Good morning,
I saw in this thread that Railway is SOC2/HIPAA compliant.
SOC 2 Type II - Railway Help Station

I am working on a very small web application for a client with <5 users and they obviously can not afford $1000/month but will need the application to be HIPAA compliant. I'm wondering if Railway has a HIPAA option for small applications that are not enterprise level.

This other thread on the subject sounds like there is possibly a $1000/year option? Quoting from the railway employee comment: "minimum spend contracts that are annual commits"
https://station.railway.com/questions/hipaa-f9adf6b8