Notion AI vs ClickUp Brain: which signs a HIPAA BAA?
Both can be covered by a BAA, on different terms. Notion Labs signs one for Notion AI only on Enterprise. ClickUp signs one for ClickUp Brain only on Enterprise.
- Business associate
- Notion Labs
- Tool
- Notion AI
- Plans with a BAA
- Enterprise
- Checked
Some plans only
- Business associate
- ClickUp
- Tool
- ClickUp Brain
- Plans with a BAA
- Enterprise
- Checked
Some plans only
Side by side
| Notion AINotion Labs | ClickUp BrainClickUp | |
|---|---|---|
| BAA | Some plans only | Some plans only |
| Plans with a BAA | Enterprise | Enterprise |
| How to get it | Accept or sign online | Not stated |
| AI features outside the BAA partly covered excluded |
|
|
| Sources | 5 sources | 5 sources |
| Last checked | Oct 11, 2026 | Oct 11, 2026 |
Every plan
Notion AI
- Free / Plus / BusinessNotion says a workspace must be on the Enterprise plan to be eligible to sign its BAA.No BAA
- EnterpriseTurn it on under Settings > Workspace settings > HIPAA compliance > Activate, then accept the BAA. It is free on Enterprise. Recommended setup includes SAML SSO only, SCIM, no public sharing, guests, or exports, custom retention, and audit logs. PHI is not allowed in workspace, file, or teamspace names, profiles, or support requests.Signs a BAA
ClickUp Brain
- Free / Unlimited / BusinessClickUp's own materials say HIPAA support is limited to the Enterprise plan.No BAA
- EnterpriseClickUp says it can support HIPAA for Enterprise customers by agreeing to a BAA. Enterprise is sold through sales, but no page describes how the BAA itself is requested or signed.Signs a BAA
If you handle patient data
Either can work. Choose on features and price, then make sure you’re on a plan listed above and the BAA is signed before anyone enters protected health information. Keep PHI out of the AI features listed as outside the BAA.
More comparisons
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.