Independent vendor compliance review
Is Airtable HIPAA compliant?
Airtable may support some HIPAA-regulated workflows only for Enterprise Scale customers that execute Airtable's Health Information Exhibit or applicable BAA terms. Do not store ePHI in Airtable unless plan eligibility, covered features, integrations, automations, and support boundaries are verified.
Direct compliance answer
Airtable HIPAA, BAA, PHI, and SOC 2 snapshot
Last checked: 2026-07-25 | Confidence: High
| Direct answer | Airtable may support some HIPAA-regulated workflows only for Enterprise Scale customers that execute Airtable's Health Information Exhibit or applicable BAA terms. Do not store ePHI in Airtable unless plan eligibility, covered features, integrations, automations, and support boundaries are verified. |
|---|---|
| BAA availability | Airtable's current health information documentation says the Health Information Exhibit execution process is available only to Enterprise Scale customers; customers without it are not permitted to store ePHI or medical information in Airtable. |
| Can it handle PHI? | Bases, record fields, attachments, interfaces, automations, emails, support tickets, AI features, and integrations can expose ePHI if they are not inside the covered configuration. |
| SOC 2 caveat | Airtable publicly references security and compliance controls, including SOC 2 materials. Request the current report and confirm whether the relevant Airtable services are in scope. |
| What to verify | Whether Airtable has executed the Health Information Exhibit or applicable BAA terms for the exact customer account. Whether the buyer's plan, workspace, bases, interfaces, attachments, automations, support access, exports, and audit logs are in covered scope. |
Independent research view
Airtable Enterprise HIPAA scope checklist
Airtable's public materials provide a conditional path, not blanket coverage. Treat each row as a written verification item before ePHI enters the workspace.
| Review area | Vendor public signal | Buyer verification |
|---|---|---|
| Eligible plan | Health information terms are tied to Enterprise Scale. | Confirm the exact organization and workspaces remain on an eligible plan. |
| Required agreement | The Health Information Exhibit includes Business Associate Addendum terms for HIPAA customers. | Execute the current terms and confirm the covered organization units before storing ePHI. |
| AI features | Airtable publishes separate health information and supplemental AI terms that buyers should reconcile for their exact setup. | Obtain written confirmation for the selected AI provider, feature, user group, and healthcare activity. |
| Automations and integrations | Automations, outgoing email, syncs, attachments, and connected apps can move data beyond the base. | Map every destination and verify separate BAA coverage and notification settings where needed. |
HIPAA status signal
Conditional
BAA public signal
Enterprise Scale only
SOC 2 evidence signal
Public evidence
PHI warning: Bases, record fields, attachments, interfaces, automations, emails, support tickets, AI features, and integrations can expose ePHI if they are not inside the covered configuration.
Search query answers
Is Airtable HIPAA compliant in 2026?
Airtable may support some HIPAA-regulated workflows only for Enterprise Scale customers that execute Airtable's Health Information Exhibit or applicable BAA terms. It should not be treated as HIPAA-ready on lower plans or before covered features, integrations, automations, and support boundaries are verified.
Does Airtable offer a BAA for HIPAA?
Airtable's public health information documentation says the Health Information Exhibit includes Business Associate Addendum terms for HIPAA customers and is available through the Enterprise Scale process. Buyers should verify the current contract, covered services, and plan eligibility directly with Airtable.
Which Airtable plan can support a HIPAA-regulated workflow?
Airtable's current Health Information Datasheet says the Health Information Exhibit execution process is available to Enterprise Scale customers. Buyers must still confirm the executed terms, covered workspace, features, support paths, AI use, automations, and integrations before storing ePHI.
Can Airtable store ePHI?
Airtable should store ePHI only after the customer verifies Enterprise Scale eligibility, executes the required health information terms, configures access controls, and confirms that bases, interfaces, attachments, automations, support, and integrations remain in covered scope.
Can Airtable AI be used in a HIPAA-enabled environment?
Airtable publishes separate Health Information Datasheet and Supplemental AI Terms that buyers should reconcile for the exact account, AI provider, feature, permitted users, and healthcare activity. Obtain current written confirmation before sending ePHI to any Airtable AI workflow.
HIPAA, BAA, and SOC 2 summary
| HIPAA | Airtable states that HIPAA support is available on Enterprise Scale and that customers intending to store ePHI must execute the Health Information Exhibit, which includes the Business Associate Addendum for HIPAA customers. |
|---|---|
| BAA | Airtable's current health information documentation says the Health Information Exhibit execution process is available only to Enterprise Scale customers; customers without it are not permitted to store ePHI or medical information in Airtable. |
| SOC 2 | Airtable publicly references security and compliance controls, including SOC 2 materials. Request the current report and confirm whether the relevant Airtable services are in scope. |
| PHI risk | Bases, record fields, attachments, interfaces, automations, emails, support tickets, AI features, and integrations can expose ePHI if they are not inside the covered configuration. |
| Category | HIPAA-Compliant Forms and Intake Software |
| Last checked | 2026-07-25 |
| Confidence | High |
Public evidence and open questions
What public sources say
- Airtable states that HIPAA support is available on Enterprise Scale.
- Airtable says customers intending to store ePHI must execute the Health Information Exhibit, which includes Business Associate Addendum terms for HIPAA customers.
- Airtable publishes separate supplemental terms for certain AI use connected to HIPAA/CMIA-enabled services.
- Airtable publicly references security and compliance controls, including SOC 2 materials.
What remains unconfirmed
- Whether the buyer's exact workspace, plan, bases, interfaces, automations, support path, and integrations are included in covered scope.
