Does Notion AI sign a BAA?
Only on some plans or setups
Notion signs a BAA only on its Enterprise plan, where admins turn on HIPAA compliance and accept the BAA in settings. Notion says Notion AI and AI Connectors support PHI through zero-retention LLM APIs. Beta features are excluded; Notion does not say whether its BAA covers Notion Mail, Notion Calendar or AI Meeting Notes.
Not fully covered by the BAA: Beta AI features.
- Business associate
- Notion Labs
- Tool
- Notion AI
- Plans with a BAA
- Enterprise
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Free / Plus / Business | No BAA | Not offered | Notion says a workspace must be on the Enterprise plan to be eligible to sign its BAA.[1] |
| Enterprise | Signs a BAA | Accept or sign online | Turn it on under Settings > Workspace settings > HIPAA compliance > Activate, then accept the BAA. It is free on Enterprise. Recommended setup includes SAML SSO only, SCIM, no public sharing, guests, or exports, custom retention, and audit logs. PHI is not allowed in workspace, file, or teamspace names, profiles, or support requests.[1],[2] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Notion Labs says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Notion AI (core writing, Q&A, chat)Enterprise | Covered | Notion says Notion AI supports HIPAA compliance and PHI processing through LLM providers' zero-retention APIs. Zero retention is the default on Enterprise workspaces.[3] |
| AI features that use data-retaining LLMs (admin opt-in)Enterprise | Not stated | Some AI features need LLMs that retain data. These are off by default, and admins can turn them on. Notion's HIPAA claim refers to zero-retention APIs, and Notion does not say whether these opt-in features are covered.[3] |
| Enterprise Search / AI ConnectorsEnterprise | Covered | Notion's Enterprise Search page says AI Connectors support HIPAA through zero-retention APIs. The BAA is available on Enterprise.[4] |
| AI Meeting Notes (transcription and summaries)Enterprise | Not stated | The AI Meeting Notes help page does not mention HIPAA or the BAA. Uploaded audio is kept for up to 3 days for reprocessing, and Enterprise owners can schedule transcript deletion.[5],[3] |
| Beta AI featuresEnterprise | Excluded | Notion says Beta Services must not be used to process PHI.[1] |
| Notion Mail and Notion Calendar (including their AI features)Enterprise | Not stated | Notion’s HIPAA page tells customers to set up HIPAA with Google Workspace for Mail and Calendar; it does not say whether Notion’s own BAA covers them.[1] |
Workspace and collaboration AI that offer a BAA
- Adobe Acrobat AI AssistantBAA on: Acrobat Studio for enterprise: Analyzer in Acrobat, Acrobat Studio for enterprise: Knowledge Base in AcrobatSome plans only
- Airtable AIBAA on: Enterprise ScaleSome plans only
- Asana AIBAA on: AsanaGov, Enterprise+Some plans only
- Atlassian Rovo / Atlassian Intelligence (Confluence, Jira)BAA on: Enterprise, Standard / Premium (Jira, Jira Service Management, Jira Product Discovery, Confluence)Some plans only
- Box AIBAA on: Enterprise / Enterprise Plus / Enterprise AdvancedSome plans only
- ClickUp BrainBAA on: EnterpriseSome plans only
All BAA-ready alternatives to Notion AI
Sources
- HIPAA configuration in Notion
- Notion Security & Compliance
- Notion AI security & privacy practices
- Enterprise Search security & privacy
- AI Meeting Notes
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.