Update compliance-overview.md

docs/en/cloud/security/compliance-overview.md

@@ -19,6 +19,14 @@ International Standards Organization (ISO) 27001 is an international standard fo
 
 The U.S. Data Privacy Framework was developed to provide U.S. organizations with reliable mechanisms for personal data transfers from the United States to the European Union/ European Economic Area, the United Kingdom, and Switzerland that are consistent with EU, UK and Swiss law (https://dataprivacyframework.gov/Program-Overview). ClickHouse self-certified to the framework and is listed on the [Data Privacy Framework List](https://dataprivacyframework.gov/list)).
 
+### HIPAA
+
+:::note HIPAA ready services are in private beta in GCP, only available with Dedicated services. A Business Associate Agreement (BAA) is required for onboarding. Please contact sales for more information.:::
+
+The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is a United States based privacy law focused on management of protected health information (PHI). HIPAA has several requirements, including the [Security Rule](https://www.hhs.gov/hipaa/for-professionals/security/index.html), which is focused on protecting electronic personal health informatino (ePHI). ClickHouse has implemented administrative, physical and technical safeguards to ensure the confidentiality, integrity and security of ePHI stored in designated services. We plan to add HIPAA to our SOC 2 in early 2025 to add external assurance of our compliance program.
+
+Customers wishing to load ePHI to services should review our [shared responsibility model](/docs/en/cloud/security/shared-responsibility/model) to review, select and implement appropriate controls for their use case.
+
 # Privacy Compliance
 
 In addition to the items above, ClickHouse maintains internal compliance programs addressing the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA) and other relevant privacy frameworks. Details on personal data that ClickHouse collects, how it is used, how it is protected and other privacy related information can be found in the following locations.