Is Notion AI HIPAA compliant?

Yes

Notion Labs, Inc. · Productivity

Yes. Notion Labs, Inc. will sign a Business Associate Agreement (BAA) for Notion AI, usually on an enterprise plan, which is the baseline requirement for handling PHI.

What we checked

This assessment separates the consumer product from any business plan. It uses the vendor documents linked below; an unverified item is not a pass.

Business Associate Agreement: Confirmed; Notion Labs, Inc. publishes a BAA option. Confirm the exact plan and service are covered before sending PHI.
Enterprise route: Enterprise; For regulated use, validate the BAA, configured service and users under the Enterprise contract.
Default data training: No by default; Notion states that by default neither it nor its AI subprocessors use Customer Data to train any models, across all plan tiers.
Business-tier training: No by default; Notion has contractual agreements prohibiting its AI subprocessors from training on Customer Data, and your use of Notion AI grants Notion no license to train ML models on your data.

Practical risk: Some AI features can optionally enable data-retaining LLMs via workspace settings, so an admin must confirm the workspace stays on zero/short-retention configurations.

How to make a decision

Check the precise account tier, written contract and intended data before approving Notion AI. A security certification, DPA or setting can apply to only part of a vendor's service. Keep the source links with your supplier review and revisit them when the vendor changes its terms.

More on Notion AI

Is Notion AI GDPR compliant?Is Notion AI SOC 2 compliant?Is Notion AI ISO 27001 certified?Does Notion AI train on your data?

See the full Notion AI risk profile, with every data-handling fact and its source, or browse all rated AI tools.