- Whether a selected Airtable AI feature, model provider, permitted user group, and healthcare activity are allowed under the buyer's current written terms.
- Whether attachments, exports, notifications, third-party syncs, and downstream tools each have appropriate BAA coverage and configuration.
What it may be used for
- Structured operational tracking where ePHI is excluded from Airtable.
- HIPAA-regulated workflows only after Enterprise Scale eligibility, Health Information Exhibit execution, covered-feature review, and configuration controls are verified.
- Internal workflow databases where access controls, auditability, attachments, automations, and integrations are reviewed together.
What not to use it for
- Storing ePHI on non-Enterprise Scale plans or before the Health Information Exhibit is executed.
- Putting ePHI in base names, table names, interface names, support tickets, screenshots, outgoing emails, or unsupported automations.
- Sending PHI to third-party integrations without separate BAA and data-flow review.
What to verify with the vendor
- Whether Airtable has executed the Health Information Exhibit or applicable BAA terms for the exact customer account.
- Whether the buyer's plan, workspace, bases, interfaces, attachments, automations, support access, exports, and audit logs are in covered scope.
- Whether any Airtable AI feature is permitted for the selected model provider, users, healthcare activity, and data under the current supplemental terms.
- Whether third-party integrations, sync destinations, email notifications, forms, and downstream tools have separate BAA coverage where needed.
- Whether user permissions, sharing, retention, exports, backups, and incident response controls match the intended ePHI workflow.
Safer alternatives and related profiles
Safer alternatives to consider
- A HIPAA-focused intake, case management, or patient operations platform with explicit BAA coverage for the exact workflow.
- Airtable Enterprise Scale only after health information terms, feature scope, integrations, and configuration are verified.
- A covered database or workflow tool where ePHI storage, attachments, audit logs, and downstream syncs are contractually in scope.
FAQ
Is Airtable HIPAA compliant in 2026?
Airtable may support some HIPAA-regulated workflows only for Enterprise Scale customers that execute Airtable's Health Information Exhibit or applicable BAA terms. It should not be treated as HIPAA-ready on lower plans or before covered features, integrations, automations, and support boundaries are verified.
Does Airtable offer a BAA for HIPAA?
Airtable's public health information documentation says the Health Information Exhibit includes Business Associate Addendum terms for HIPAA customers and is available through the Enterprise Scale process. Buyers should verify the current contract, covered services, and plan eligibility directly with Airtable.
Which Airtable plan can support a HIPAA-regulated workflow?
Airtable's current Health Information Datasheet says the Health Information Exhibit execution process is available to Enterprise Scale customers. Buyers must still confirm the executed terms, covered workspace, features, support paths, AI use, automations, and integrations before storing ePHI.
Can Airtable store ePHI?
Airtable should store ePHI only after the customer verifies Enterprise Scale eligibility, executes the required health information terms, configures access controls, and confirms that bases, interfaces, attachments, automations, support, and integrations remain in covered scope.
Can Airtable AI be used in a HIPAA-enabled environment?
Airtable publishes separate Health Information Datasheet and Supplemental AI Terms that buyers should reconcile for the exact account, AI provider, feature, permitted users, and healthcare activity. Obtain current written confirmation before sending ePHI to any Airtable AI workflow.
Is Airtable HIPAA compliant?
Airtable may support some HIPAA-regulated workflows only for Enterprise Scale customers that execute Airtable's Health Information Exhibit or applicable BAA terms. Do not store ePHI in Airtable unless plan eligibility, covered features, integrations, automations, and support boundaries are verified.
Will Airtable sign a BAA?
Airtable's current health information documentation says the Health Information Exhibit execution process is available only to Enterprise Scale customers; customers without it are not permitted to store ePHI or medical information in Airtable.
Can Airtable be used with PHI?
Do not use this vendor with PHI until your organization verifies BAA scope, covered services, configuration, access controls, data retention, and connected integrations.
Does SOC 2 mean Airtable is HIPAA compliant?
No. SOC 2 evidence can support security diligence, but it does not prove HIPAA compliance, confirm BAA coverage, or approve PHI use. Review HIPAA terms, BAA scope, covered services, configuration, and intended workflow separately.
What should buyers verify before using Airtable with PHI?
Whether Airtable has executed the Health Information Exhibit or applicable BAA terms for the exact customer account. Whether the buyer's plan, workspace, bases, interfaces, attachments, automations, support access, exports, and audit logs are in covered scope. Whether any Airtable AI feature is permitted for the selected model provider, users, healthcare activity, and data under the current supplemental terms. Whether third-party integrations, sync destinations, email notifications, forms, and downstream tools have separate BAA coverage where needed. Whether user permissions, sharing, retention, exports, backups, and incident response controls match the intended ePHI workflow.
Last checked and source notes
- Last checked
- 2026-07-25
- Confidence
- High
- Dataset rows
- 271 vendors
- Reviewed Airtable's HIPAA overview, Health Information Datasheet updated March 13, 2026, and Supplemental AI Terms updated July 23, 2026, on 2026-07-25.
- Airtable HIPAA suitability depends on plan, executed terms, covered features, account configuration, support boundaries, and integrations.
- Airtable's health information and supplemental AI materials should be reconciled for the exact AI feature, provider, permitted users, and healthcare activity.
- ComplySaaS did not verify a private Airtable contract or customer-specific BAA.
- Airtable HIPAA overview
- Airtable Health Information Datasheet
- Airtable Supplemental AI Terms for Health Information