Is Databricks AI HIPAA compliant?
Only on the right plan. Databricks signs a Business Associate Agreement for Databricks AI on Enterprise tier with compliance security profile (HIPAA standard). Other plans aren't covered, so keep patient data out of them.
Does Databricks AI sign a BAA?
Only on some plans or setups
Databricks signs a BAA for workspaces on the Enterprise pricing tier that have the compliance security profile turned on with the HIPAA standard; the profile is a paid add-on. Only AI features shown in Databricks' HIPAA regional support table may be used with PHI, and preview features outside that table are not allowed.
Not fully covered by the BAA: Model Serving: Foundation Model APIs (pay-per-token), custom models, external models, ai_query, AI Playground, AI Gateway; Vector Search, AI Functions (AI Extract, AI Classify, AI ParseDocument) and Agent Bricks AI Functions; Genie Code (formerly Databricks Assistant), Genie Agents, Genie One and other AI assistive features; Preview features not listed in the HIPAA support table.
- Business associate
- Databricks
- Tool
- Databricks AI
- Plans with a BAA
- Enterprise tier with compliance security profile (HIPAA standard)
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Enterprise tier with compliance security profile (HIPAA standard) | Signs a BAA | Accept or sign online | Requires the Enterprise pricing tier and the Enhanced Security and Compliance add-on, which carries an extra charge. Turning on the compliance security profile with the HIPAA standard means accepting Databricks' BAA unless a separately negotiated one exists. The profile must be on for every workspace that touches PHI. The customer also needs its own BAA with the cloud provider (AWS or Google Cloud). On Azure Databricks, the BAA is with Microsoft instead. Other requirements include customer-managed keys or the notebook-results storage setting, and keeping PHI out of free-text fields such as workspace, job and tag names.[1],[2],[3],[4],[5] |
| Workspaces without the compliance security profile (Standard / Premium tiers, or Enterprise without the add-on) | No BAA | Not offered | Databricks' HIPAA controls require the compliance security profile, which needs the Enterprise tier and the add-on. Databricks says the profile must be on for every workspace that processes PHI, so PHI may not be processed in other workspaces.[1],[2],[3] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Databricks says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Model Serving: Foundation Model APIs (pay-per-token), custom models, external models, ai_query, AI Playground, AI GatewayEnterprise tier with compliance security profile (HIPAA standard) | Partly covered | These appear in the HIPAA page's regional support table, but only in some regions or columns, and the fetched table lost its column headers, so per-region support could not be confirmed. Databricks notes the table may list features before they are released. Check the live table for your region before sending PHI.[1],[4] |
| Vector Search, AI Functions (AI Extract, AI Classify, AI ParseDocument) and Agent Bricks AI FunctionsEnterprise tier with compliance security profile (HIPAA standard) | Partly covered | Listed in the HIPAA regional support table with checkmarks in only some columns. Other Agent Bricks features (for example Knowledge Assistant, Supervisor Agent) are listed separately or not at all, so confirm each one in the table.[1],[4],[5] |
| Genie Code (formerly Databricks Assistant), Genie Agents, Genie One and other AI assistive featuresEnterprise tier with compliance security profile (HIPAA standard) | Partly covered | In compliance-profile workspaces the 'partner-powered AI features' setting is off by default. With it off, the Databricks-hosted models behind Genie Code are available in HIPAA workspaces, but Genie Code's agentic mode, Genie Agents chat and agent modes, Genie App Builder and synthetic data generation are unavailable. With it on, features use Azure OpenAI, OpenAI on Databricks or Anthropic on Databricks. Account-level Genie One does not pull data from compliance-profile workspaces. Databricks says the setting is being removed on November 1, 2026.[3],[6],[7] |
| Preview features not listed in the HIPAA support tableEnterprise tier with compliance security profile (HIPAA standard) | Excluded | Databricks tells customers not to use preview features to process PHI unless the feature appears in the regional support table.[1],[5] |
Cloud AI platforms that offer a BAA
- Azure OpenAIBAA on: Azure subscription (EA / MCA / CSP), Models sold by Azure incl. Azure OpenAISome plans only
- Cloudflare Workers AIBAA on: EnterpriseSome plans only
- IBM watsonx.aiBAA on: watsonx.ai Runtime HIPAA-Ready planSome plans only
- Snowflake Cortex AIBAA on: Business Critical / Virtual Private Snowflake (VPS)Some plans only
- SupabaseBAA on: Team / Enterprise with HIPAA add-onSome plans only
- Amazon BedrockBAA on: AWS accounts (standard AWS BAA)Signs a BAA
All BAA-ready alternatives to Databricks AI
Compare Databricks AI
- Databricks AI vs Snowflake Cortex AISnowflake Cortex AI: some plans
Sources
- HIPAA (Databricks on AWS)
- Enhanced security and compliance add-on
- Compliance security profile
- HIPAA (Databricks on Google Cloud)
- HIPAA (Azure Databricks)
- Partner-powered AI features
- Databricks AI assistive features trust and safety
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.