'/%3e%3cpath%20d='M534.104%20592.554C517.522%20607.15%20492.036%20605.65%20479.37%20587.55C432.827%20521.038%20409.925%20440.343%20415.135%20358.545C420.344%20276.748%20453.298%20199.61%20507.904%20139.54C522.764%20123.194%20548.234%20124.939%20562.83%20141.521L608.023%20192.862C622.619%20209.444%20620.638%20234.536%20607.101%20251.994C581.387%20285.156%20565.941%20325.498%20563.237%20367.978C560.53%20410.458%20570.733%20452.433%20592.032%20488.59C603.245%20507.624%20602.027%20532.765%20585.445%20547.361L534.104%20592.554Z'%20fill='url(%23paint1_linear_154_257)'/%3e%3cpath%20d='M404.368%20499.661L455.381%20493.203L438.013%20356L387%20362.458L404.368%20499.661Z'%20fill='white'/%3e%3cpath%20d='M349%20408.709L355.956%20459.657L492.983%20440.947L486.026%20390L349%20408.709Z'%20fill='white'/%3e%3cdefs%3e%3clinearGradient%20id='paint0_linear_154_257'%20x1='170'%20y1='492.5'%20x2='449'%20y2='508.5'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%236648E0'/%3e%3cstop%20offset='1'%20stop-color='%23413AC9'/%3e%3c/linearGradient%3e%3clinearGradient%20id='paint1_linear_154_257'%20x1='429'%20y1='384'%20x2='549.5'%20y2='380.5'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%235B51FF'/%3e%3cstop%20offset='1'%20stop-color='%233428E6'/%3e%3c/linearGradient%3e%3c/defs%3e%3c/svg%3e)
Practical reference
Which Vendors Sign a HIPAA BAA, and on Which Plan
Last verified 2026-10-30. Vendor terms and prices change; every row links to its source.
Short answer: AWS, Google Cloud and Microsoft Azure all include a HIPAA Business Associate Agreement at no extra charge, accepted in the console or built into their standard terms. Most SaaS tools work differently. The BAA sits behind a business or enterprise tier, a paid add-on or a sales conversation, and a few vendors, including Postmark, Resend, Calendly and Google Analytics, say plainly that they will not sign one. Whichever vendor you pick, a BAA covers only the services it lists, so read the conditions column before any PHI reaches a product. We checked every row against the vendor's own page.
BAA availability by vendor
Showing 122 of 122 vendors.
| Vendor | Signs a BAA? | Plan that unlocks it | Extra cost | Conditions | Source |
|---|---|---|---|---|---|
| Amazon Web Services (AWS)Cloud platforms | Yes | Any AWS account; accept the standard BAA in AWS Artifact | No extra cost | PHI only in the HIPAA-eligible services named in the BAA. Other services can run in the account if they never touch PHI. | Vendor page for Amazon Web Services (AWS) |
| Google CloudCloud platforms | Yes | Any Google Cloud account; review and accept the BAA in the console | No extra cost | Covers the 150+ products on Google's covered list only. Google says HIPAA customers pay the same prices as everyone else. | Vendor page for Google Cloud |
| Microsoft AzureCloud platforms | Yes | Included by default in the Microsoft Product Terms and DPA | No extra cost | No separate contract to sign. Applies to Azure services in Microsoft's HIPAA BAA scope list only. | Vendor page for Microsoft Azure |
| Oracle Cloud Infrastructure (OCI)Cloud platforms | Yes | Request through your Oracle account team | Not published | Oracle enters into a BAA for OCI customers in HIPAA scope. Keep PHI in the services and regions Oracle lists as HIPAA assessed. | Vendor page for Oracle Cloud Infrastructure (OCI) |
| DigitalOceanCloud platforms | Yes | Request from Sales (new customers) or Support (existing) | Not published | Covered list includes Droplets, Kubernetes, Spaces, Volumes and Load Balancers. Managed Databases is not on it. | Vendor page for DigitalOcean |
| VercelCloud platforms | Yes | Pro with the HIPAA BAA add-on, or Enterprise | Paid tier or add-on | Pro teams buy the add-on ($350/mo on Vercel's pricing page) in billing settings. Enterprise requests it from sales. | Vendor page for Vercel |
| NetlifyCloud platforms | Yes | Enterprise | Enterprise contract | Enterprise customers handling PHI can execute a BAA through sales. Not offered on self-serve plans. | Vendor page for Netlify |
| RenderCloud platforms | Yes | Scale or Enterprise workspace with HIPAA enabled | Paid tier or add-on | Adds a 20% fee on all usage in the HIPAA-enabled workspace. Render emails a BAA link after you opt in. | Vendor page for Render |
| Fly.ioCloud platforms | Yes | Any paid plan plus the HIPAA compliance package | Paid tier or add-on | HIPAA package is $99/mo. Fly.io pre-signs the BAA; it takes effect when you sign it. | Vendor page for Fly.io |
| HerokuCloud platforms | Yes | Heroku Shield (a package for Heroku Enterprise) | Enterprise contract | Open a ticket to sign the BAA. PHI only in Shield Private Spaces, Shield dynos and Shield data services. | Vendor page for Heroku |
| CloudflareCloud platforms | Yes | Enterprise | Enterprise contract | BAAs for Enterprise customers only. In-scope list includes CDN, WAF, DNS, Workers, R2, D1 and Zero Trust. | Vendor page for Cloudflare |
| RailwayCloud platforms | Yes | HIPAA BAA add-on at the $1,000/mo committed-spend tier (1-year commitment) | Paid tier or add-on | Railway's docs call the BAA a paid add-on with a monthly spend threshold. Once it is active, Railway staff lose direct access to workloads. | Vendor page for Railway |
| AptibleCloud platforms | Yes | Production plan | Paid tier or add-on | HIPAA requires the Production plan ($499/mo base plus usage). Aptible coordinates the BAA when you request your first dedicated stack. | Vendor page for Aptible |
