# BAA Atlas

> BAA Atlas answers one question for major SaaS vendors: will it sign a HIPAA Business Associate Agreement (BAA), and can you store protected health information (PHI) in it? Every verdict is cited to a dated public source. Cited information for vendor procurement — not legal advice; confirm current terms with the vendor.

Dataset: 105 vendors, last verified 2026-05-31.

## Start here
- [Vendor directory](https://baa-atlas.foundagent.net/vendors): every vendor grouped by category, each with its BAA + PHI verdict.
- [Methodology](https://baa-atlas.foundagent.net/methodology): how each verdict is sourced and date-stamped.

## Vendors
- [ActiveCampaign](https://baa-atlas.foundagent.net/vendors/activecampaign): Sometimes — ActiveCampaign signs a HIPAA BAA only on specific plans or add-ons.
- [Acuity Scheduling](https://baa-atlas.foundagent.net/vendors/acuity-scheduling): Sometimes — Acuity Scheduling signs a HIPAA BAA only on specific plans or add-ons.
- [Adobe Acrobat Sign](https://baa-atlas.foundagent.net/vendors/adobe-acrobat-sign): Sometimes — Adobe Acrobat Sign signs a HIPAA BAA only on specific plans or add-ons.
- [Aircall](https://baa-atlas.foundagent.net/vendors/aircall): Yes — Aircall will sign a HIPAA Business Associate Agreement (BAA).
- [Airtable](https://baa-atlas.foundagent.net/vendors/airtable): Sometimes — Airtable signs a HIPAA BAA only on specific plans or add-ons.
- [Amazon Web Services (AWS)](https://baa-atlas.foundagent.net/vendors/amazon-web-services): Yes — Amazon Web Services (AWS) will sign a HIPAA Business Associate Agreement (BAA).
- [Amplitude](https://baa-atlas.foundagent.net/vendors/amplitude): Yes — Amplitude will sign a HIPAA Business Associate Agreement (BAA).
- [Anthropic (Claude)](https://baa-atlas.foundagent.net/vendors/anthropic): Sometimes — Anthropic (Claude) signs a HIPAA BAA only on specific plans or add-ons.
- [Asana](https://baa-atlas.foundagent.net/vendors/asana): Sometimes — Asana signs a HIPAA BAA only on specific plans or add-ons.
- [AssemblyAI](https://baa-atlas.foundagent.net/vendors/assemblyai): Yes — AssemblyAI will sign a HIPAA Business Associate Agreement (BAA).
- [Atlassian Jira & Confluence Cloud](https://baa-atlas.foundagent.net/vendors/atlassian-jira-confluence): Sometimes — Atlassian Jira & Confluence Cloud signs a HIPAA BAA only on specific plans or add-ons.
- [Auth0](https://baa-atlas.foundagent.net/vendors/auth0): Sometimes — Auth0 signs a HIPAA BAA only on specific plans or add-ons.
- [Basecamp](https://baa-atlas.foundagent.net/vendors/basecamp): No — Basecamp does not sign a HIPAA Business Associate Agreement (BAA).
- [Box](https://baa-atlas.foundagent.net/vendors/box): Sometimes — Box signs a HIPAA BAA only on specific plans or add-ons.
- [Braze](https://baa-atlas.foundagent.net/vendors/braze): Yes — Braze will sign a HIPAA Business Associate Agreement (BAA).
- [Brevo](https://baa-atlas.foundagent.net/vendors/brevo): No — Brevo does not sign a HIPAA Business Associate Agreement (BAA).
- [Calendly](https://baa-atlas.foundagent.net/vendors/calendly): No — Calendly does not sign a HIPAA Business Associate Agreement (BAA).
- [Canva](https://baa-atlas.foundagent.net/vendors/canva): No — Canva does not sign a HIPAA Business Associate Agreement (BAA).
- [Cisco Webex](https://baa-atlas.foundagent.net/vendors/cisco-webex): Yes — Cisco Webex will sign a HIPAA Business Associate Agreement (BAA).
- [ClickUp](https://baa-atlas.foundagent.net/vendors/clickup): Sometimes — ClickUp signs a HIPAA BAA only on specific plans or add-ons.
- [Cloudflare](https://baa-atlas.foundagent.net/vendors/cloudflare): Sometimes — Cloudflare signs a HIPAA BAA only on specific plans or add-ons.
