Is IBM watsonx.ai HIPAA compliant?
Only on the right plan. IBM signs a Business Associate Agreement for IBM watsonx.ai on watsonx.ai Runtime HIPAA-Ready plan. Other plans aren't covered, so keep patient data out of them.
Does IBM watsonx.ai sign a BAA?
Only on some plans or setups
IBM offers watsonx.ai under its BAA only through a separate HIPAA-Ready plan for watsonx.ai Runtime ($1,800 a month instance fee, Dallas region, enabled by IBM Sales). That plan covers foundation model inferencing, embeddings and reranking, but many features, including tuning, agents, AutoAI and vector indexes, are not available on it.
Not fully covered by the BAA: Tuning, custom and deploy-on-demand models, AutoAI, AI services, Agent Lab, guardrails, text extraction, vector index; Cloud Pak for Data as a Service projects.
- Business associate
- IBM
- Tool
- IBM watsonx.ai
- Plans with a BAA
- watsonx.ai Runtime HIPAA-Ready plan
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| watsonx.ai Runtime HIPAA-Ready plan | Signs a BAA | Through sales | IBM requires agreeing to its Business Associate Addendum for the IBM Cloud account. The plan is off by default: send your IBM Cloud account ID to IBM Sales to enable it. Sign up in the Dallas (US South) region and create a new HIPAA-Ready instance (existing instances can't be upgraded). Use new blank projects, paired with a new watsonx.ai Studio Professional instance. $1,800 per month instance fee plus Standard-rate usage.[1],[2],[3] |
| Lite / Essentials / Standard plans | Not confirmed | Not stated | IBM's admin setup guide says HIPAA readiness comes with the HIPAA-Ready plan. The other plans are not described as HIPAA-ready, but no page states they are barred from PHI.[2],[3] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what IBM says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Foundation model inferencing, prompt template deployments, text embeddings and reranking APIswatsonx.ai Runtime HIPAA-Ready plan | Covered | Listed as available on the HIPAA-Ready plan.[2] |
| Tuning, custom and deploy-on-demand models, AutoAI, AI services, Agent Lab, guardrails, text extraction, vector indexwatsonx.ai Runtime HIPAA-Ready plan | Excluded | IBM lists these as not available on the HIPAA-Ready plan, along with batch and online deployments, Decision Optimization, SPSS Modeler, RStudio, Synthetic Data Generator and Data Refinery flows.[2] |
| Cloud Pak for Data as a Service projectswatsonx.ai Runtime HIPAA-Ready plan | Excluded | IBM says HIPAA-compliant projects can't be used on Cloud Pak for Data as a Service.[2] |
Cloud AI platforms that offer a BAA
- Azure OpenAIBAA on: Azure subscription (EA / MCA / CSP), Models sold by Azure incl. Azure OpenAISome plans only
- Cloudflare Workers AIBAA on: EnterpriseSome plans only
- Databricks AIBAA on: Enterprise tier with compliance security profile (HIPAA standard)Some plans only
- Snowflake Cortex AIBAA on: Business Critical / Virtual Private Snowflake (VPS)Some plans only
- SupabaseBAA on: Team / Enterprise with HIPAA add-onSome plans only
- Amazon BedrockBAA on: AWS accounts (standard AWS BAA)Signs a BAA
All BAA-ready alternatives to IBM watsonx.ai
Sources
- IBM Cloud compliance: HIPAA
- watsonx.ai Runtime service plans
- Setting up the IBM watsonx platform for administrators
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.