| Oracle Health Insurance applicationsCloud platforms | Yes | Per contract with Oracle | Not published | Oracle's docs say it is a business associate whenever it handles PHI for a covered entity, and that it keeps standard BAAs for customers. | Vendor page for Oracle Health Insurance applications |
| SupabaseDatabases and backends | Yes | Team or Enterprise plan with the HIPAA add-on | Paid tier or add-on | Not available on Pro. You need a signed BAA and the HIPAA add-on enabled before handling PHI. | Vendor page for Supabase |
| FirebaseDatabases and backends | Partial | Through the Google Cloud BAA | No extra cost | Only Firestore and Cloud Storage for Firebase are on Google's list. Realtime Database, Hosting and Cloud Messaging are not. | Vendor page for Firebase |
| MongoDB AtlasDatabases and backends | Yes | Request from MongoDB sales | Not published | Covers Atlas, App Services, Charts, Data Lake and Atlas for Government. Beta and preview features are excluded. | Vendor page for MongoDB Atlas |
| PlanetScaleDatabases and backends | Yes | All plans, including Base; request in the dashboard | No extra cost | Settings, Legal, Create request. PlanetScale reviews each request; you must be a covered entity or business associate. | Vendor page for PlanetScale |
| NeonDatabases and backends | Yes | Scale plan; enable HIPAA in organization settings | Paid tier or add-on | No surcharge today; Neon says a 15% surcharge will apply later. The Data API and Managed Better Auth are not covered. | Vendor page for Neon |
| CockroachDB CloudDatabases and backends | Yes | Advanced plan | Paid tier or add-on | HIPAA-ready clusters are on the Advanced plan, and Cockroach Labs signs a BAA on request. | Vendor page for CockroachDB Cloud |
| SnowflakeDatabases and backends | Yes | Business Critical edition or higher | Paid tier or add-on | A signed BAA must be in place before any PHI is stored. Lower editions do not list PHI support. | Vendor page for Snowflake |
| DatabricksDatabases and backends | Yes | Compliance security profile, billed as the Enhanced Security and Compliance add-on | Paid tier or add-on | Have an active BAA first, and enable the compliance security profile on every workspace that processes PHI. | Vendor page for Databricks |
| Confluent Cloud (managed Kafka)Databases and backends | Yes | Contracted account with a signed BAA; no tier named | Not published | PHI only after a BAA is executed. Confluent's self-serve eCommerce terms bar PHI, so card sign-up accounts don't qualify. | Vendor page for Confluent Cloud (managed Kafka) |
| Amazon MSK (Managed Streaming for Apache Kafka)Databases and backends | Yes | Covered by the AWS BAA | No extra cost | Listed as HIPAA eligible on AWS's services reference (updated October 15, 2026). | Vendor page for Amazon MSK (Managed Streaming for Apache Kafka) |
| Aiven (Kafka, Postgres and other managed services)Databases and backends | Yes | On request; HIPAA environments need a commitment deal and Advanced or Premium support | Enterprise contract | Aiven's acceptable use policy bars PHI until a BAA is concluded. Its Enhanced Compliance Environments carry the deal and support requirements. | Vendor page for Aiven (Kafka, Postgres and other managed services) |
| Redpanda CloudDatabases and backends | Unclear | Not stated publicly | Not published | Redpanda says it self-attested to HIPAA for Dedicated and BYOC, but no Redpanda page says it signs a BAA. Ask in writing. | Vendor page for Redpanda Cloud |
| Redis CloudDatabases and backends | Partial | Request from Redis | Not published | Redis offers a BAA for its "HIPAA-secure" Redis Cloud services but does not publish which subscriptions those are or a price. | Vendor page for Redis Cloud |
| UpstashDatabases and backends | Yes | Enterprise | Enterprise contract | Enterprise only; Prod Pack doesn't include it. Mark HIPAA databases, keep PHI out of keys and avoid public endpoints. | Vendor page for Upstash |
| Auth0 (Okta Customer Identity)Authentication | Yes | Enterprise plan with the HIPAA/BAA add-on | Enterprise contract | Not on self-serve plans. Auth0 says HIPAA is not available on its Azure deployments. | Vendor page for Auth0 (Okta Customer Identity) |
| Okta (Workforce Identity)Authentication | Yes | Purchase of Okta's HIPAA cell | Enterprise contract | Okta signs a BAA with customers who buy its HIPAA cell, before they store any PHI in Okta. | Vendor page for Okta (Workforce Identity) |
| ClerkAuthentication | Yes | Enterprise | Enterprise contract | Clerk's pricing page lists the HIPAA BAA on the Enterprise plan only. | Vendor page for Clerk |
| Firebase AuthenticationAuthentication | Partial | Upgrade to Google Cloud Identity Platform | Paid tier or add-on | Firebase Authentication is not on Google Cloud's covered list. Identity Platform, its paid upgrade path, is. | Vendor page for Firebase Authentication |
| Amazon CognitoAuthentication | Yes | Covered by the AWS BAA | No extra cost | Listed as HIPAA eligible on AWS's services reference. | Vendor page for Amazon Cognito |
| WorkOSAuthentication | Yes | Enterprise plans | Enterprise contract | WorkOS says it can sign BAAs for customers on enterprise plans. | Vendor page for WorkOS |
| StytchAuthentication | Yes | Enterprise | Enterprise contract | Stytch's pricing page lists HIPAA/BAA as an Enterprise plan feature. | Vendor page for Stytch |
| FusionAuthAuthentication | Yes | Enterprise plan with HA hosting (FusionAuth Cloud) | Paid tier or add-on | FusionAuth Cloud only. The BAA needs the Enterprise plan, which includes HA hosting; FusionAuth publishes Enterprise pricing. | Vendor page for FusionAuth |
