Is Notion HIPAA Compliant?
Notion can hold protected health information, but only in an Enterprise workspace that has accepted Notion's Business Associate Agreement and turned on the right settings. This guide covers how to accept the BAA, the limits that come with it, and the controls to configure first.
Yes, but only on the Enterprise plan with the BAA accepted
Notion signs a Business Associate Agreement for Enterprise workspaces only, at no extra charge. Workspaces on any other plan cannot sign it and should hold no PHI. Even on Enterprise, Notion may not be used to communicate with patients, and beta features are outside the BAA.
Enterprise + BAA + settings
Can store PHI for internal work
Any other plan
Keep it PHI-free
Does Notion Sign a BAA?
Yes, for Enterprise customers. Notion's HIPAA help page says that to be eligible to sign its BAA “you must subscribe to our Enterprise Plan,” and that HIPAA compliance is available free of charge on that plan. You accept the agreement inside the product:
- Open Settings in the sidebar, then Workspace settings.
- Choose HIPAA compliance, then Activate.
- Read the BAA in the window that appears and select Accept. Notion confirms on screen and by email.
Deactivating it later means the workspace can no longer hold PHI, so move the data out first. Keep the confirmation email with your other business associate agreements.
What You Still Cannot Do in Notion
The BAA comes with product limits, and they matter for how a practice uses the tool:
- No patient communication. Notion may not be used to communicate with patients, plan members, or their families or employers. Guests from outside the organization should be off or approval-only.
- No PHI in names. Workspace, organization, teamspace, and user-group names, file names, and profile fields must stay PHI-free.
- No PHI in support tickets. Requests and attachments sent to Notion support must not contain PHI.
- No beta features. Beta services are not covered by the BAA and may not process PHI.
Notion Mail and Notion Calendar
Connections and integrations
Apps already connected stay connected after you turn HIPAA on. Review each one: a connected app that reads PHI is another vendor that needs its own BAA, and admins can block new connections that are not on an allowlist.
The Settings to Change After You Accept the BAA
Notion maps its Enterprise controls to the Security Rule's technical safeguards. These are the ones a practice should turn on before any PHI goes in:
| Safeguard | Notion setting |
|---|---|
| Access control | Verify your email domain, enable SAML SSO, and set the login method to SSO only |
| Unique user IDs | Provision and remove users through SCIM from your identity provider |
| Automatic logoff | Shorten session duration (adjustable from 1 hour up to the 180-day default) |
| Audit controls | Use the Enterprise audit log; export to CSV for review |
| Sharing | Disable Share to web, disable or require approval for guests, block moving pages to other workspaces |
| Exports and extensions | Disable export if not needed and allowlist third-party extensions |
| Retention | Set custom data retention for deleted pages |
| Encryption | AES-256 at rest and TLS 1.2+ in transit are on by default |
Document these choices in your risk assessment. The BAA covers Notion's side; how your workspace is configured is your side.
What Practices Use Notion For (and What to Use Instead)
Good fits on Enterprise
Internal wikis, policies and procedures, onboarding checklists, and operational trackers are where Notion shines, and most of them need no PHI at all. Your HIPAA policy manual and training materials can live there on any plan as long as they never name a patient.
Poor fits even with a BAA
Anything that talks to patients, because the BAA terms forbid it. Use a HIPAA-compliant texting app or your patient portal instead. Clinical documentation also belongs in the EHR, which is your record of care.
On a smaller plan?
Keep Notion strictly PHI-free and store patient files in a service that signs a BAA on smaller plans; our HIPAA-compliant file sharing comparison lists them by price. The same question comes up with Slack, which also limits its BAA to its top tier.