No Webflow offers no BAA on any plan (Starter, Basic, CMS, Business, Enterprise), and site hosting, CMS and native form submissions are excluded because Webflow's Terms of Service, section 3.6, prohibit PHI. Verdict date: 2026-10-28.
Short answer
Webflow does not sign a BAA on any plan. Its Terms require customers not to provide PHI, and its security page says the platform is not designed to store or process PHI. For definitions of BAA and PHI, see the HIPAA glossary.
Webflow's security page also says most marketing and informational sites fall outside HIPAA's scope. For regulated use cases, it points to pairing Webflow with custom hosting or compliant backends. "Outside scope" here means the site collects no PHI. A person at your organization has to confirm that for each site. Webflow's statement does not make any site automatically in or out of scope.
The full list of vendor checks is at Is it HIPAA compliant? All vendors.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Starter | Not available | Not applicable, no BAA offered | Not applicable |
| Basic | Not available | Not applicable, no BAA offered | Not applicable |
| CMS | Not available | Not applicable, no BAA offered | Not applicable |
| Business | Not available | Not applicable, no BAA offered | Not applicable |
| Enterprise | Not available | Not applicable, no BAA offered | Not applicable |
Even the highest tier is excluded, so upgrading does not change the answer.
What the BAA covers and what it excludes
Covered: none, because no BAA exists.
Excluded:
- Site hosting
- CMS
- Native form submissions
All three are excluded because Terms section 3.6 prohibits PHI. The Terms also bar customers from enabling end users to submit PHI through Website Content. That is why contact forms, appointment-request forms and patient intake forms are the main risk on a clinic site. A "Describe your symptoms" field on a Webflow form is enough to put PHI on a platform that has not agreed to handle it.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Yes |
| SSO | Yes |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Yes |
These controls are not a substitute for a BAA. SOC 2 and ISO 27001 describe how a vendor runs its security program; they do not make a platform eligible for PHI. The table lists what the vendor publishes and is not an audit.
How to use Webflow with PHI
Webflow should not hold PHI. If it sits in front of a clinic workflow, the responsibility for keeping PHI out of it is yours:
- Do not collect PHI through Webflow forms or the CMS.
- Keep patient intake, scheduling and messaging on a system that signs a BAA, and link to it from the site rather than embedding PHI fields.
- Confirm that each embedded or linked third-party tool, such as a scheduling widget or chat plug-in, has its own BAA.
- Review the site's analytics and tracking scripts for PHI exposure, such as appointment-type URLs or form values passed to ad platforms.
- Record the decision in your vendor inventory: Webflow in use, no BAA, no PHI permitted.
- Train staff not to paste PHI into the CMS, for example patient stories or testimonials with identifying details.
- Re-check Webflow's Terms before any change of use. Other website platforms are checked on pages such as Is WordPress HIPAA compliant?.
Compliance depends on the signed BAA, configuration and policies. Here, no BAA exists.
Alternatives with a BAA
These website options have a conditional verdict. Each BAA is limited to specific plans and services, so read each vendor card before you build on it.
- Bubble: conditional, BAA from Dedicated Enterprise (HIPAA add-on).
- Is GoDaddy HIPAA compliant?: conditional, covering Microsoft 365 email on plans GoDaddy represents as HIPAA-compliant.
- Is Squarespace HIPAA compliant?: conditional, via Acuity Scheduling Premium (Powerhouse).
- Is Wix HIPAA compliant?: conditional, from the Business plan.
Browse more options in HIPAA-compliant software by category.
Sources
- Terms | Webflow — Terms, checked 2026-10-28. "3.6 HIPAA Non-Compliance. You acknowledge that the Platform may not be compliant with the Health Insurance Portability and Accountability Act and amendments thereto ("HIPAA") and you agree not to provide or enable End Users to provide Protected Health Information, as defined in HIPAA, in the Website Content or otherwise in connection with your use of the Platform."
- Terms | Webflow — Terms, checked 2026-10-28. "Please do not collect Protected Health Information using the Platform as Webflow does not offer HIPAA compliant services at the present time."
- Webflow Security & Compliance — Trust center, checked 2026-10-28. "Webflow is not HIPAA compliant by default and is not designed to store or process protected health information. Most marketing and informational sites built on Webflow don't handle sensitive data, keeping them outside HIPAA scope. For regulated use cases, Webflow can be used alongside custom hosting or compliant backends."
- Webflow Security & Compliance — Trust center, checked 2026-10-28. "TLS 1.2+ for all sites and encrypted data at rest. HSTS enforced by default. Enterprise support for custom SSL certificates and custom security headers."
- Webflow Security & Compliance — Trust center, checked 2026-10-28. "Webflow pairs this managed approach with SOC 2 Type II compliance and ISO 27001 certification, along with features like custom security headers and granular access controls"
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
FAQ
Is Webflow HIPAA compliant?
No BAA is available, so the verdict is no. Webflow's Terms (section 3.6) require customers not to provide PHI, and its security page says the platform is not designed to store or process PHI.
Does Webflow sign a BAA on any plan, including Enterprise?
No. Starter, Basic, CMS, Business and Enterprise all have no BAA, so upgrading does not change the answer.
Can I collect patient information with Webflow forms?
No. Native form submissions are excluded, and the Terms bar enabling end users to submit PHI in Website Content. Use a form or intake system that signs a BAA instead.
Can a clinic marketing website be built on Webflow if it collects no PHI?
Webflow's security page says most marketing and informational sites fall outside HIPAA's scope. That depends on the site collecting no PHI, which your team must confirm for each site, including forms, embeds and tracking.