| DescopeAuthentication | Yes | Growth or Enterprise | Paid tier or add-on | Not on Free or Pro. Descope lists Growth from $799/mo billed annually; Enterprise is quoted by sales. | Vendor page for Descope |
| OpenAI APIAI and LLM APIs | Yes | Any API organization; request by email to baa@openai.com | No extra cost | No enterprise agreement needed. PHI only on BAA-eligible endpoints once your org has Zero Data Retention or approved retention. | Vendor page for OpenAI API |
| ChatGPT (Enterprise and Edu)AI and LLM APIs | Partial | ChatGPT Enterprise or Edu with a sales-managed account | Enterprise contract | OpenAI says only sales-managed Enterprise and Edu accounts qualify. It does not offer a BAA for ChatGPT Business. | Vendor page for ChatGPT (Enterprise and Edu) |
| Anthropic Claude APIAI and LLM APIs | Yes | First-party API; sign the BAA, then Anthropic enables it | Not published | Covers the Messages, Token Counting and Models APIs. Not Batch, Files, Code Execution, Computer Use or Web Fetch. | Vendor page for Anthropic Claude API |
| Claude EnterpriseAI and LLM APIs | Yes | Enterprise plan; Primary Owner accepts in organization settings | Enterprise contract | Chat, projects and artifacts are covered. MCP and other third-party integrations are not. Claude Code only with ZDR. | Vendor page for Claude Enterprise |
| Azure OpenAI (Foundry Models sold by Azure)AI and LLM APIs | Yes | Microsoft BAA, included through the Microsoft DPA | No extra cost | Processing is governed by the Microsoft DPA that carries the BAA. Check your model and modality against Microsoft's scope list. | Vendor page for Azure OpenAI (Foundry Models sold by Azure) |
| Gemini on Agent Platform (formerly Vertex AI)AI and LLM APIs | Yes | Covered by the Google Cloud BAA | No extra cost | Listed as "Generative AI on Gemini Enterprise Agent Platform", which is Vertex AI under its new name. | Vendor page for Gemini on Agent Platform (formerly Vertex AI) |
| Gemini API (Google AI Studio)AI and LLM APIs | No | Not covered | Not applicable | Not on Google Cloud's BAA covered list. For PHI, call Gemini through Agent Platform (Vertex AI) instead. | Vendor page for Gemini API (Google AI Studio) |
| Amazon BedrockAI and LLM APIs | Yes | Covered by the AWS BAA | No extra cost | Listed as HIPAA eligible on AWS's services reference. | Vendor page for Amazon Bedrock |
| CohereAI and LLM APIs | Partial | Custom model development engagements only | Enterprise contract | The BAA does not cover Cohere's hosted SaaS products. Cohere says not to send PHI through its SaaS services. | Vendor page for Cohere |
| Groq (GroqCloud)AI and LLM APIs | Yes | GroqCloud customers with a services agreement in place | Not published | Groq publishes its BAA. Beta, preview, trial and free-of-charge features are excluded. | Vendor page for Groq (GroqCloud) |
| Together AIAI and LLM APIs | Unclear | Not stated publicly | Not published | Says it adheres to HIPAA and has BAAs with its partners, but does not say publicly that it signs BAAs with customers. | Vendor page for Together AI |
| Hugging FaceAI and LLM APIs | Yes | Enterprise plan | Paid tier or add-on | Hugging Face says it can offer Business Associate Addendums through an Enterprise plan. Confirm which products are in scope. | Vendor page for Hugging Face |
| DeepgramAI and LLM APIs | Yes | Enterprise | Enterprise contract | Deepgram signs BAAs for Enterprise customers and provides its BAA to covered entities on request. No price is published. | Vendor page for Deepgram |
| AssemblyAIAI and LLM APIs | Yes | Any paid account; signed self-serve in the dashboard | No extra cost | An Owner or Admin signs on the Data Controls page at no extra cost. Free accounts must upgrade before the option appears. | Vendor page for AssemblyAI |
| ElevenLabs (ElevenAgents)AI and LLM APIs | Partial | Enterprise | Enterprise contract | Only ElevenAgents is HIPAA-eligible. Zero Retention Mode must be on, LLMs are limited to an allowlist, and no PHI before the BAA. | Vendor page for ElevenLabs (ElevenAgents) |
| Twilio (SMS, Voice)Email, SMS and communication | Yes | Security Edition or Enterprise Edition | Enterprise contract | Use only products on Twilio's HIPAA Eligible list. SendGrid is not on it. | Vendor page for Twilio (SMS, Voice) |
| SendGridEmail, SMS and communication | No | Not offered | Not applicable | Twilio says it cannot sign BAAs for SendGrid and that customers should not use SendGrid with PHI. | Vendor page for SendGrid |
| PostmarkEmail, SMS and communication | No | Not offered | Not applicable | Postmark says it is not HIPAA compliant and cannot sign BAAs. | Vendor page for Postmark |
| MailgunEmail, SMS and communication | Yes | Not published; contact Mailgun | Not published | Mailgun publishes a HIPAA BAA as an addendum to its Terms of Service. The plan it requires is not stated. | Vendor page for Mailgun |
| Amazon SESEmail, SMS and communication | Yes | Covered by the AWS BAA | No extra cost | Listed as HIPAA eligible on AWS's services reference. | Vendor page for Amazon SES |
| ResendEmail, SMS and communication | No | Not offered publicly | Not applicable | Resend says it cannot sign a BAA. Its Enterprise terms allow PHI only if an order form includes a signed BAA. | Vendor page for Resend |
