nudgesecurity.com/security-profile/airtable-com

**Yes, but only under strict conditions.** Airtable can support HIPAA compliance for electronic Protected Health Information (ePHI), but it is **not** HIPAA compliant by default on standard accounts.[](https://teachmehipaa.com/hipaa-baa/productivity/airtable/) [[1]](https://teachmehipaa.com/hipaa-baa/productivity/airtable/)[[2]](https://www.facebook.com/KnackHQ/posts/airtable-is-great-until-it-is-patient-dataon-standard-plans-there-is-no-baa-the-/1661739832624383/)[[3]](https://community.airtable.com/announcements-6/airtable-is-now-hipaa-compliant-1542)[[4]](https://www.reddit.com/r/Airtable/comments/d9btne/was_about_to_use_airtable_but_no_hipaa_compliant/)[[5]](https://www.business-automated.com/tutorials/is-airtable-safe-security-guide) The critical requirements and boundaries for using Airtable with patient data include: - **Enterprise Scale Plan Required:** HIPAA support and the option to execute a Business Associate Agreement (BAA) are restricted exclusively to Airtable’s highest-tier **Enterprise Scale** plan. Free, Team, and Business plans are strictly non-compliant and prohibited for storing PHI.[](https://teachmehipaa.com/hipaa-baa/productivity/airtable/) - **Signed Business Associate Agreement (BAA):** You must formally execute Airtable’s **Health Information Exhibit** , which incorporates their BAA, via your Airtable account representative before any patient data enters the platform.[](https://teachmehipaa.com/hipaa-baa/productivity/airtable/) - **Strict Where-Data-Lives Boundaries:** Under Airtable's compliance rules, ePHI and medical data **must only live inside record cells** within designated bases or interfaces.[](https://www.airtable.com/company/health-info-datasheet) [[1]](https://www.airtable.com/company/health-info-datasheet) - **Feature Exclusions:** - **Airtable AI:** Cannot be used or enabled in workspaces containing ePHI unless specific health supplemental terms are met (and generally restricted from touching raw PHI). - **Automations & Email:** You cannot expose ePHI in unencrypted or non-compliant automated notification emails. - **Customer Support:** You must never include patient data or screenshots containing PHI in support tickets. - **Patient Portals:** Airtable explicitly prohibits using its native features as a direct patient-facing portal.[](https://teachmehipaa.com/hipaa-baa/productivity/airtable/) - **Third-Party Integrations:** Any connected tool (like Zapier, Slack, or custom APIs) must also be HIPAA-compliant and covered by its own BAA; a single unencrypted link breaks the chain of custody.[](https://www.specode.ai/blog/is-airtable-hipaa-compliant) [[1]](https://www.specode.ai/blog/is-airtable-hipaa-compliant)[[2]](https://curogram.com/blog/mental-health/hipaa-compliant-texting-for-behavioral-health)[[3]](https://www.mindbowser.com/hipaa-compliant-app-with-flutter/)[[4]](https://www.slicktext.com/hipaa-compliant-texting) Review details on the [Airtable HIPAA Compliance Overview](https://www.airtable.com/company/hipaa-airtable) or check their explicit rules in the [Airtable Health Information Datasheet](https://www.airtable.com/company/health-info-datasheet).[[1]](https://support.airtable.com/docs/understanding-hipaa-at-airtable)[[2]](https://www.nudgesecurity.com/security-profile/airtable-com)[[3]](https://teachmehipaa.com/hipaa-baa/productivity/airtable/) If you're planning a setup, tell me: - What **tier/plan** your organization currently uses - Whether you plan to connect **external integrations or APIs** I can help you evaluate if Airtable fits your workflow or if a dedicated backend is safer. Yes, but only under strict conditions. Airtable can support HIPAA compliance for electronic Protected Health Information (ePHI), but it is not HIPAA compliant by default on standard accounts. Airtable and HIPAA compliance Airtable now supports its customers' HIPAA compliance, a reversal of its earlier position that no Bu... Airtable is great, until it is patient data. On standard plans there is no BAA. The HIPAA add-on is enterprise-only, and even then... Airtable is now HIPAA compliant for its Enterprise Scale customers. Airtable's platform is designed to help healthcare providers a... Not sure why they're so slack on this. Smartsheet is HIPAA compliant, but there's some hoops you have to jump through and it's not... HIPAA: The Part Everyone Gets Wrong Every couple of weeks a client asks us, "Is Airtable HIPAA compliant?" The honest answer is "i... The critical requirements and boundaries for using Airtable with patient data include: Enterprise Scale Plan Required: HIPAA support and the option to execute a Business Associate Agreement (BAA) are restricted exclusively to Airtable’s highest-tier Enterprise Scale plan. Free, Team, and Business plans are strictly non-compliant and prohibited for storing PHI. Signed Business Associate Agreement (BAA): You must formally execute Airtable’s Health Information Exhibit, which incorporates their BAA, via your Airtable account representative before any patient data enters the platform. Strict Where-Data-Lives Boundaries: Under Airtable's compliance rules, ePHI and medical data must only live inside record cells within designated bases or interfaces. Feature