AI Vendor BAA CheckCheck your tool list

Is Cloudflare Workers AI HIPAA compliant?

Only on the right plan. Cloudflare signs a Business Associate Agreement with its customers on Enterprise. Other plans aren't covered, so keep patient data out of them. Cloudflare doesn't say whether the BAA covers all of its AI features.

Does Cloudflare Workers AI sign a BAA?

Only on some plans or setups

Cloudflare signs BAAs only with Enterprise customers, and its pages do not say whether that BAA covers Workers AI. For Free and pay-as-you-go accounts there is no BAA, so Workers AI should not receive PHI there.

Based on 4 sources, all from Cloudflare unless marked.

Not fully covered by the BAA: AI Gateway calls to third-party model providers.

Not confirmed for the AI features: Cloudflare doesn’t say whether its BAA covers Workers AI inference (serverless models on Cloudflare's network). Get that in writing before using it with patient data.

Business associate
Cloudflare
Tool
Cloudflare Workers AI
Plans with a BAA
Enterprise
Checked
Some plans only
Cloudflare signs only for the plans listed; AI coverage isn't stated.

By plan

PlanBAAHow to get itConditions
EnterpriseConditions applyThrough salesCloudflare enters into BAAs only with Enterprise customers. An older Cloudflare HIPAA whitepaper describes the BAA as non-negotiable, subject to minimum spend, and arranged through sales. It names CDN, WAF and Bot Management as examples but does not mention Workers or Workers AI, so whether the BAA reaches Workers AI must be confirmed with Cloudflare.[1],[2]
Free / Workers Paid (pay-as-you-go)No BAANot offeredCloudflare's HIPAA page says it signs BAAs only with Enterprise customers.[1]

Are the AI features covered?

Vendors often sign a BAA for the core product but leave some AI features out. Here is what Cloudflare says about each one.

AI featureUnder the BAADetails
Workers AI inference (serverless models on Cloudflare's network)EnterpriseNot statedNo Cloudflare page checked lists Workers AI as inside or outside the BAA. Cloudflare says it does not train on customer content and describes the models as third-party products.[1],[3],[4]
AI Gateway calls to third-party model providersEnterpriseExcludedCloudflare's terms say its Data Processing Addendum and Information Security Exhibit do not apply to third-party products reached through AI Gateway, so data sent onward is outside Cloudflare's data protection commitments.[4]

Cloud AI platforms that offer a BAA

  • Azure OpenAIBAA on: Azure subscription (EA / MCA / CSP), Models sold by Azure incl. Azure OpenAISome plans only
  • Databricks AIBAA on: Enterprise tier with compliance security profile (HIPAA standard)Some plans only
  • IBM watsonx.aiBAA on: watsonx.ai Runtime HIPAA-Ready planSome plans only
  • Snowflake Cortex AIBAA on: Business Critical / Virtual Private Snowflake (VPS)Some plans only
  • SupabaseBAA on: Team / Enterprise with HIPAA add-onSome plans only
  • Amazon BedrockBAA on: AWS accounts (standard AWS BAA)Signs a BAA

All BAA-ready alternatives to Cloudflare Workers AI

Sources

  1. Cloudflare and HIPAA complianceCloudflare, Trust center. Checked Oct 13, 2026. Archived copy
  2. Cloudflare HIPAA privacy compliance whitepaperCloudflare, Documentation. Checked Oct 13, 2026. Archived copy
  3. Workers AI data usageCloudflare, Documentation. Checked Oct 13, 2026. Archived copy
  4. Service-Specific Terms: Developer PlatformCloudflare, Legal terms. Checked Oct 13, 2026. Archived copy

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.