| Google WorkspaceEmail, SMS and communication | Yes | Any Workspace account; a super admin accepts it in the Admin console | No extra cost | Covers listed services such as Gmail, Drive, Calendar, Meet, Chat and Gemini in Workspace. Third-party add-ons are excluded. | Vendor page for Google Workspace |
| Microsoft 365Email, SMS and communication | Yes | Included by default through the Microsoft DPA | No extra cost | In scope: Exchange Online, Teams, SharePoint, OneDrive for Business, Copilot Chat and the other services Microsoft lists. | Vendor page for Microsoft 365 |
| ZoomEmail, SMS and communication | Yes | Paid plans: Pro online, or Business and above through sales | Paid tier or add-on | Pro buyers select the US BAA at checkout. Business, Business Plus and Enterprise customers sign through Zoom sales. | Vendor page for Zoom |
| SlackEmail, SMS and communication | Yes | Enterprise plan (Enterprise Grid) | Enterprise contract | Not for talking with patients. DLP is required, and Marketplace apps are not covered by Slack's BAA. | Vendor page for Slack |
| IntercomEmail, SMS and communication | Yes | Expert plan | Paid tier or add-on | Intercom lists HIPAA support on the Expert plan. The BAA is arranged through sales or your account manager. | Vendor page for Intercom |
| FrontEmail, SMS and communication | Yes | Annual contract above Front's threshold | Enterprise contract | Email notifications, email tags and Front's native email sending cannot process PHI under the BAA. | Vendor page for Front |
| PauboxEmail, SMS and communication | Yes | Every plan, including the Email API free tier | No extra cost | Paubox says all customers receive a BAA at no additional charge. | Vendor page for Paubox |
| CalendlyEmail, SMS and communication | No | Not offered | Not applicable | Calendly's customer terms require that your data contain no protected health information. | Vendor page for Calendly |
| Cal.comEmail, SMS and communication | Yes | Enterprise, or Organizations with 15+ users; add-on for smaller plans | Paid tier or add-on | BAA is $300/mo on Teams or Organizations plans under 15 users, and included on Enterprise. | Vendor page for Cal.com |
| Vonage Communications APIsEmail, SMS and communication | Partial | Through your Vonage account manager | Not published | Covers the Video, Voice, Messages and Verify APIs, U.S. traffic only. No page found extending it to Vonage Business phone plans. | Vendor page for Vonage Communications APIs |
| TelnyxEmail, SMS and communication | Partial | Request from sales; customers that meet Telnyx's commercial thresholds | Not published | HIPAA-eligible services and U.S. messaging only. Telnyx treats plain call and SMS transit as falling under the conduit exception. | Vendor page for Telnyx |
| RingCentralEmail, SMS and communication | Partial | Request from your RingCentral representative; paying covered-entity customers | Not published | Listed services only, such as RingEX, Fax, RingCX and Contact Center. RingCentral will not sign a customer's own BAA form. | Vendor page for RingCentral |
| DialpadEmail, SMS and communication | Yes | Healthcare customers; signed online in one click | Not published | Dialpad's trust page links a one-click BAA for healthcare customers. Its pricing page does not tie HIPAA to a plan. | Vendor page for Dialpad |
| MailchimpEmail, SMS and communication | No | Not offered | Not applicable | No BAA. Mailchimp's acceptable use policy bans legally regulated sensitive personal data, and its terms disclaim HIPAA liability. | Vendor page for Mailchimp |
| StripePayments | No | Not offered | Not applicable | Stripe publishes no BAA, and its Services Agreement bars sending PHI as Third Party Data. Keep PHI out of Stripe entirely. | Vendor page for Stripe |
| SquarePayments | Yes | All sellers; the BAA is part of Square's terms | No extra cost | Applies only to features Square marks HIPAA-enabled, such as Appointments and Invoices. Buyer-facing services are excluded. | Vendor page for Square |
| DatadogMonitoring and analytics | Yes | Not published; arranged with Datadog | Not published | Log Management and Cloud SIEM are eligible, APM and about 30 others are extended eligible. Other services must not get PHI. | Vendor page for Datadog |
| New RelicMonitoring and analytics | Yes | Enterprise edition with Data Plus | Enterprise contract | US data region required. Your account rep must confirm the HIPAA-enabled account in writing before you send PHI. | Vendor page for New Relic |
| SentryMonitoring and analytics | Yes | Business plan or higher (not trials) | Paid tier or add-on | Owners or billing contacts accept it under Legal & Compliance in settings. Only Enterprise customers can negotiate changes. | Vendor page for Sentry |
| MixpanelMonitoring and analytics | Yes | Enterprise plan | Enterprise contract | BAA offered to Enterprise Plan customers; contact sales to confirm you qualify. | Vendor page for Mixpanel |
| AmplitudeMonitoring and analytics | Yes | Not published; arranged with Amplitude | Not published | Amplitude says it can enter a BAA with covered entities and business associates, and that its AI features are covered. | Vendor page for Amplitude |
| PostHogMonitoring and analytics | Yes | Boost ($250/mo), Scale or Enterprise package | Paid tier or add-on | PostHog Cloud only. The managed reverse proxy and PostHog AI features are not covered. | Vendor page for PostHog |
| SegmentMonitoring and analytics | Yes | Business tier | Enterprise contract | Not on Free or Team. Use only the Segment products on Twilio's HIPAA Eligible list. | Vendor page for Segment |