- [Coda](https://baa-atlas.foundagent.net/vendors/coda): Sometimes — Coda signs a HIPAA BAA only on specific plans or add-ons.
- [Confluent](https://baa-atlas.foundagent.net/vendors/confluent): Yes — Confluent will sign a HIPAA Business Associate Agreement (BAA).
- [Constant Contact](https://baa-atlas.foundagent.net/vendors/constant-contact): Yes — Constant Contact will sign a HIPAA Business Associate Agreement (BAA).
- [Customer.io](https://baa-atlas.foundagent.net/vendors/customer-io): Yes — Customer.io will sign a HIPAA Business Associate Agreement (BAA).
- [Databricks](https://baa-atlas.foundagent.net/vendors/databricks): Yes — Databricks will sign a HIPAA Business Associate Agreement (BAA).
- [Datadog](https://baa-atlas.foundagent.net/vendors/datadog): Yes — Datadog will sign a HIPAA Business Associate Agreement (BAA).
- [Deepgram](https://baa-atlas.foundagent.net/vendors/deepgram): Yes — Deepgram will sign a HIPAA Business Associate Agreement (BAA).
- [Dialpad](https://baa-atlas.foundagent.net/vendors/dialpad): Yes — Dialpad will sign a HIPAA Business Associate Agreement (BAA).
- [DigitalOcean](https://baa-atlas.foundagent.net/vendors/digitalocean): Sometimes — DigitalOcean signs a HIPAA BAA only on specific plans or add-ons.
- [DocuSign](https://baa-atlas.foundagent.net/vendors/docusign): Yes — DocuSign will sign a HIPAA Business Associate Agreement (BAA).
- [Dropbox](https://baa-atlas.foundagent.net/vendors/dropbox): Sometimes — Dropbox signs a HIPAA BAA only on specific plans or add-ons.
- [Dropbox Sign](https://baa-atlas.foundagent.net/vendors/dropbox-sign): Sometimes — Dropbox Sign signs a HIPAA BAA only on specific plans or add-ons.
- [Elastic Cloud](https://baa-atlas.foundagent.net/vendors/elastic-cloud): Yes — Elastic Cloud will sign a HIPAA Business Associate Agreement (BAA).
- [Figma](https://baa-atlas.foundagent.net/vendors/figma): No — Figma does not sign a HIPAA Business Associate Agreement (BAA).
- [Five9](https://baa-atlas.foundagent.net/vendors/five9): Yes — Five9 will sign a HIPAA Business Associate Agreement (BAA).
- [Fivetran](https://baa-atlas.foundagent.net/vendors/fivetran): Sometimes — Fivetran signs a HIPAA BAA only on specific plans or add-ons.
- [Freshdesk (Freshworks)](https://baa-atlas.foundagent.net/vendors/freshdesk): Sometimes — Freshdesk (Freshworks) signs a HIPAA BAA only on specific plans or add-ons.
- [Front](https://baa-atlas.foundagent.net/vendors/front): Yes — Front will sign a HIPAA Business Associate Agreement (BAA).
- [FullStory](https://baa-atlas.foundagent.net/vendors/fullstory): Sometimes — FullStory signs a HIPAA BAA only on specific plans or add-ons.
- [GitHub](https://baa-atlas.foundagent.net/vendors/github): Sometimes — GitHub signs a HIPAA BAA only on specific plans or add-ons.
- [Google Analytics (GA4)](https://baa-atlas.foundagent.net/vendors/google-analytics-ga4): No — Google Analytics (GA4) does not sign a HIPAA Business Associate Agreement (BAA).
- [Google Cloud Platform (GCP)](https://baa-atlas.foundagent.net/vendors/google-cloud-platform): Yes — Google Cloud Platform (GCP) will sign a HIPAA Business Associate Agreement (BAA).
- [Google Workspace](https://baa-atlas.foundagent.net/vendors/google-workspace): Sometimes — Google Workspace signs a HIPAA BAA only on specific plans or add-ons.
- [GoTo Meeting](https://baa-atlas.foundagent.net/vendors/goto-meeting): Yes — GoTo Meeting will sign a HIPAA Business Associate Agreement (BAA).
- [Help Scout](https://baa-atlas.foundagent.net/vendors/help-scout): Sometimes — Help Scout signs a HIPAA BAA only on specific plans or add-ons.
