Is Replicate HIPAA compliant?
Not confirmed. We couldn't find a Business Associate Agreement offer on Replicate's own pages. Without a signed BAA, keep patient data out of it.
Does Replicate sign a BAA?
Not confirmed
Replicate's terms, privacy policy, pricing and enterprise pages never mention HIPAA, PHI or a BAA. Its enterprise offer mentions data processing agreements but not BAAs, so BAA availability is unknown.
- Business associate
- Replicate
- Tool
- Replicate
- Plans with a BAA
- Not stated
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Pay-as-you-go API | Not confirmed | Not stated | The Terms (updated April 1, 2026) and Privacy Policy do not mention HIPAA, PHI, health data or a BAA. API prediction inputs, outputs and logs are deleted after one hour by default; predictions made on the website are kept indefinitely.[1],[2],[3],[4] |
| Enterprise | Not confirmed | Not stated | The enterprise page offers security and compliance terms, data processing agreements, SLAs and indemnity, but does not mention HIPAA or a BAA.[5] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Replicate says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Model predictions (public and private models), fine-tuning | Not stated | No BAA is documented, so no feature has documented BAA coverage. Some third-party models carry extra provider terms.[1],[3] |
LLM APIs that offer a BAA
- Claude API (Claude Platform)BAA on: First-party API (custom / negotiated BAA), First-party API (self-serve Console enablement)Some plans only
- CohereBAA on: Custom model development engagementSome plans only
- GroqCloudBAA on: GroqCloud paid, generally available services (customers with an existing Groq agreement)Some plans only
- Hugging FaceBAA on: EnterpriseSome plans only
- ModalBAA on: EnterpriseSome plans only
- BasetenBAA on: All plans (Basic, Pro, Enterprise)Signs a BAA
All BAA-ready alternatives to Replicate
Sources
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.