Notion offers a BAA on the Enterprise plan only. Free, Plus and Business workspaces are not covered, so they should not hold PHI. Notion AI is covered on Enterprise, and several content types stay excluded even there. This page is a reference summary of Notion's published terms, not legal advice or an audit.
Is Notion HIPAA compliant? Verdict
Conditional BAA available on the Enterprise plan only, for the Notion workspace and Notion AI; the main exclusions are the Free, Plus and Business plans and Beta Services (checked 2026-10-19).
See Is it HIPAA compliant? All vendors for other vendors.
Short answer
A BAA is available on Notion's Enterprise plan. A workspace owner activates it in workspace settings at no extra charge. It covers the Notion workspace and Notion AI, which runs through zero-retention LLM APIs. Free, Plus and Business plans and Beta Services are not covered.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Free | Not available | n/a | n/a |
| Plus | Not available | n/a | n/a |
| Business | Not available | n/a | n/a |
| Enterprise | Available | The workspace owner goes to Settings > Workspace settings > HIPAA compliance > Activate, then reviews and accepts the BAA. Notion emails a confirmation. | None. Minimum seat count: Not published by the vendor |
Notion's help article on HIPAA states that eligibility requires the Enterprise plan.
Practical consequence: a clinic using a Business workspace for its staff wiki cannot move PHI into it by upgrading settings. It needs the Enterprise plan and an accepted BAA first.
What the BAA covers and what it excludes
Covered:
- The Enterprise workspace (pages, databases and teamspaces) under the HIPAA configuration.
- Notion AI, which uses zero-retention APIs.
Excluded:
- Beta Services.
- Communicating with patients, plan members, families or employers.
- PHI in workspace, organization or teamspace names, file names, user profiles and group names.
- PHI in support requests and their attachments.
- Guest access, except through approved guest requests.
The naming exclusions matter in day-to-day use. A page body can hold PHI under the BAA, but a file uploaded as Smith_J_MRI_2026.pdf or a teamspace named after a patient group puts PHI in a place Notion does not cover. Staff need a naming convention that uses internal case numbers instead of names. A support ticket with a screenshot of a patient record also falls outside the BAA.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Yes |
| SSO | Yes |
| Data residency | Available to Enterprise customers only (data stored in a specified region) |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Yes |
Audit log wording comes from Notion's pricing page. Data residency is available to Enterprise customers only.
These are vendor-reported controls. A control listed here does not extend the BAA beyond the scope above.
How to use Notion with PHI
The BAA is one part of the arrangement. The customer's configuration and policies decide whether PHI stays inside the covered scope. See the HIPAA glossary (BAA, PHI) for terms.
- Confirm the workspace is on the Enterprise plan.
- Activate and accept the BAA before any PHI enters the workspace.
- Keep PHI out of workspace and teamspace names, file names, user profiles and group names.
- Do not use Beta Services with PHI.
- Keep PHI out of support requests and attachments.
- Limit guests to approved guest requests.
- Before using Notion AI on PHI, confirm that zero data retention applies to your workspace.
Do not use Notion to communicate with patients, plan members, families or employers.
Alternatives with a BAA
These vendors also have conditional verdicts on this site. Each requires its own BAA and plan check.
| Vendor | Verdict | BAA starting plan |
|---|---|---|
| Adobe Acrobat | Conditional | Acrobat Sign Solutions for enterprise |
| Adobe Acrobat Sign | Conditional | Acrobat Sign Solutions for enterprise |
| Box | Conditional | Enterprise |
| DocHub | Conditional | Site License |
| Google Docs | Conditional | Google Workspace (Business Starter, Business Standard, Business Plus, Enterprise, Education, Nonprofits) and Cloud Identity accounts managed in the Admin console |
Category tables compare more options: HIPAA-compliant project management software, HIPAA-compliant document management software and HIPAA-compliant office suites.
Sources
- HIPAA configuration – Notion Help Center — Help article, checked 2026-10-19. "To be eligible to sign Notion's BAA, you must subscribe to our Enterprise Plan."
- Notion Security & Compliance | SOC 2 Certified, trusted by Enterprises — Trust center, checked 2026-10-19. "Businesses subject to HIPAA can leverage Notion's Enterprise-grade HIPAA security features."
- Meet your AI team | Notion — Vendor page, checked 2026-10-19. "Notion AI enables HIPAA compliance by utilizing LLM provider’s zero-retention APIs"
- Notion AI security & privacy practices – Notion Help Center — Help article, checked 2026-10-19. "For workspaces with zero data retention in effect, our providers' zero-retention APIs support HIPAA-compliant workflows."
- Pricing – Notion — Pricing page, checked 2026-10-19. "Access a detailed log of security and safety-related activity for your workspace account."
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
Changes and FAQ
No changes recorded since first verification on 2026-10-19. See Recent changes in vendor HIPAA status.
Does Notion sign a BAA?
Yes, on the Enterprise plan. The workspace owner activates it under Workspace settings > HIPAA compliance, reviews and accepts it, and receives an email confirmation. There is no extra charge.
Is Notion AI covered by the BAA?
On Enterprise, yes. Notion AI is covered through zero-retention LLM APIs. It is not covered on other plans, because they have no BAA.
Can I use Notion on the Free, Plus or Business plan with PHI?
No. A BAA is not available on those plans, so PHI should not be stored there.
Can I put PHI in page titles, file names or support tickets?
No. PHI in workspace, organization or teamspace names, file names, user profiles and group names is excluded from the BAA. PHI in support requests and their attachments is excluded too.