- [Heroku (Salesforce)](https://baa-atlas.foundagent.net/vendors/heroku): Sometimes — Heroku (Salesforce) signs a HIPAA BAA only on specific plans or add-ons.
- [Hotjar](https://baa-atlas.foundagent.net/vendors/hotjar): No — Hotjar does not sign a HIPAA Business Associate Agreement (BAA).
- [HubSpot](https://baa-atlas.foundagent.net/vendors/hubspot): Sometimes — HubSpot signs a HIPAA BAA only on specific plans or add-ons.
- [Intercom](https://baa-atlas.foundagent.net/vendors/intercom): Sometimes — Intercom signs a HIPAA BAA only on specific plans or add-ons.
- [Iterable](https://baa-atlas.foundagent.net/vendors/iterable): Yes — Iterable will sign a HIPAA Business Associate Agreement (BAA).
- [Jotform](https://baa-atlas.foundagent.net/vendors/jotform): Sometimes — Jotform signs a HIPAA BAA only on specific plans or add-ons.
- [Klaviyo](https://baa-atlas.foundagent.net/vendors/klaviyo): No — Klaviyo does not sign a HIPAA Business Associate Agreement (BAA).
- [Linear](https://baa-atlas.foundagent.net/vendors/linear): Sometimes — Linear signs a HIPAA BAA only on specific plans or add-ons.
- [Loom](https://baa-atlas.foundagent.net/vendors/loom): No — Loom does not sign a HIPAA Business Associate Agreement (BAA).
- [Mailchimp](https://baa-atlas.foundagent.net/vendors/mailchimp): No — Mailchimp does not sign a HIPAA Business Associate Agreement (BAA).
- [Mailgun (Sinch)](https://baa-atlas.foundagent.net/vendors/mailgun): Sometimes — Mailgun (Sinch) signs a HIPAA BAA only on specific plans or add-ons.
- [Microsoft 365 (Office 365)](https://baa-atlas.foundagent.net/vendors/microsoft-365): Sometimes — Microsoft 365 (Office 365) signs a HIPAA BAA only on specific plans or add-ons.
- [Microsoft Azure](https://baa-atlas.foundagent.net/vendors/microsoft-azure): Yes — Microsoft Azure will sign a HIPAA Business Associate Agreement (BAA).
- [Miro](https://baa-atlas.foundagent.net/vendors/miro): No — Miro does not sign a HIPAA Business Associate Agreement (BAA).
- [Mixpanel](https://baa-atlas.foundagent.net/vendors/mixpanel): Sometimes — Mixpanel signs a HIPAA BAA only on specific plans or add-ons.
- [monday.com](https://baa-atlas.foundagent.net/vendors/monday-com): Sometimes — monday.com signs a HIPAA BAA only on specific plans or add-ons.
- [MongoDB Atlas](https://baa-atlas.foundagent.net/vendors/mongodb-atlas): Sometimes — MongoDB Atlas signs a HIPAA BAA only on specific plans or add-ons.
- [Netlify](https://baa-atlas.foundagent.net/vendors/netlify): Sometimes — Netlify signs a HIPAA BAA only on specific plans or add-ons.
- [New Relic](https://baa-atlas.foundagent.net/vendors/new-relic): Sometimes — New Relic signs a HIPAA BAA only on specific plans or add-ons.
- [Notion](https://baa-atlas.foundagent.net/vendors/notion): Sometimes — Notion signs a HIPAA BAA only on specific plans or add-ons.
- [Okta](https://baa-atlas.foundagent.net/vendors/okta): Sometimes — Okta signs a HIPAA BAA only on specific plans or add-ons.
- [OpenAI](https://baa-atlas.foundagent.net/vendors/openai): Sometimes — OpenAI signs a HIPAA BAA only on specific plans or add-ons.
- [OpenPhone](https://baa-atlas.foundagent.net/vendors/openphone): Sometimes — OpenPhone signs a HIPAA BAA only on specific plans or add-ons.
- [PandaDoc](https://baa-atlas.foundagent.net/vendors/pandadoc): Sometimes — PandaDoc signs a HIPAA BAA only on specific plans or add-ons.
- [Pipedrive](https://baa-atlas.foundagent.net/vendors/pipedrive): No — Pipedrive does not sign a HIPAA Business Associate Agreement (BAA).
