All tools / Workspace and projects
N
On some plansIs Notion HIPAA compliant?
Checked 6 Nov 2026 from 2 vendor sources
Notion offers a free BAA only to Enterprise customers, accepted in workspace settings. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Plans other than Enterprise (vendor says Enterprise is required) | Not covered |
| Enterprise | Covered |
What the BAA leaves out
- Beta Services
- Notion Mail and Notion Calendar are handled through Google Workspace HIPAA, not described under Notion’s BAA
- Use for communicating with patients, plan members or their families or employers
- PHI in workspace, teamspace or file names, profiles, group names or support requests
How to get the BAA
An Enterprise admin goes to Settings, Workspace settings, HIPAA compliance, Activate, and accepts the signed BAA.
What the vendor says to do
- Activate under Settings, Workspace settings, HIPAA compliance and accept the BAA
- Enforce SAML SSO only login
- Use SCIM provisioning
- Set session duration
- Use Audit Log export and DLP connections
- Disable public sharing, guests, moving pages to other workspaces, export and workspace creation
- Restrict third-party extensions and review previously enabled integrations
- Configure Trash retention
Proof from the vendor
- HIPAA configuration in NotionEnterprise only, free, activation path, beta exclusion, Mail and Calendar note, configuration by safeguard
- Notion AI security & privacy practicesMentions HIPAA-compliant workflows only for zero data retention provider APIs; no BAA statement
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.