| Google Analytics (GA4)Monitoring and analytics | No | Not offered | Not applicable | Google does not offer a BAA for Analytics. Keep it off authenticated pages and pages about care. | Vendor page for Google Analytics (GA4) |
| Microsoft ClarityMonitoring and analytics | No | Not offered | Not applicable | Clarity's terms bar use with health care content, and Clarity is not in Microsoft's HIPAA BAA scope. | Vendor page for Microsoft Clarity |
| Tableau CloudMonitoring and analytics | Partial | Request from your Salesforce account representative | Not published | Tableau Cloud and Tableau Next only; Tableau Bridge, Data Connect and Tableau Server are excluded. No public sharing of PHI. | Vendor page for Tableau Cloud |
| Microsoft Power BIMonitoring and analytics | Yes | Included by default in the Microsoft DPA | No extra cost | The Power BI cloud service is on Microsoft's HIPAA scope list. Microsoft will not sign a customer-drafted BAA. | Vendor page for Microsoft Power BI |
| Looker (Google Cloud)Monitoring and analytics | Yes | Google Cloud BAA, accepted in the console | No extra cost | Looker (Google Cloud core) and Looker (original) are on Google's covered list. Keep PHI out of query business logic. | Vendor page for Looker (Google Cloud) |
| FivetranMonitoring and analytics | Yes | Not published; arranged with Fivetran | Not published | Fivetran says it will sign a BAA for PHI. Its pricing pages name no plan; HITRUST certification comes with Business Critical. | Vendor page for Fivetran |
| HexMonitoring and analytics | Yes | Enterprise with the HIPAA add-on | Paid tier or add-on | The order form must select a HIPAA environment (multi- or single-tenant), and the BAA must be signed before PHI is uploaded. | Vendor page for Hex |
| ThoughtSpotMonitoring and analytics | Yes | Not published; Business Associate Addendum agreed with ThoughtSpot | Not published | ThoughtSpot's cloud program guide bars PHI unless the parties have expressly agreed a Business Associate Addendum. | Vendor page for ThoughtSpot |
| Heap (Contentsquare)Monitoring and analytics | Unclear | Not stated publicly | Not published | A 2023 Heap post says it signs BAAs, but Contentsquare's current Heap terms bar regulated data without its written consent. | Vendor page for Heap (Contentsquare) |
| dbt Cloud (dbt Labs)Monitoring and analytics | Unclear | Not stated publicly | Not published | dbt Labs reports on HIPAA Security criteria in its SOC 2 report but publishes no offer to sign a customer BAA. | Vendor page for dbt Cloud (dbt Labs) |
| Metabase CloudMonitoring and analytics | Unclear | Not stated publicly | Not published | Metabase recommends self-hosting or air-gapping for HIPAA and does not say it signs a BAA for Metabase Cloud. | Vendor page for Metabase Cloud |
| Sigma ComputingMonitoring and analytics | Unclear | Not stated publicly | Not published | Sigma lists HIPAA among its audits, but no Sigma page offers a BAA and its service agreement is silent on PHI. | Vendor page for Sigma Computing |
| Grafana CloudMonitoring and analytics | Unclear | Not stated publicly | Not published | Grafana's standard terms bar PHI in user content, and its BAA covered-services page returned 404 on 2026-10-30. Ask in writing. | Vendor page for Grafana Cloud |
| HoneycombMonitoring and analytics | Yes | Pro or Enterprise | Paid tier or add-on | The free plan is not eligible. Honeycomb lists Pro from $150/mo, though its pricing page does not mention the BAA. | Vendor page for Honeycomb |
| PagerDutyMonitoring and analytics | Unclear | Not stated publicly | Not published | One PagerDuty page cites HIPAA certification, but its terms, security page and trust portal do not offer a BAA. | Vendor page for PagerDuty |
| Elastic CloudMonitoring and analytics | Yes | Any Elastic Cloud subscription tier on AWS, Azure or Google Cloud | No extra cost | Elastic says every Elastic Cloud tier on the three clouds supports a BAA. It publishes no signing flow; ask Elastic. | Vendor page for Elastic Cloud |
| Splunk Cloud PlatformMonitoring and analytics | Partial | Premium HIPAA environment on an order; also Splunk Observability Cloud | Enterprise contract | Only the Premium HIPAA environment and Observability Cloud are covered. Trials, evaluations, beta and free licenses are excluded. | Vendor page for Splunk Cloud Platform |
| ZendeskSupport, CRM and productivity | Yes | Professional or higher with the Advanced Compliance add-on | Paid tier or add-on | Some Suite plans include the add-on. You must also turn on Zendesk's required security settings. | Vendor page for Zendesk |
| HubSpotSupport, CRM and productivity | Yes | Enterprise subscriptions (Marketing, Sales, Service, Data, Content or Smart CRM) | Paid tier or add-on | Turn on sensitive data and declare HIPAA status in settings. The BAA is part of HubSpot's Sensitive Data Terms. | Vendor page for HubSpot |
| SalesforceSupport, CRM and productivity | Yes | Through your Salesforce account representative | Not published | Covers only the services on Salesforce's HIPAA covered-services list. Check its BAA restrictions page. | Vendor page for Salesforce |
| NotionSupport, CRM and productivity | Yes | Enterprise plan | Enterprise contract | Free of charge on Enterprise. Beta features are not covered and must not process PHI. | Vendor page for Notion |
| AirtableSupport, CRM and productivity | Yes | Enterprise Scale | Enterprise contract | The BAA sits in Airtable's Health Information Exhibit. There is no migration path from non-HIPAA workspaces. | Vendor page for Airtable |
