Is Notion HIPAA Compliant? The Enterprise-Only BAA, Notion AI, and What a Practice Pays (2026)

TL;DR: Yes, but only on Notion Enterprise. As of November 2026, Notion signs a HIPAA Business Associate Agreement (BAA) only for Enterprise workspaces, and the BAA itself is free: a workspace owner switches it on in settings. The catch for a small practice is price. Enterprise has no published per-seat price, and Business, at $20 a seat, gets no BAA at all. Beta features and anything that communicates with patients are excluded even on Enterprise.

Practices love Notion for SOPs, onboarding docs and the front desk wiki. The question I hear is whether it can also hold the stuff with patient names in it. Here's what Notion's own pages say, read on November 8, 2026.

Is Notion HIPAA compliant? What "yes" means

Same rule as every post in this series: software isn't HIPAA compliant by itself. A vendor is safe for protected health information (PHI) when it signs a BAA, a contract about how it protects that data, and you set the tool up the way the BAA expects. The full idea is in my guide to HIPAA compliant AI.

Notion's HIPAA guide is direct: "To be eligible to sign Notion's BAA, you must subscribe to our Enterprise Plan." The BAA covers PHI "stored in the Notion Service." And: "HIPAA compliance is available free of charge to customers on the Enterprise plan." No add-on fee, no separate form. An owner goes to Settings, Workspace settings, HIPAA compliance, Activate, reads the BAA and clicks Accept. Notion emails a confirmation.

Notion plans vs HIPAA, and what it costs

Prices from notion.com/pricing on November 8, 2026 (Notion offers up to 20% off for yearly billing). So the per-seat price of the cheapest plan that gets a BAA is simply not public. Notion doesn't list a seat minimum either. For a 5 to 20 person practice, that means a sales call and a written quote before you can compare Notion to anything. Don't assume it's Business plus a little.

The trap is Business. It has SAML single sign-on, Notion AI and AI meeting notes, so it looks like the grown-up plan. It still can't get a BAA.

What Notion AI does with PHI

Notion AI searches your pages and sends the relevant ones, with your question, to outside AI models to write an answer. Notion's AI security page says what happens next:

• No training. By default neither Notion nor its AI providers train models on your data, and that's in Notion's contracts with every provider.
• Enterprise: zero data retention on most models. The provider processes the request and keeps nothing. A small number of models do retain data for a limited time. Those are off by default and the workspace owner has to opt in. For a HIPAA workspace, don't.
• Free, Plus and Business: up to 30 days. The AI provider keeps your data for 30 days or fewer. With no BAA on those plans, a patient note pasted into Notion AI is a problem twice.
• External agents play by different rules. Notion says different controls apply to them, so check before connecting one to a HIPAA workspace.

Notion's own phrasing is careful: "For workspaces with zero data retention in effect, our providers' zero-retention APIs support HIPAA-compliant workflows." Its HIPAA guide doesn't mention Notion AI by name. If you plan to run AI over patient pages, ask your Notion rep to confirm in writing which AI features the BAA covers. If you're still deciding between Notion AI and a separate assistant, I compared them in Notion AI vs Claude for business; Claude's own BAA rules are in is Claude HIPAA compliant.

What the BAA excludes, even on Enterprise

• Beta features. "Any Beta Services are not covered by the BAA." On the pricing page I read, Enterprise Search and Workers carried a Beta label. Check for the label before using any new feature with PHI.
• Talking to patients. "Notion may not be used to communicate with patients, plan members, or their families or employers." No patient portals, no shared pages with patients, and I'd skip patient intake forms too.
• PHI in names. Not in workspace, teamspace, file or user group names, and not in user profiles. "Jane Doe follow-up.pdf" breaks the rule.
• Support tickets. No PHI in a support request or its attachments.
• Notion Mail and Notion Calendar. Notion says to enable HIPAA compliance through Google Workspace for those. My read on that side is in is Google Workspace HIPAA compliant.

The settings checklist for a practice

All of these come from Notion's HIPAA configuration guide. Most are Enterprise-only, which is another reason Business can't do this job.

1. Activate HIPAA compliance and accept the BAA (Settings, Workspace settings, HIPAA compliance).
2. Verify your email domain, turn on SAML SSO, and set the login method to Only SAML SSO.
3. Set the session duration. The default is 180 days; Notion lets you go as short as 1 hour.
4. Disable Share to web, so no page can go public.
5. Disable guests, or turn on guest requests so an admin approves each one.
6. Disable export, and moving or duplicating pages to other workspaces.
7. Allowlist extensions and connections, and review the ones already turned on. Notion leaves existing connections enabled when you activate HIPAA.
8. Disable external workspace access and new workspace creation.
9. Keep non-zero-retention AI models off.
10. Check the audit log monthly, and export it for your records.

If Enterprise isn't in the budget

Keep Notion for what it's good at in a practice: SOPs, training docs, vendor lists, the staff wiki. Write a one-line rule that no patient identifiers go in it, and keep patient information in your EHR, which already has a BAA with you. That split covers most small practices without a sales call.

This is a technology explainer, not legal advice; take the exclusions list to your compliance lead. If you want help deciding which tools hold PHI and which don't, and setting up the ones that do, see how I work with healthcare practices.

Sources

• Notion Help, HIPAA configuration: Enterprise-only BAA, free on Enterprise, activation steps, exclusions, configuration guide. Read November 8, 2026.
• Notion Help, Notion AI security practices: no training, zero data retention on Enterprise, 30-day retention on Free, Plus and Business, opt-in non-ZDR models. Read November 8, 2026.
• Notion pricing: Free, Plus $10, Business $20 per member/month, Enterprise custom; Enterprise zero data retention; Beta labels. Read November 8, 2026.