Are Modal's AI features covered by the BAA?

Serverless GPU functions and inference endpoints (including Volumes v2 and filesystem/directory snapshots): covered by the baa. Volumes v1, Images, Memory Snapshots and user code: excluded from the baa. Sandboxes, Dicts, Queues and logs: coverage not stated.

Is Modal HIPAA compliant?

Q: Does Modal sign a HIPAA BAA?

Only on some plans or setups. Modal signs BAAs only with Enterprise customers; its Starter and Team plans don't include HIPAA. Even under the BAA, PHI must stay out of Volumes v1, container Images, Memory Snapshots and user code.

Only on the right plan. Modal signs a Business Associate Agreement with its customers on Enterprise. Other plans aren't covered, so keep patient data out of them. Modal doesn't say whether the BAA covers all of its AI features.

Does Modal sign a BAA?

Only on some plans or setups

Modal signs BAAs only with Enterprise customers; its Starter and Team plans don't include HIPAA. Even under the BAA, PHI must stay out of Volumes v1, container Images, Memory Snapshots and user code.

Based on 3 sources, all from Modal unless marked.

Not fully covered by the BAA: Volumes v1, Images, Memory Snapshots and user code.

Not confirmed for the AI features: Modal doesn’t say whether its BAA covers Sandboxes, Dicts, Queues and logs. Get that in writing before using it with patient data.

Business associate: Modal
Tool: Modal
Plans with a BAA: Enterprise
Checked: Oct 13, 2026

Some plans only

Modal signs only for the plans listed; AI coverage isn't stated.

By plan

Plan	BAA	How to get it	Conditions
Enterprise	Signs a BAA	Through salessales@modal.com	Modal's pricing page marks HIPAA as included only on Enterprise. The security docs say to contact sales@modal.com to start HIPAA on Enterprise; the 2024 announcement named security@modal.com for BAA requests.[1],[2],[3]
Starter / Team	No BAA	Not offered	The pricing page marks HIPAA as not included on these plans, and Modal says it only enters BAAs with Enterprise customers.[2],[3]

Are the AI features covered?

Vendors often sign a BAA for the core product but leave some AI features out. Here is what Modal says about each one.

AI feature	Under the BAA	Details
Serverless GPU functions and inference endpoints (including Volumes v2 and filesystem/directory snapshots)Enterprise	Covered	Modal's announcement says all features are covered except the listed exclusions. Volumes v2 is the recommended storage for PHI, and filesystem and directory snapshots are carved out of the Images exclusion.[1],[3]
Volumes v1, Images, Memory Snapshots and user codeEnterprise	Excluded	Modal lists these as out of scope for PHI.[1],[3]
Sandboxes, Dicts, Queues and logsEnterprise	Not stated	Not named on the current out-of-scope list. The 2024 announcement says everything not excluded is covered, but the current docs don't list in-scope products, so confirm newer features with Modal.[1],[3]

LLM APIs that offer a BAA

Claude API (Claude Platform)BAA on: First-party API (custom / negotiated BAA), First-party API (self-serve Console enablement)Some plans only
CohereBAA on: Custom model development engagementSome plans only
GroqCloudBAA on: GroqCloud paid, generally available services (customers with an existing Groq agreement)Some plans only
Hugging FaceBAA on: EnterpriseSome plans only
BasetenBAA on: All plans (Basic, Pro, Enterprise)Signs a BAA
OpenAI API platformBAA on: API (enterprise / sales-managed accounts), API (pay-as-you-go / self-serve organizations), API FedRAMP (with Modified Retention)Signs a BAA

All BAA-ready alternatives to Modal

Sources

Security and privacy at ModalModal, Documentation. Checked Oct 13, 2026. Archived copy
Plan pricingModal, Documentation. Checked Oct 13, 2026. Archived copy
Modal is now HIPAA compliantModal, Announcement. Checked Oct 13, 2026. Archived copy

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.