Are Replit's AI features covered by the BAA?

Replit Agent / Replit AI: coverage not stated.

Does Replit sign a BAA?

Q: Does Replit sign a HIPAA BAA?

Not confirmed. Replit's official terms, DPA, enterprise agreement, security docs and trust center say nothing about HIPAA or BAAs. No official page confirms or rules out a BAA.

Not confirmed

Replit's official terms, DPA, enterprise agreement, security docs and trust center say nothing about HIPAA or BAAs. No official page confirms or rules out a BAA.

Based on 5 sources, all from Replit unless marked.

Business associate: Replit
Tool: Replit
Plans with a BAA: Not stated
Checked: Oct 11, 2026

Not confirmed

No BAA offer found on Replit's own pages.

By plan

Plan	BAA	How to get it	Conditions
All plans (Starter / Core / Teams / Enterprise)	Not confirmed	Not stated	The Terms of Service, DPA (April 2026), Enterprise Agreement (September 2026), information-security docs, enterprise page and trust center do not mention HIPAA, PHI or BAAs. The only certification Replit cites is SOC 2 Type 2.[1],[2],[3],[4],[5]

Are the AI features covered?

Vendors often sign a BAA for the core product but leave some AI features out. Here is what Replit says about each one.

AI feature	Under the BAA	Details
Replit Agent / Replit AI	Not stated	No official statement was found on HIPAA coverage of the AI features.[1],[2],[3]

AI coding tools that offer a BAA

Claude CodeBAA on: Claude Console API key (Commercial org) with zero data retention, Claude Enterprise (HIPAA-ready)Some plans only
CursorBAA on: EnterpriseSome plans only
OpenAI CodexBAA on: ChatGPT for Healthcare / ChatGPT for Clinicians / Enterprise or Edu with Regulated Workspace, OpenAI API (API key sign-in) with Modified RetentionSome plans only

All BAA-ready alternatives to Replit

Sources

Replit Terms of ServiceReplit, Legal terms. Checked Oct 11, 2026.
Data Processing Agreement (DPA) | ReplitReplit, Legal terms. Checked Oct 11, 2026.
Replit Enterprise AgreementReplit, Legal terms. Checked Oct 11, 2026.
Information security overview | Replit DocsReplit, Documentation. Checked Oct 11, 2026.
Replit Trust CenterReplit, Trust center. Checked Oct 11, 2026.

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.