| Atlassian (Jira, Confluence)Support, CRM and productivity | Yes | Standard, Premium or Enterprise | Paid tier or add-on | Free and trial plans are excluded. Covers Jira, Jira Service Management, Jira Product Discovery and Confluence. | Vendor page for Atlassian (Jira, Confluence) |
| GitHubSupport, CRM and productivity | Unclear | No public BAA offer found | Not published | GitHub's DPA bars sending PHI without GitHub's prior written consent. Ask GitHub before any PHI reaches a repository. | Vendor page for GitHub |
| 1PasswordSupport, CRM and productivity | No | Not applicable | Not applicable | 1Password says it is not a business associate, and so not subject to a BAA, because it cannot decrypt vault data. | Vendor page for 1Password |
| ZapierSupport, CRM and productivity | No | Not offered | Not applicable | Zapier says it does not support PHI and can't sign BAAs on any plan, Enterprise included. | Vendor page for Zapier |
| LoomSupport, CRM and productivity | No | Not offered | Not applicable | Loom says it can't sign BAAs and asks customers not to send PHI. Atlassian's BAA covers Jira and Confluence, not Loom. | Vendor page for Loom |
| Retool (Retool Cloud)Support, CRM and productivity | No | Not offered | Not applicable | Retool's subscription agreement bars submitting PHI to Retool Cloud. Self-hosted Retool keeps data in your own infrastructure. | Vendor page for Retool (Retool Cloud) |
| AsanaSupport, CRM and productivity | Yes | Enterprise tier with the HIPAA feature enabled | Enterprise contract | The BAA takes effect when the customer enables Asana's opt-in HIPAA feature. Enterprise pricing is quoted by sales. | Vendor page for Asana |
| monday.comSupport, CRM and productivity | Yes | Enterprise plan with the HIPAA feature enabled | Enterprise contract | An admin accepts the BAA in the platform. Third-party integrations are not covered, and downgrading ends coverage. | Vendor page for monday.com |
| ClickUpSupport, CRM and productivity | Yes | Max or Enterprise | Paid tier or add-on | The pricing page marks Max and Enterprise "With BAA"; ClickUp's FAQ names Enterprise only. Free, Core and Business are not eligible. | Vendor page for ClickUp |
| LinearSupport, CRM and productivity | Yes | Enterprise | Enterprise contract | Linear offers a BAA to Enterprise plan customers, requested through sales. | Vendor page for Linear |
| DocuSign eSignatureE-signature, documents and storage | Yes | Arranged through DocuSign sales | Not published | DocuSign acts as a business associate when eSignature handles PHI. It does not publish which plans include the BAA. | Vendor page for DocuSign eSignature |
| DropboxE-signature, documents and storage | Yes | Standard, Business, Advanced, Business Plus or Enterprise | Paid tier or add-on | Team admins sign it in the Admin Console (US customers only). Reseller support can't be enabled once signed. | Vendor page for Dropbox |
| BoxE-signature, documents and storage | Yes | Enterprise, Enterprise Plus or Enterprise Advanced | Paid tier or add-on | Box requires one of these Enterprise tiers and a signed BAA. Lower tiers are not eligible. | Vendor page for Box |
| Google Drive (Workspace)E-signature, documents and storage | Yes | Google Workspace account with the BAA accepted | No extra cost | Drive, including Docs, Sheets, Slides and Forms, is on the Workspace HIPAA Included Functionality list. | Vendor page for Google Drive (Workspace) |
| OneDrive for BusinessE-signature, documents and storage | Yes | Microsoft 365 commercial plans, via the DPA | No extra cost | OneDrive for Business is in Microsoft's HIPAA scope. Consumer OneDrive is not on the list. | Vendor page for OneDrive for Business |
| Backblaze B2E-signature, documents and storage | Yes | On request, for business customers that are covered entities | Not published | Backblaze provides a BAA on request and names no plan or fee for it. | Vendor page for Backblaze B2 |
| JotformE-signature, documents and storage | Yes | Gold or Enterprise | Paid tier or add-on | HIPAA features need Gold or Enterprise at no extra fee. Covered entities sign the BAA self-serve once HIPAA is enabled. | Vendor page for Jotform |
| TypeformE-signature, documents and storage | Yes | Enterprise | Enterprise contract | Typeform's pricing marks HIPAA Enterprise only. Set up the BAA through sales or your account manager before building health forms. | Vendor page for Typeform |
| FormstackE-signature, documents and storage | Yes | HIPAA add-on on Forms and Suite; included in Enterprise and Salesforce Solutions | Paid tier or add-on | Formstack provides a standard BAA for HIPAA accounts and reviews custom BAAs case by case. The add-on price is not published. | Vendor page for Formstack |
- Yes
- The vendor states it signs a BAA (subject to the plan and conditions shown).
- Partial
- Only some products or engagements are covered; read the conditions.
- No
- The vendor states it does not sign a BAA, or its terms bar PHI.
- Unclear
- The vendor's public wording does not settle it; ask the vendor in writing.
- No extra cost: Available on a standard account of the service; no upgrade or fee stated.
- Paid tier or add-on: Requires a specific published plan, add-on or surcharge.
- Enterprise contract: Requires a sales-negotiated enterprise plan or contract.
- Not published: The vendor does not publish the plan or price for its BAA.