- [PlanetScale](https://baa-atlas.foundagent.net/vendors/planetscale): Yes — PlanetScale will sign a HIPAA Business Associate Agreement (BAA).
- [PostHog](https://baa-atlas.foundagent.net/vendors/posthog): Sometimes — PostHog signs a HIPAA BAA only on specific plans or add-ons.
- [Postmark](https://baa-atlas.foundagent.net/vendors/postmark): No — Postmark does not sign a HIPAA Business Associate Agreement (BAA).
- [QuickBooks Online (Intuit)](https://baa-atlas.foundagent.net/vendors/quickbooks): No — QuickBooks Online (Intuit) does not sign a HIPAA Business Associate Agreement (BAA).
- [Render](https://baa-atlas.foundagent.net/vendors/render): Sometimes — Render signs a HIPAA BAA only on specific plans or add-ons.
- [Retool](https://baa-atlas.foundagent.net/vendors/retool): No — Retool does not sign a HIPAA Business Associate Agreement (BAA).
- [RingCentral](https://baa-atlas.foundagent.net/vendors/ringcentral): Yes — RingCentral will sign a HIPAA Business Associate Agreement (BAA).
- [Salesforce](https://baa-atlas.foundagent.net/vendors/salesforce): Yes — Salesforce will sign a HIPAA Business Associate Agreement (BAA).
- [Sentry](https://baa-atlas.foundagent.net/vendors/sentry): Sometimes — Sentry signs a HIPAA BAA only on specific plans or add-ons.
- [ServiceNow](https://baa-atlas.foundagent.net/vendors/servicenow): Yes — ServiceNow will sign a HIPAA Business Associate Agreement (BAA).
- [Shopify](https://baa-atlas.foundagent.net/vendors/shopify): No — Shopify does not sign a HIPAA Business Associate Agreement (BAA).
- [SignNow](https://baa-atlas.foundagent.net/vendors/signnow): Sometimes — SignNow signs a HIPAA BAA only on specific plans or add-ons.
- [Slack](https://baa-atlas.foundagent.net/vendors/slack): Sometimes — Slack signs a HIPAA BAA only on specific plans or add-ons.
- [Smartsheet](https://baa-atlas.foundagent.net/vendors/smartsheet): Sometimes — Smartsheet signs a HIPAA BAA only on specific plans or add-ons.
- [Snowflake](https://baa-atlas.foundagent.net/vendors/snowflake): Sometimes — Snowflake signs a HIPAA BAA only on specific plans or add-ons.
- [Squarespace](https://baa-atlas.foundagent.net/vendors/squarespace): Sometimes — Squarespace signs a HIPAA BAA only on specific plans or add-ons.
- [Stripe](https://baa-atlas.foundagent.net/vendors/stripe): No — Stripe does not sign a HIPAA Business Associate Agreement (BAA).
- [Supabase](https://baa-atlas.foundagent.net/vendors/supabase): Sometimes — Supabase signs a HIPAA BAA only on specific plans or add-ons.
- [SurveyMonkey](https://baa-atlas.foundagent.net/vendors/surveymonkey): Sometimes — SurveyMonkey signs a HIPAA BAA only on specific plans or add-ons.
- [Talkdesk](https://baa-atlas.foundagent.net/vendors/talkdesk): Yes — Talkdesk will sign a HIPAA Business Associate Agreement (BAA).
- [Trello](https://baa-atlas.foundagent.net/vendors/trello): No — Trello does not sign a HIPAA Business Associate Agreement (BAA).
- [Twilio](https://baa-atlas.foundagent.net/vendors/twilio): Sometimes — Twilio signs a HIPAA BAA only on specific plans or add-ons.
- [Twilio Segment](https://baa-atlas.foundagent.net/vendors/twilio-segment): Sometimes — Twilio Segment signs a HIPAA BAA only on specific plans or add-ons.
- [Twilio SendGrid](https://baa-atlas.foundagent.net/vendors/sendgrid): No — Twilio SendGrid does not sign a HIPAA Business Associate Agreement (BAA).
- [Typeform](https://baa-atlas.foundagent.net/vendors/typeform): Sometimes — Typeform signs a HIPAA BAA only on specific plans or add-ons.
- [Vercel](https://baa-atlas.foundagent.net/vendors/vercel): Sometimes — Vercel signs a HIPAA BAA only on specific plans or add-ons.
