AI Vendor BAA Check

Does ServiceNow Now Assist sign a BAA?

Only on some plans or setups

ServiceNow's HIPAA white paper says customers that will store ePHI in their instance can request a BAA through sales. No ServiceNow page says whether Now Assist generative AI is inside that BAA.

Based on 4 sources, all from ServiceNow unless marked.

Business associate
ServiceNow
Tool
ServiceNow Now Assist
Plans with a BAA
ServiceNow AI Platform subscription (instance storing ePHI)
Checked
Some plans only
ServiceNow signs only for the plans listed.

By plan

PlanBAAHow to get itConditions
ServiceNow AI Platform subscription (instance storing ePHI)Conditions applyThrough salesServiceNow sales support representativeThe customer must tell its sales support representative it intends to store ePHI and request a BAA for that subscription service. ServiceNow will not sign a BAA that makes it carry out the customer's covered-entity obligations.[1]

Are the AI features covered?

Vendors often sign a BAA for the core product but leave some AI features out. Here is what ServiceNow says about each one.

AI featureUnder the BAADetails
Now Assist (generative AI via Now LLM Service and third-party endpoints such as Azure OpenAI)Not statedThe HIPAA white paper does not mention Now Assist or generative AI. The Now Assist data-use doc says prompts are processed transiently at ServiceNow compute hubs or third-party endpoints within the ServiceNow network boundary. It does not mention HIPAA or BAAs. Optional masking (Data Privacy for Now Assist / Sensitive Data Handler) is off by default.[1],[2],[3]

Customer support AI that offer a BAA

  • AdaBAA on: Enterprise contracts (Ada is sales-led)Some plans only
  • Freshdesk / Freddy AIBAA on: Freshdesk, Freshchat (standalone), Freshcaller, Freshdesk OmnichannelSome plans only
  • Intercom FinBAA on: Fin workspaces (Fin AI Agent standalone), Intercom ExpertSome plans only
  • Jotform AI AgentsBAA on: Enterprise, GoldSome plans only
  • Kustomer AIBAA on: Enterprise or Ultimate with HIPAA add-on packageSome plans only
  • LivePerson Conversational CloudBAA on: Conversational Cloud (enterprise contracts)Some plans only

All BAA-ready alternatives to ServiceNow Now Assist

Sources

  1. ServiceNow Security and HIPAA (HIPAA Security Controls v5.1)ServiceNow, Documentation. Checked Oct 11, 2026.
  2. User data usage policy for Now AssistServiceNow, Documentation. Checked Oct 11, 2026.
  3. Sensitive Data and Advanced AI Products FAQs - ServiceNow CommunityServiceNow, Documentation. Checked Oct 11, 2026.
  4. ServiceNow AI Platform ComplianceServiceNow, Trust center. Checked Oct 11, 2026.

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.