What a BAA must contain
HIPAA sets the minimum terms for a business associate contract in 45 CFR 164.504(e). A vendor's BAA should do each of the following:
- Set out the permitted and required uses and disclosures of PHI by the business associate. (e)(2)(i)
- Bar any use or further disclosure beyond what the contract permits or the law requires. (e)(2)(ii)(A)
- Require appropriate safeguards, including compliance with the Security Rule (Subpart C) for electronic PHI. (e)(2)(ii)(B)
- Require reporting of any use or disclosure the contract does not allow, including breaches of unsecured PHI. (e)(2)(ii)(C)
- Flow the same restrictions down to any subcontractor that handles the PHI. (e)(2)(ii)(D)
- Support patients' rights of access, amendment and an accounting of disclosures. (e)(2)(ii)(E)-(G)
- Open the business associate's practices and records to HHS for compliance reviews. (e)(2)(ii)(I)
- Return or destroy PHI at termination, or extend the protections if that is not feasible. (e)(2)(ii)(J)
- Let the covered entity terminate the contract if the business associate breaches a material term. (e)(2)(iii)
Three things a BAA does not do
- It does not make your application compliant. A BAA puts the vendor's obligations in writing. Access control, audit logging, encryption settings, backups, risk analysis and your own policies are still yours to build and run.
- It covers the listed services only. Every BAA names what is in scope. AWS, Google Cloud and Microsoft publish service lists, and SaaS vendors carve out features such as AI assistants, beta products, native email sending or marketplace apps. PHI that reaches an unlisted service is outside the agreement.
- It does not cover your own misconfiguration. The vendor secures its platform; you secure how you use it. A public storage bucket, an over-broad IAM role or PHI in a log line is your exposure, BAA or not.
If you're mapping a BAA-scoped architecture, that's the work we do.
Sources
- Amazon Web Services (AWS) — checked 2026-09-26
- Google Cloud, Firebase, Firebase Authentication, Gemini on Agent Platform (formerly Vertex AI), Gemini API (Google AI Studio) — checked 2026-09-26
- Microsoft Azure — checked 2026-09-26
- Oracle Cloud Infrastructure (OCI) — checked 2026-09-26
- DigitalOcean — checked 2026-09-26
- Vercel — checked 2026-09-26
- Netlify — checked 2026-09-26
- Render — checked 2026-09-26
- Fly.io — checked 2026-09-26
- Heroku — checked 2026-09-26
- Cloudflare — checked 2026-09-26
- Railway — checked 2026-10-30
- Aptible — checked 2026-10-30
- Oracle Health Insurance applications — checked 2026-10-30
- Supabase — checked 2026-09-26
- MongoDB Atlas — checked 2026-09-26
- PlanetScale — checked 2026-09-26
- Neon — checked 2026-09-26
- CockroachDB Cloud — checked 2026-09-26
- Snowflake — checked 2026-09-26
- Databricks — checked 2026-09-26
- Confluent Cloud (managed Kafka) — checked 2026-10-30
- Amazon MSK (Managed Streaming for Apache Kafka), Amazon Cognito, Amazon Bedrock, Amazon SES — checked 2026-10-30
- Aiven (Kafka, Postgres and other managed services) — checked 2026-10-30
- Redpanda Cloud — checked 2026-10-30
- Redis Cloud — checked 2026-10-30
- Upstash — checked 2026-10-30
- Auth0 (Okta Customer Identity) — checked 2026-09-26
- Okta (Workforce Identity) — checked 2026-09-26
- Clerk — checked 2026-09-26
- WorkOS — checked 2026-09-26
- Stytch — checked 2026-09-26
- FusionAuth — checked 2026-10-30
- Descope — checked 2026-10-30
- OpenAI API, ChatGPT (Enterprise and Edu) — checked 2026-09-26
- Anthropic Claude API, Claude Enterprise — checked 2026-09-26
- Azure OpenAI (Foundry Models sold by Azure) — checked 2026-09-26
- Cohere — checked 2026-09-26
- Groq (GroqCloud) — checked 2026-09-26
- Together AI — checked 2026-09-26
- Hugging Face — checked 2026-09-26
- Deepgram — checked 2026-10-30
- AssemblyAI — checked 2026-10-30
- ElevenLabs (ElevenAgents) — checked 2026-10-30
- Twilio (SMS, Voice) — checked 2026-09-26
- SendGrid — checked 2026-09-26
- Postmark — checked 2026-09-26
- Mailgun — checked 2026-09-26
- Resend — checked 2026-10-30
- Google Workspace — checked 2026-09-26
- Microsoft 365, Microsoft Power BI, OneDrive for Business — checked 2026-10-30
- Zoom — checked 2026-09-26
- Slack — checked 2026-09-26
- Intercom — checked 2026-09-26
- Front — checked 2026-09-26
- Paubox — checked 2026-09-26
- Calendly — checked 2026-09-26
- Cal.com — checked 2026-09-26
- Vonage Communications APIs — checked 2026-10-30
- Telnyx — checked 2026-10-30
- RingCentral — checked 2026-10-30
- Dialpad — checked 2026-10-30
- Mailchimp — checked 2026-10-30
- Stripe — checked 2026-09-26
- Square — checked 2026-09-26
- Datadog — checked 2026-09-26
- New Relic — checked 2026-09-26
- Sentry — checked 2026-09-26
- Mixpanel — checked 2026-09-26
- Amplitude — checked 2026-09-26
- PostHog — checked 2026-09-26
- Segment — checked 2026-09-26
- Google Analytics (GA4) — checked 2026-09-26
- Microsoft Clarity — checked 2026-09-26
- Tableau Cloud — checked 2026-10-30
- Looker (Google Cloud) — checked 2026-10-30
- Fivetran — checked 2026-10-30
- Hex — checked 2026-10-30
- ThoughtSpot — checked 2026-10-30
- Heap (Contentsquare) — checked 2026-10-30
- dbt Cloud (dbt Labs) — checked 2026-10-30