- [Vonage](https://baa-atlas.foundagent.net/vendors/vonage): Sometimes — Vonage signs a HIPAA BAA only on specific plans or add-ons.
- [Webflow](https://baa-atlas.foundagent.net/vendors/webflow): No — Webflow does not sign a HIPAA Business Associate Agreement (BAA).
- [Wix](https://baa-atlas.foundagent.net/vendors/wix): Sometimes — Wix signs a HIPAA BAA only on specific plans or add-ons.
- [Wrike](https://baa-atlas.foundagent.net/vendors/wrike): Yes — Wrike will sign a HIPAA Business Associate Agreement (BAA).
- [Zapier](https://baa-atlas.foundagent.net/vendors/zapier): No — Zapier does not sign a HIPAA Business Associate Agreement (BAA).
- [Zendesk](https://baa-atlas.foundagent.net/vendors/zendesk): Sometimes — Zendesk signs a HIPAA BAA only on specific plans or add-ons.
- [Zoho](https://baa-atlas.foundagent.net/vendors/zoho): Sometimes — Zoho signs a HIPAA BAA only on specific plans or add-ons.
- [Zoom](https://baa-atlas.foundagent.net/vendors/zoom): Sometimes — Zoom signs a HIPAA BAA only on specific plans or add-ons.

# AI Data Watch

> AI Data Watch answers, for major AI tools, whether the tool trains its models on your data, whether you can opt out, and whether zero-retention or a DPA is available — broken out by plan tier. Every verdict is cited to a dated public source. Cited information, not legal advice; confirm current terms with the vendor.

Dataset: 34 AI tools, last verified 2026-06-01.

- [AI tool directory](https://baa-atlas.foundagent.net/ai): every tool with its data-training verdict.
- [Which AI tools sign a HIPAA BAA](https://baa-atlas.foundagent.net/ai/hipaa): every AI tool ranked by whether it signs a HIPAA Business Associate Agreement and on which plan tier, with the PHI-eligibility verdict.

## AI tools
Each tool lists its data-training verdict and, below it, its HIPAA BAA / PHI-eligibility verdict.
- [Adobe Firefly](https://baa-atlas.foundagent.net/ai/adobe-firefly): No — Adobe Firefly does not use your content to train its AI models by default.
  - HIPAA BAA: No — Adobe Firefly does not sign a HIPAA BAA; never put PHI into it. Do not process PHI in Adobe Firefly — Adobe's BAA covers only its HIPAA-Ready services, which do not include Firefly.
- [Amazon Q Developer](https://baa-atlas.foundagent.net/ai/amazon-q-developer): It depends — Amazon Q Developer trains on consumer/free-tier data by default but excludes business, enterprise and API tiers.
  - HIPAA BAA: No — Amazon Q Developer does not sign a HIPAA BAA; never put PHI into it. Even under an executed AWS BAA, do not use ePHI with Amazon Q Developer — it is not a HIPAA-eligible service.
- [Canva (Magic Studio)](https://baa-atlas.foundagent.net/ai/canva): It depends — Canva (Magic Studio) trains on consumer/free-tier data by default but excludes business, enterprise and API tiers.
  - HIPAA BAA: No — Canva (Magic Studio) does not sign a HIPAA BAA; never put PHI into it. Use Canva for non-PHI content only — it will not sign a BAA, so designing or uploading protected health information is non-compliant.
- [Character.AI](https://baa-atlas.foundagent.net/ai/character-ai): Yes — Character.AI trains on your data by default; you have to opt out.
  - HIPAA BAA: No — Character.AI does not sign a HIPAA BAA; never put PHI into it. Do not enter PHI into Character.AI — it is a consumer product with no BAA and is not HIPAA-ready.
- [ChatGPT](https://baa-atlas.foundagent.net/ai/chatgpt): It depends — ChatGPT trains on consumer/free-tier data by default but excludes business, enterprise and API tiers.
  - HIPAA BAA: Only on qualifying tiers — ChatGPT signs a HIPAA BAA on specific (usually enterprise/business) plans; consumer tiers are excluded. PHI is permitted only on a BAA-covered Enterprise, API or ChatGPT-for-Healthcare account — never on Free, Plus or Pro.
- [Claude](https://baa-atlas.foundagent.net/ai/anthropic-claude): It depends — Claude trains on consumer/free-tier data by default but excludes business, enterprise and API tiers.
