AI Vendor BAA CheckCheck your tool list

Databricks AI vs Snowflake Cortex AI: which signs a HIPAA BAA?

Both can be covered by a BAA, on different terms. Databricks signs one for Databricks AI only on Enterprise tier with compliance security profile (HIPAA standard). Snowflake signs one for Snowflake Cortex AI only on Business Critical / Virtual Private Snowflake (VPS).

Business associate
Databricks
Tool
Databricks AI
Plans with a BAA
Enterprise tier with compliance security profile (HIPAA standard)
Checked
Some plans only
Databricks signs only for the plans listed.

Databricks AI: plan-by-plan breakdown and sources

Business associate
Snowflake
Tool
Snowflake Cortex AI
Plans with a BAA
Business Critical / Virtual Private Snowflake (VPS)
Checked
Some plans only
Snowflake signs only for the plans listed.

Snowflake Cortex AI: plan-by-plan breakdown and sources

Side by side

Databricks AIDatabricksSnowflake Cortex AISnowflake
BAASome plans onlySome plans only
Plans with a BAAEnterprise tier with compliance security profile (HIPAA standard)Business Critical / Virtual Private Snowflake (VPS)
How to get itAccept or sign onlineThrough sales
AI features outside the BAA partly covered excluded
  • Model Serving: Foundation Model APIs (pay-per-token), custom models, external models, ai_query, AI Playground, AI Gateway
  • Vector Search, AI Functions (AI Extract, AI Classify, AI ParseDocument) and Agent Bricks AI Functions
  • Genie Code (formerly Databricks Assistant), Genie Agents, Genie One and other AI assistive features
  • Preview features not listed in the HIPAA support table
None listed
Sources7 sources5 sources
Last checkedOct 13, 2026Oct 13, 2026

Plan by plan

Databricks AI

  • Enterprise tier with compliance security profile (HIPAA standard)Requires the Enterprise pricing tier and the Enhanced Security and Compliance add-on, which carries an extra charge. Turning on the compliance security profile with the HIPAA standard means accepting Databricks' BAA unless a separately negotiated one exists. The profile must be on for every workspace that touches PHI. The customer also needs its own BAA with the cloud provider (AWS or Google Cloud). On Azure Databricks, the BAA is with Microsoft instead. Other requirements include customer-managed keys or the notebook-results storage setting, and keeping PHI out of free-text fields such as workspace, job and tag names.Signs a BAA
  • Workspaces without the compliance security profile (Standard / Premium tiers, or Enterprise without the add-on)Databricks' HIPAA controls require the compliance security profile, which needs the Enterprise tier and the add-on. Databricks says the profile must be on for every workspace that processes PHI, so PHI may not be processed in other workspaces.No BAA

Snowflake Cortex AI

  • Business Critical / Virtual Private Snowflake (VPS)Snowflake's editions page lists PHI support only for Business Critical and VPS, and says a signed BAA with Snowflake must be in place before storing PHI. No self-serve signing process is published.Signs a BAA
  • Standard / Enterprise editionsThese editions are not listed as supporting PHI. Cortex AI functions are available on every edition, but PHI support is not.No BAA

If you handle patient data

Either can work. Choose on features and price, then make sure you’re on a plan listed above and the BAA is signed before anyone enters protected health information. Keep PHI out of the AI features listed as outside the BAA.

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.