Does Notion AI sign a BAA?

Only on some plans or setups

Notion signs a BAA only on its Enterprise plan, where admins turn on HIPAA compliance and accept the BAA in settings. Notion says Notion AI and AI Connectors support PHI through zero-retention LLM APIs. Beta features are excluded; Notion does not say whether its BAA covers Notion Mail, Notion Calendar or AI Meeting Notes.

Based on 5 sources, all from Notion Labs unless marked.

Not fully covered by the BAA: Beta AI features.

Business associate
Notion Labs
Tool
Notion AI
Plans with a BAA
Enterprise
Checked
Some plans only
Notion Labs signs only for the plans listed.

By plan

PlanBAAHow to get itConditions
Free / Plus / BusinessNo BAANot offeredNotion says a workspace must be on the Enterprise plan to be eligible to sign its BAA.[1]
EnterpriseSigns a BAAAccept or sign onlineTurn it on under Settings > Workspace settings > HIPAA compliance > Activate, then accept the BAA. It is free on Enterprise. Recommended setup includes SAML SSO only, SCIM, no public sharing, guests, or exports, custom retention, and audit logs. PHI is not allowed in workspace, file, or teamspace names, profiles, or support requests.[1],[2]

Are the AI features covered?

Vendors often sign a BAA for the core product but leave some AI features out. Here is what Notion Labs says about each one.

AI featureUnder the BAADetails
Notion AI (core writing, Q&A, chat)EnterpriseCoveredNotion says Notion AI supports HIPAA compliance and PHI processing through LLM providers' zero-retention APIs. Zero retention is the default on Enterprise workspaces.[3]
AI features that use data-retaining LLMs (admin opt-in)EnterpriseNot statedSome AI features need LLMs that retain data. These are off by default, and admins can turn them on. Notion's HIPAA claim refers to zero-retention APIs, and Notion does not say whether these opt-in features are covered.[3]
Enterprise Search / AI ConnectorsEnterpriseCoveredNotion's Enterprise Search page says AI Connectors support HIPAA through zero-retention APIs. The BAA is available on Enterprise.[4]
AI Meeting Notes (transcription and summaries)EnterpriseNot statedThe AI Meeting Notes help page does not mention HIPAA or the BAA. Uploaded audio is kept for up to 3 days for reprocessing, and Enterprise owners can schedule transcript deletion.[5],[3]
Beta AI featuresEnterpriseExcludedNotion says Beta Services must not be used to process PHI.[1]
Notion Mail and Notion Calendar (including their AI features)EnterpriseNot statedNotion’s HIPAA page tells customers to set up HIPAA with Google Workspace for Mail and Calendar; it does not say whether Notion’s own BAA covers them.[1]

Workspace and collaboration AI that offer a BAA

All BAA-ready alternatives to Notion AI

Sources

  1. HIPAA configuration in NotionNotion Labs, Help center. Checked Oct 11, 2026.
  2. Notion Security & ComplianceNotion Labs, Trust center. Checked Oct 11, 2026.
  3. Notion AI security & privacy practicesNotion Labs, Help center. Checked Oct 11, 2026.
  4. Enterprise Search security & privacyNotion Labs, Help center. Checked Oct 11, 2026.
  5. AI Meeting NotesNotion Labs, Help center. Checked Oct 11, 2026.

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.