  - HIPAA BAA: Only on qualifying tiers — Claude signs a HIPAA BAA on specific (usually enterprise/business) plans; consumer tiers are excluded. PHI is permitted only on a BAA-covered Claude for Enterprise (or commercial/API) agreement — never on consumer Claude.
- [Codeium / Windsurf](https://baa-atlas.foundagent.net/ai/codeium): It depends — Codeium / Windsurf trains on consumer/free-tier data by default but excludes business, enterprise and API tiers.
  - HIPAA BAA: Only on qualifying tiers — Codeium / Windsurf signs a HIPAA BAA on specific (usually enterprise/business) plans; consumer tiers are excluded. PHI is permissible only under a separately negotiated BAA on a qualifying enterprise implementation — the default subscription disclaims HIPAA.
- [Copy.ai](https://baa-atlas.foundagent.net/ai/copy-ai): No — Copy.ai does not use your content to train its AI models by default.
  - HIPAA BAA: No — Copy.ai does not sign a HIPAA BAA; never put PHI into it. Copy.ai publishes no HIPAA BAA, so this general marketing-copy tool should not be used with protected health information.
- [Cursor](https://baa-atlas.foundagent.net/ai/cursor): It depends — Cursor trains on consumer/free-tier data by default but excludes business, enterprise and API tiers.
  - HIPAA BAA: No — Cursor does not sign a HIPAA BAA; never put PHI into it. Do not route PHI through Cursor — without a BAA, any PHI in prompts, indexed files or test data is a HIPAA exposure.
- [DeepSeek](https://baa-atlas.foundagent.net/ai/deepseek): Yes — DeepSeek trains on your data by default; you have to opt out.
  - HIPAA BAA: No — DeepSeek does not sign a HIPAA BAA; never put PHI into it. Do not use DeepSeek with PHI — no BAA is offered, data is stored in China, and it is not HIPAA-ready.
- [Descript](https://baa-atlas.foundagent.net/ai/descript): No — Descript does not use your content to train its AI models by default.
  - HIPAA BAA: No — Descript does not sign a HIPAA BAA; never put PHI into it. Descript publishes no HIPAA BAA, so its audio/video editor should not be used to process protected health information.
- [ElevenLabs](https://baa-atlas.foundagent.net/ai/elevenlabs): It depends — ElevenLabs trains on consumer/free-tier data by default but excludes business, enterprise and API tiers.
  - HIPAA BAA: Only on qualifying tiers — ElevenLabs signs a HIPAA BAA on specific (usually enterprise/business) plans; consumer tiers are excluded. PHI is permitted only on an ElevenLabs Enterprise plan with a signed BAA and Zero Retention Mode engaged.
- [Fireflies.ai](https://baa-atlas.foundagent.net/ai/fireflies): No — Fireflies.ai does not use your content to train its AI models by default.
  - HIPAA BAA: On request — Fireflies.ai will sign a HIPAA BAA for qualifying plans if you ask. PHI is permitted once a BAA is requested and signed on a qualifying paid plan.
- [GitHub Copilot](https://baa-atlas.foundagent.net/ai/github-copilot): It depends — GitHub Copilot trains on consumer/free-tier data by default but excludes business, enterprise and API tiers.
  - HIPAA BAA: No — GitHub Copilot does not sign a HIPAA BAA; never put PHI into it. Do not enter PHI into GitHub Copilot — it is excluded from Microsoft's HIPAA BAA coverage.
- [Google Gemini](https://baa-atlas.foundagent.net/ai/google-gemini): It depends — Google Gemini trains on consumer/free-tier data by default but excludes business, enterprise and API tiers.
  - HIPAA BAA: Yes — Google Gemini signs a HIPAA BAA. PHI is permitted in Gemini for Workspace once a Workspace admin has accepted the Google Workspace BAA — not in the free consumer Gemini app.
- [Google NotebookLM](https://baa-atlas.foundagent.net/ai/google-notebooklm): No — Google NotebookLM does not use your content to train its AI models by default.
  - HIPAA BAA: No — Google NotebookLM does not sign a HIPAA BAA; never put PHI into it. NotebookLM is excluded from the Google Workspace HIPAA BAA and its Included Functionality list, so do not use it with PHI.
- [Grammarly](https://baa-atlas.foundagent.net/ai/grammarly): It depends — Grammarly trains on consumer/free-tier data by default but excludes business, enterprise and API tiers.
