Conditional A BAA is available through an Adobe sales representative for Adobe's HIPAA-Ready Services (Acrobat Sign Solutions for enterprise and Acrobat Sign for Government). The main exclusion is that Acrobat individual and team subscriptions, including Acrobat Pro, are not listed. Last verified 2026-10-20.
Short answer
Adobe acts as a Business Associate only for the services on its HIPAA-Ready list. In Document Cloud, those are Acrobat Sign (enterprise), Acrobat Sign for Government, Analyzer in Acrobat and Knowledge Base in Acrobat. Definitions of BAA and PHI are in the HIPAA glossary (BAA, PHI).
For the "Acrobat Pro" and "Adobe Pro" variants of the question: Acrobat Pro and Acrobat Web as a whole are not on the list. Adobe's trust page says customers may not create, receive, maintain or transmit PHI through products that are not listed. The exact wording is quoted under Sources.
In practice, a clinic that edits scanned referral PDFs in an Acrobat Pro subscription has no BAA path stated for that use. A hospital that sends consent forms through Acrobat Sign Solutions for enterprise can request one.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Acrobat Sign Solutions for enterprise | Available | Contact an Adobe sales representative; requires the correct license and a signed BAA | Not published by the vendor |
| Acrobat Sign for Government | Available | Contact an Adobe sales representative; requires the correct license and a signed BAA | Not published by the vendor |
| Acrobat individual and team subscriptions | Not listed as HIPAA-Ready; no BAA path stated | Not published by the vendor | Not published by the vendor |
Minimum seats: Not published by the vendor.
What the BAA covers and what it excludes
Covered (HIPAA-Ready Services):
- Adobe Acrobat Sign
- Adobe Acrobat Sign for Government
- Analyzer in Acrobat
- Knowledge Base in Acrobat
Excluded:
- Acrobat Web
- Acrobat Services
- Acrobat AI Assistant
- Acrobat Studio
Coverage depends on holding the correct license and having a signed BAA, not on using a product with a listed name. Check that the license on your invoice matches the listed service before any PHI enters it.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Absence from the checked pages is not proof that a control is missing. Evaluators should request Adobe's security documentation during procurement.
How to use Adobe Acrobat with PHI
Compliance depends on the signed BAA, your configuration and your organization's own policies. Adobe's BAA does not make an organization compliant by itself.
- Confirm the exact service and license you hold appear on Adobe's HIPAA-Ready list.
- Sign the BAA with Adobe before any PHI enters the service.
- Keep PHI out of Acrobat Web, Acrobat Services, Acrobat AI Assistant and Acrobat Studio. This includes uploading a lab report to summarize it with the AI Assistant.
- Restrict who can use the covered service and document who has access.
- Train front-desk and billing staff on which Adobe tools are allowed, so a desktop Acrobat Pro install is not used for signed intake packets.
- Review the HIPAA-Ready list again at each renewal or license change.
Alternatives with a BAA
All of the following are conditional. Each depends on the named plan and a signed BAA. The full list is in Is it HIPAA compliant? All vendors.
- Adobe Acrobat Sign: conditional, from Acrobat Sign Solutions for enterprise.
- Box: conditional, Enterprise plan. Is Box HIPAA compliant?
- DocHub: conditional, Site License.
- DocuSign: conditional, Enhanced plans via contact sales.
- Dropbox Sign: conditional, Standard annual plan.
For related file sharing, see Is Dropbox HIPAA compliant?.
Category comparisons: HIPAA-compliant document management software and HIPAA-compliant electronic signature software.
Sources
- HIPAA-Ready Services – Adobe Trust Center — Trust center, checked 2026-10-20. "Adobe acts as a Business Associate for its HIPAA-Ready Services, which are listed below."
- HIPAA-Ready Services – Adobe Trust Center — Trust center, checked 2026-10-20. "must have the correct license and a signed BAA with Adobe"
- HIPAA-Ready Services – Adobe Trust Center — Trust center, checked 2026-10-20. "Customers are not permitted to create, receive, maintain, or transmit PHI through Adobe products and services"
- Adobe Compliance List – Adobe Trust Center — Trust center, checked 2026-10-20. "Adobe Document Cloud, Acrobat Sign Solutions for enterprise"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Is Adobe Acrobat Pro HIPAA compliant?
Acrobat Pro is not listed as a HIPAA-Ready Service, and no BAA path is stated for individual or team subscriptions. Adobe's trust page says PHI may not be processed through non-listed products.
Does Adobe sign a BAA, and how do I get one?
Yes, for HIPAA-Ready Services. Contact an Adobe sales representative. A BAA requires the correct license and a signed agreement. Pricing and seat minimums are not published by the vendor.
Which Adobe Acrobat services are covered by a BAA?
Adobe Acrobat Sign (enterprise), Adobe Acrobat Sign for Government, Analyzer in Acrobat and Knowledge Base in Acrobat.
Can I use Acrobat AI Assistant or Acrobat Web with PHI?
No. Acrobat AI Assistant and Acrobat Web are both on the exclusions list, along with Acrobat Services and Acrobat Studio. Keep PHI out of them.