- Metabase Cloud — checked 2026-10-30
- Sigma Computing — checked 2026-10-30
- Grafana Cloud — checked 2026-10-30
- Honeycomb — checked 2026-10-30
- PagerDuty — checked 2026-10-30
- Elastic Cloud — checked 2026-10-30
- Splunk Cloud Platform — checked 2026-10-30
- Zendesk — checked 2026-09-26
- HubSpot — checked 2026-09-26
- Salesforce — checked 2026-09-26
- Notion — checked 2026-09-26
- Airtable — checked 2026-09-26
- Atlassian (Jira, Confluence) — checked 2026-09-26
- GitHub — checked 2026-09-26
- 1Password — checked 2026-09-26
- Zapier — checked 2026-10-30
- Loom — checked 2026-10-30
- Retool (Retool Cloud) — checked 2026-10-30
- Asana — checked 2026-10-30
- monday.com — checked 2026-10-30
- ClickUp — checked 2026-10-30
- Linear — checked 2026-10-30
- DocuSign eSignature — checked 2026-09-26
- Dropbox — checked 2026-09-26
- Box — checked 2026-09-26
- Google Drive (Workspace) — checked 2026-09-26
- Backblaze B2 — checked 2026-10-30
- Jotform — checked 2026-10-30
- Typeform — checked 2026-10-30
- Formstack — checked 2026-10-30
- 45 CFR 164.504(e), business associate contracts (eCFR) — required contents of a BAA
Questions this page answers
Does AWS charge for a BAA?
No. AWS presents a standard Business Associate Addendum that you review and accept in AWS Artifact, and its HIPAA page lists no fee for it. Google Cloud says HIPAA customers get the same products at the same prices, and Microsoft includes its BAA in the Product Terms for every Azure customer. In all three cases, PHI may only go into the services the provider lists as covered.
Will OpenAI sign a BAA?
Yes, for the API: OpenAI reviews requests sent to baa@openai.com and does not require an enterprise agreement, but PHI may only go to BAA-eligible endpoints once your organization has Zero Data Retention or an approved retention setting. For ChatGPT, only sales-managed Enterprise and Edu accounts qualify, and OpenAI does not offer a BAA for ChatGPT Business.
Does Stripe sign a BAA?
Stripe publishes no BAA, and its Services Agreement says customers must not provide protected health information as Third Party Data. If you use Stripe, use it only to move money and keep diagnoses, visit details and other PHI out of descriptions, metadata and customer fields. HIPAA's payment-processing exemption (Social Security Act section 1179) covers moving the money, not storing health details alongside it. Square does publish a BAA for features it marks HIPAA-enabled, such as Appointments and Invoices.
Is Firebase covered by Google's BAA?
Only in part. Google Cloud's covered-products list includes Firestore and Cloud Storage for Firebase. Firebase Authentication is not on it, though Identity Platform (its paid upgrade path) is, and no other Firebase-branded product such as Realtime Database, Hosting or Cloud Messaging appears.
Which AI APIs will sign a BAA?
The OpenAI API, the Anthropic Claude API, Azure OpenAI through the Microsoft DPA, Gemini on Google's Agent Platform (formerly Vertex AI), Amazon Bedrock and GroqCloud all state they offer one, each with its own endpoint and retention conditions. Cohere's BAA covers custom model engagements only, and the Gemini API through Google AI Studio is not on Google Cloud's covered list.
Can I get a BAA without an enterprise plan?
Yes, from some vendors. AWS, Google Cloud, Azure, Google Workspace and Microsoft 365 include it on a standard account, PlanetScale offers it on every plan, Paubox includes it even on its free API tier, and Square builds it into its terms. Most other SaaS tools put it behind a named paid tier, an add-on fee or an enterprise contract.
Does Resend sign a BAA?
No. As of October 30, 2026, Resend's security page says it is not HIPAA compliant and cannot sign a Business Associate Agreement. Postmark and SendGrid also do not offer one. Amazon SES (under the AWS BAA), Mailgun (arranged with Mailgun) and Paubox (on every plan) do.
Which managed Kafka services will sign a BAA?
As of October 30, 2026: Amazon MSK is HIPAA eligible under the AWS BAA, and Google Cloud Managed Service for Apache Kafka is on Google's covered list. Confluent Cloud supports PHI once a BAA is executed, though its self-serve sign-up terms bar PHI, and Aiven offers BAAs on request with a commitment deal. Redpanda says it self-attested to HIPAA but does not say it signs a BAA.
Which identity and access-control vendors sign a BAA?
As of October 30, 2026: Okta (with its HIPAA cell), Auth0 (Enterprise with the HIPAA add-on), Clerk, WorkOS and Stytch (Enterprise), Descope (Growth or Enterprise), FusionAuth (Enterprise with HA hosting) and Amazon Cognito (under the AWS BAA). Firebase Authentication is not on Google's covered list; Identity Platform, its paid upgrade, is.
Which analytics and BI vendors sign a BAA?
As of October 30, 2026: Snowflake (Business Critical or higher), Databricks (compliance security profile), Power BI (Microsoft DPA by default), Looker (Google Cloud BAA), Tableau Cloud (via Salesforce, excluding Tableau Server and Bridge), Hex (Enterprise HIPAA add-on), Fivetran and ThoughtSpot (by agreement). For product analytics, Mixpanel, Amplitude, PostHog and Segment do; Google Analytics does not.