  - HIPAA BAA: Only on qualifying tiers — Grammarly signs a HIPAA BAA on specific (usually enterprise/business) plans; consumer tiers are excluded. PHI is permitted only on a Grammarly Business Enterprise plan (100+ seats) with a signed BAA in place.
- [Grok](https://baa-atlas.foundagent.net/ai/grok): Yes — Grok trains on your data by default; you have to opt out.
  - HIPAA BAA: On request — Grok will sign a HIPAA BAA for qualifying plans if you ask. PHI is allowed only via xAI's ZDR-enabled Enterprise API after xAI reviews your questionnaire and signs a BAA — never in consumer Grok.
- [Jasper](https://baa-atlas.foundagent.net/ai/jasper): Yes — Jasper trains on your data by default; you have to opt out.
  - HIPAA BAA: No — Jasper does not sign a HIPAA BAA; never put PHI into it. Jasper's marketing platform tells users not to input PHI and signs no BAA, so it is not suitable for protected health information.
- [Meta AI](https://baa-atlas.foundagent.net/ai/meta-ai): Yes — Meta AI trains on your data by default; you have to opt out.
  - HIPAA BAA: No — Meta AI does not sign a HIPAA BAA; never put PHI into it. Do not enter PHI into Meta AI — Meta does not sign a BAA and the product is not HIPAA-ready.
- [Microsoft 365 Copilot](https://baa-atlas.foundagent.net/ai/microsoft-365-copilot): No — Microsoft 365 Copilot does not use your content to train its AI models by default.
  - HIPAA BAA: Only on qualifying tiers — Microsoft 365 Copilot signs a HIPAA BAA on specific (usually enterprise/business) plans; consumer tiers are excluded. PHI is permitted only when Microsoft 365 Copilot runs inside a BAA-covered M365 enterprise tenant (E3/E5 or Business Premium).
- [Microsoft Copilot](https://baa-atlas.foundagent.net/ai/microsoft-copilot): It depends — Microsoft Copilot trains on consumer/free-tier data by default but excludes business, enterprise and API tiers.
  - HIPAA BAA: No — Microsoft Copilot does not sign a HIPAA BAA; never put PHI into it. Do not enter PHI into consumer Microsoft Copilot — it is outside the Microsoft BAA; use a BAA-covered M365 enterprise tenant instead.
- [Midjourney](https://baa-atlas.foundagent.net/ai/midjourney): Yes — Midjourney trains on your data by default; you have to opt out.
  - HIPAA BAA: No — Midjourney does not sign a HIPAA BAA; never put PHI into it. Do not put any PHI into Midjourney — it does not sign a BAA and is intended for general creative use only.
- [Mistral Le Chat](https://baa-atlas.foundagent.net/ai/mistral-le-chat): It depends — Mistral Le Chat trains on consumer/free-tier data by default but excludes business, enterprise and API tiers.
  - HIPAA BAA: No — Mistral Le Chat does not sign a HIPAA BAA; never put PHI into it. Le Chat is not HIPAA-ready and Mistral signs no BAA for it; PHI is only viable if you self-host the open-weight models in your own environment.
- [Notion AI](https://baa-atlas.foundagent.net/ai/notion-ai): No — Notion AI does not use your content to train its AI models by default.
  - HIPAA BAA: Only on qualifying tiers — Notion AI signs a HIPAA BAA on specific (usually enterprise/business) plans; consumer tiers are excluded. Even with a Notion Enterprise BAA, the Notion AI add-on is excluded, so do not put PHI into Notion AI.
- [Otter.ai](https://baa-atlas.foundagent.net/ai/otter-ai): Yes — Otter.ai trains on your data by default; you have to opt out.
  - HIPAA BAA: Only on qualifying tiers — Otter.ai signs a HIPAA BAA on specific (usually enterprise/business) plans; consumer tiers are excluded. PHI is permitted only on Otter Enterprise with a signed BAA — never on Basic, Pro or Business.
- [Perplexity AI](https://baa-atlas.foundagent.net/ai/perplexity): It depends — Perplexity AI trains on consumer/free-tier data by default but excludes business, enterprise and API tiers.
  - HIPAA BAA: No — Perplexity AI does not sign a HIPAA BAA; never put PHI into it. Do not enter PHI into Perplexity — it does not sign a BAA on any plan, including Enterprise Pro.
