Last verified: October 2026, against Airtable's HIPAA page and health-information AI terms. General information, not legal advice — confirm with your compliance officer or attorney.
Is Airtable HIPAA compliant? Airtable offers HIPAA support only on its Enterprise Scale plan, with a signed Business Associate Addendum. Every other plan should hold no patient information. Practices tend to reach for Airtable because it feels like a spreadsheet with superpowers, and that's exactly how a "referral tracker" or "no-show list" ends up holding protected health information (PHI) on a plan that can't cover it.
Practices ask this regularly: "is airtable hipaa compliant" is searched about 110 times a month in the US, with an average cost per click of $10.11 (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
Short answer from Airtable's own documentation
Short answer (verified October 2026): Airtable's HIPAA page (opens in a new tab) says: "HIPAA is available on our Enterprise Scale Plan and customers will need to sign Airtable's Business Associate Addendum." It lists Enterprise Key Management, data loss prevention through DLP provider APIs, Enterprise single sign-on and Enterprise audit logs as supporting features. Using Airtable AI with HIPAA-enabled services adds conditions in Airtable's health-information AI terms (opens in a new tab).
What HIPAA requires before patient information goes in
Before a vendor creates, receives, maintains or transmits PHI for your practice, HIPAA requires a written contract with it (45 CFR 164.502(e) (opens in a new tab)). That contract, the business associate agreement (Airtable calls its version an addendum), must "establish the permitted and required uses and disclosures" of PHI and require the vendor to report unauthorized uses (45 CFR 164.504(e) (opens in a new tab)). A base that stores patient names and visit details is "maintaining" PHI.
The addendum is necessary, not sufficient. Who can see each base, what gets shared or exported, and which features touch the data are your responsibility. Background on these contracts is in business associate agreements.
Which Airtable plans a BAA can cover
| Airtable plan | HIPAA available? |
|---|---|
| Enterprise Scale | Yes, with the Business Associate Addendum signed |
| Any other plan, including free | No |
Airtable's page doesn't say which features the addendum covers. Ask in writing about the ones practices use most: forms, interfaces, shared view links, automations that send email, sync between bases, extensions and the mobile app.
Airtable AI with health information
Airtable's Supplemental AI Terms for Health Information (opens in a new tab) (last updated July 23, 2026) set rules by AI provider. Features powered by Anthropic "may only be used for charting, billing, coding, claims processing, or clinical research" and "must not be used for patient-provider interactions, patient diagnosis, or treatment purposes." For OpenAI-powered features, you must "ensure that only qualified, licensed professionals are permitted to use the Output." Across both, outputs must be disclosed as AI-generated, and "You shall not use the Services or Outputs as a medical device."
Patient trackers in spreadsheet-databases
Airtable makes it easy to build a database in an afternoon, often without anyone deciding it will hold patient data. Common examples at practices:
- A referral log with patient names, referring doctors and reasons.
- A no-show or waitlist tracker.
- A before-and-after photo library for marketing.
- A "leads" base fed by a website form that asks about symptoms.
Each one is PHI. Each can also spread it further: a shared view link sent to a contractor, an automation that emails a row, a synced copy in another base. On any plan below Enterprise Scale, there's no BAA behind any of it.
Safe uses and unsafe uses for a practice
| Safe on any plan (no patient data) | Needs Enterprise Scale and the addendum |
|---|---|
| Content and social calendars | Referral logs and patient follow-ups |
| Campaign and ad budget trackers | Waitlists and no-show lists |
| Equipment and supply inventory | Form submissions with health questions |
| Hiring pipeline and vendor lists | Patient photos or testimonials with names |
Safer setup or alternatives
- Name your no-PHI bases. List the bases that may never hold patient data and say so in your staff policy.
- Audit what exists. Open each base and look for names alongside dates, services or notes. Move anything with PHI out, then delete it.
- Use the right home for patient work: your EHR or practice-management system, or a patient crm whose vendor signs a BAA.
- If you need Airtable for PHI, move to Enterprise Scale, sign the addendum, get feature coverage in writing and lock down sharing.
- Compare similar tools. notion restricts its BAA to Enterprise too.
Medfy doesn't sell or integrate with Airtable. For its own services, Medfy signs a BAA with each practice, and patient information from website forms and chat is stored in separate, encrypted HIPAA databases in the US or Canada. See how Medfy handles patient data, request a free marketing audit, or check more tools in HIPAA and marketing software.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
Will Airtable sign a BAA?
Yes, on the Enterprise Scale plan. Airtable's HIPAA page says HIPAA is available on that plan and customers need to sign Airtable's Business Associate Addendum. Airtable AI used with HIPAA-enabled services carries extra conditions in separate health-information terms. Lower plans aren't covered. Ask Airtable which features the addendum covers, and have your compliance officer or attorney review it before adding patient data.
Is the free version of Airtable HIPAA compliant?
No. Airtable makes HIPAA available only on its Enterprise Scale plan, with a signed Business Associate Addendum, so a free base can't hold patient information. Free and lower-tier bases still work well for marketing calendars, content plans and vendor lists with no patient details. Write that limit into your staff policy and confirm it with your compliance officer.
Can a practice use Airtable without patient information?
Yes. Content calendars, campaign trackers, equipment inventories and hiring pipelines don't involve PHI, so no BAA is needed. The danger is a base that slowly becomes a patient tracker, such as a referral log or a no-show list. Name the bases that may never hold patient data, review them quarterly, and confirm the policy with your compliance officer.
What is a HIPAA-compliant alternative to Airtable?
For patient lists and follow-ups, use your EHR or practice-management system, or a patient CRM whose vendor signs a BAA for your plan. Airtable Enterprise Scale with the addendum signed is also an option if your team needs its flexibility. Whichever you pick, check the vendor's BAA for the exact features you'll use and have your compliance officer or attorney review it.