Is Baseten HIPAA compliant?
Baseten signs a Business Associate Agreement with its customers, which HIPAA requires before a vendor handles patient data for you. Once it's signed, you can use Baseten with patient data within the BAA's scope; whether your use is compliant still depends on your setup and your own policies. Baseten doesn't say whether the BAA covers all of its AI features.
Does Baseten sign a BAA?
Yes, it signs a BAA
Baseten publishes a standard BAA that customers can sign by emailing support or by adding it to an order form. Its terms bar PHI until a BAA is in effect, and no plan restriction is stated. Whether the BAA covers its shared Model APIs for third-party models is not spelled out.
Not confirmed for the AI features: Baseten doesn’t say whether its BAA covers Model APIs (shared endpoints for third-party models); Beta and preview features. Get that in writing before using them with patient data.
- Business associate
- Baseten
- Tool
- Baseten
- Plans with a BAA
- All plans (Basic, Pro, Enterprise)
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| All plans (Basic, Pro, Enterprise) | Signs a BAA | Request by emailsupport@baseten.co | The BAA is not in effect by default. It applies once both sides sign it (DocuSign accepted) or once it is referenced in an order form. The Terms (section 3.2) bar sending PHI until a BAA is in effect. The pricing page lists 'HIPAA compliant' on the free Basic plan, and no page limits the BAA to a particular plan.[1],[2],[3] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Baseten says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Dedicated model deployments, training and fine-tuning on Baseten | Covered | The BAA covers PHI handled in connection with the Services, which the Terms define as Baseten's inference platform including deployment, orchestration and training. No product exclusions are listed.[1],[2] |
| Model APIs (shared endpoints for third-party models) | Not stated | The Terms treat models offered through Model APIs as Third-Party Products. The BAA does not name Model APIs as included or excluded, so confirm with Baseten.[1],[2] |
| Beta and preview features | Not stated | Preview features come as-is with no commitments under the Terms; neither the Terms nor the BAA say how the BAA applies to them.[2] |
Sources
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.