- [Poe](https://baa-atlas.foundagent.net/ai/poe): It depends — Poe trains on consumer/free-tier data by default but excludes business, enterprise and API tiers.
  - HIPAA BAA: No — Poe does not sign a HIPAA BAA; never put PHI into it. Do not enter PHI into Poe — no BAA is offered and chats are shared with third-party model providers.
- [QuillBot](https://baa-atlas.foundagent.net/ai/quillbot): Yes — QuillBot trains on your data by default; you have to opt out.
  - HIPAA BAA: No — QuillBot does not sign a HIPAA BAA; never put PHI into it. QuillBot's official trust documentation offers no HIPAA BAA, so this writing/paraphrasing tool should not handle protected health information.
- [Replit AI](https://baa-atlas.foundagent.net/ai/replit-ai): It depends — Replit AI trains on consumer/free-tier data by default but excludes business, enterprise and API tiers.
  - HIPAA BAA: No — Replit AI does not sign a HIPAA BAA; never put PHI into it. Replit AI is for synthetic/test-data prototyping only — with no BAA it cannot lawfully store or process real PHI.
- [Slack AI](https://baa-atlas.foundagent.net/ai/slack-ai): No — Slack AI does not use your content to train its AI models by default.
  - HIPAA BAA: Only on qualifying tiers — Slack AI signs a HIPAA BAA on specific (usually enterprise/business) plans; consumer tiers are excluded. PHI with Slack AI is permitted only on Slack Enterprise Grid once a BAA is signed and the workspace is HIPAA-configured.
- [Sourcegraph Cody](https://baa-atlas.foundagent.net/ai/sourcegraph-cody): No — Sourcegraph Cody does not use your content to train its AI models by default.
  - HIPAA BAA: No — Sourcegraph Cody does not sign a HIPAA BAA; never put PHI into it. Cody offers no HIPAA BAA, so it should not be used to process protected health information.
- [Tabnine](https://baa-atlas.foundagent.net/ai/tabnine): No — Tabnine does not use your content to train its AI models by default.
  - HIPAA BAA: On request — Tabnine will sign a HIPAA BAA for qualifying plans if you ask. Tabnine suits HIPAA use only via its self-hosted/air-gapped Enterprise deployment where you retain full data control — not the default SaaS tier.
- [Zoom AI Companion](https://baa-atlas.foundagent.net/ai/zoom-ai-companion): No — Zoom AI Companion does not use your content to train its AI models by default.
  - HIPAA BAA: No — Zoom AI Companion does not sign a HIPAA BAA; never put PHI into it. Zoom AI Companion is carved out of the standard Zoom BAA, so do not process PHI through it unless your BAA names it in writing.

## HIPAA BAA comparison hubs
Head-to-head "which signs a HIPAA BAA, and on which plan tier?" comparisons by category. Each verdict is cited and date-stamped.
- [HIPAA BAA comparisons](https://baa-atlas.foundagent.net/compare): index of every category comparison.
- [HIPAA compliant team chat: Slack vs Teams vs Google Chat vs Zoom](https://baa-atlas.foundagent.net/compare/team-chat): Slack vs Microsoft Teams vs Google Chat — which team chat signs a HIPAA BAA?
- [HIPAA compliant cloud storage: Dropbox vs Box vs Google Drive vs OneDrive](https://baa-atlas.foundagent.net/compare/cloud-storage): Dropbox vs Box vs Google Drive vs OneDrive — which cloud storage signs a HIPAA BAA?
- [HIPAA compliant video conferencing: Zoom vs Google Meet vs Microsoft Teams](https://baa-atlas.foundagent.net/compare/video-conferencing): Zoom vs Google Meet vs Microsoft Teams — which video tool signs a HIPAA BAA for telehealth?
- [HIPAA compliant project management: monday vs Smartsheet vs Asana vs ClickUp vs Trello](https://baa-atlas.foundagent.net/compare/project-management): monday vs Smartsheet vs Asana vs ClickUp vs Trello — which signs a HIPAA BAA?
- [HIPAA compliant help desk: Zendesk vs Intercom vs Front vs Help Scout vs Freshdesk](https://baa-atlas.foundagent.net/compare/help-desk): Zendesk vs Intercom vs Front vs Help Scout vs Freshdesk — which support tool signs a HIPAA BAA?