Exclusions:Airtable AI: Cannot be used or enabled in workspaces containing ePHI unless specific health supplemental terms are met (and generally restricted from touching raw PHI). Automations & Email: You cannot expose ePHI in unencrypted or non-compliant automated notification emails. Customer Support: You must never include patient data or screenshots containing PHI in support tickets. Patient Portals: Airtable explicitly prohibits using its native features as a direct patient-facing portal. Airtable AI: Cannot be used or enabled in workspaces containing ePHI unless specific health supplemental terms are met (and generally restricted from touching raw PHI). Automations & Email: You cannot expose ePHI in unencrypted or non-compliant automated notification emails. Customer Support: You must never include patient data or screenshots containing PHI in support tickets. Patient Portals: Airtable explicitly prohibits using its native features as a direct patient-facing portal. Third-Party Integrations: Any connected tool (like Zapier, Slack, or custom APIs) must also be HIPAA-compliant and covered by its own BAA; a single unencrypted link breaks the chain of custody. - **Enterprise Scale Plan Required:** HIPAA support and the option to execute a Business Associate Agreement (BAA) are restricted exclusively to Airtable’s highest-tier **Enterprise Scale** plan. Free, Team, and Business plans are strictly non-compliant and prohibited for storing PHI.[](https://teachmehipaa.com/hipaa-baa/productivity/airtable/) - **Signed Business Associate Agreement (BAA):** You must formally execute Airtable’s **Health Information Exhibit** , which incorporates their BAA, via your Airtable account representative before any patient data enters the platform.[](https://teachmehipaa.com/hipaa-baa/productivity/airtable/) - **Strict Where-Data-Lives Boundaries:** Under Airtable's compliance rules, ePHI and medical data **must only live inside record cells** within designated bases or interfaces.[](https://www.airtable.com/company/health-info-datasheet) [[1]](https://www.airtable.com/company/health-info-datasheet) - **Feature Exclusions:** - **Airtable AI:** Cannot be used or enabled in workspaces containing ePHI unless specific health supplemental terms are met (and generally restricted from touching raw PHI). - **Automations & Email:** You cannot expose ePHI in unencrypted or non-compliant automated notification emails. - **Customer Support:** You must never include patient data or screenshots containing PHI in support tickets. - **Patient Portals:** Airtable explicitly prohibits using its native features as a direct patient-facing portal.[](https://teachmehipaa.com/hipaa-baa/productivity/airtable/) - **Third-Party Integrations:** Any connected tool (like Zapier, Slack, or custom APIs) must also be HIPAA-compliant and covered by its own BAA; a single unencrypted link breaks the chain of custody.[](https://www.specode.ai/blog/is-airtable-hipaa-compliant) [[1]](https://www.specode.ai/blog/is-airtable-hipaa-compliant)[[2]](https://curogram.com/blog/mental-health/hipaa-compliant-texting-for-behavioral-health)[[3]](https://www.mindbowser.com/hipaa-compliant-app-with-flutter/)[[4]](https://www.slicktext.com/hipaa-compliant-texting) Requirements for HIPAA and/or CMIA Customers * Automations | Airtable automations allow users to automate workflows, including out... Off-load the PHI, Keep Only “Breadcrumbs” in Airtable * Shape-shift PHI into opaque IDs. Store patient details in a hardened backe... Each tool that handles PHI on your behalf needs its own BAA. This includes your texting platform, even if it integrates with your ... 4⃣ HIPAA ( Health Insurance Portability and Accountability Act ) -Compliant APIs Ensure that any third-party APIs you integrate ar... Yes, our API enables secure, HIPAA compliant messaging for your organization. When connecting with third-party services like Zapie... Review details on the Airtable HIPAA Compliance Overview or check their explicit rules in the Airtable Health Information Datasheet. Review details on the [Airtable HIPAA Compliance Overview](https://www.airtable.com/company/hipaa-airtable) or check their explicit rules in the [Airtable Health Information Datasheet](https://www.airtable.com/company/health-info-datasheet).[[1]](https://support.airtable.com/docs/understanding-hipaa-at-airtable)[[2]](https://www.nudgesecurity.com/security-profile/airtable-com)[[3]](https://teachmehipaa.com/hipaa-baa/productivity/airtable/) Your organization's use of Airtable must comply with the requirements listed in the Health Information Datasheet (opens in new tab... Review the complete security profile for Airtable, including supply chain details, privacy policy, terms of service, GDPR complian... Airtable's terms prohibit storing ePHI on the Free, Team, and Business plans, so anyone below Enterprise Scale should keep treatin... If you're planning a setup, tell me: What tier/plan your organization currently uses Whether you plan to connect external integrations or APIs - What **tier/plan** your organization currently uses - Whether you plan to connect **external integrations or APIs** I can help you evaluate if Airtable fits your workflow or if a dedicated backend is safer.