Is Airtable HIPAA Compliant? What the BAA Covers, and Where It Stops
Whether Airtable is HIPAA compliant for your practice depends on three things: the plan you are on, a signed business associate addendum, and how your automations behave. HIPAA is offered on the Enterprise Scale plan only, and even there Airtable's own rules keep patient data out of automated emails, AI-enabled workspaces and any integration you have not vetted.
This is general information to help you ask better questions, not legal advice. Where it turns on your specific facts, it says so, and the person who should sign off is your compliance officer or healthcare counsel.
What does Airtable actually say about HIPAA?
That it is available on Enterprise Scale with a signed addendum. Airtable's HIPAA at Airtable page (opens in new window) says HIPAA is available on the Enterprise Scale plan and that customers need to sign its Business Associate Addendum. The detail lives in its Health Information Datasheet (opens in new window), which lists what you may and may not do with patient data once you are covered.
Two terms carry the rest of this page. Protected health information (PHI) is health information that identifies a patient — a name next to an appointment reason is enough; Airtable's documents call the electronic form ePHI. A business associate agreement (BAA) is the contract HIPAA requires between a healthcare organisation and any vendor that creates, receives, stores or transmits PHI on its behalf; Airtable calls its version an addendum, and the HHS guidance on business associates (opens in new window) sets out what it has to contain.
| Feature | Can it carry PHI? | The restriction |
|---|---|---|
| Records in bases and interfaces | Yes | The only place ePHI may be stored |
| Base, table, interface and workspace names | No | Names, descriptions and access requests stay free of patient detail |
| Automated emails | No | No ePHI in the body or subject line |
| Send record | No | Not to be used on a record containing ePHI |
| Airtable AI | Only with extra terms | Requires the AI Terms, including the Supplemental AI Terms for Health Information |
| Integrations | Your responsibility | You ensure each integration meets HIPAA; Airtable is not responsible once data leaves |
| Patient portal | No | Airtable says not to use it as one |
| Support tickets and calls | No | No ePHI in screenshots, tickets, calls, email or Slack with Airtable staff |
Is Enterprise Scale worth it for a small practice?
Only if Airtable is where the patient work genuinely needs to live. Enterprise Scale is Airtable's top tier, sold through its account team rather than a self-serve checkout, and the plan has to stay in place for as long as PHI sits in your bases. Ask for a written quote before you design anything around it — plan names and terms change.
The tier also brings controls a practice will actually use: enterprise audit logs that record who did what, kept for 180 days according to the datasheet, and central admin over users and workspaces. Those support the access reviews the HIPAA Security Rule expects. They do not replace your risk analysis, written policies or staff training — no subscription can sign for those.
How does the BAA signing process work?
You ask for it. Airtable's addendum is part of a Health Information Exhibit, and the datasheet says to contact a member of your account team to begin executing it. In practice that means agreeing the Enterprise Scale contract, signing the exhibit, then configuring the account before any patient record goes in.
- Confirm HIPAA applies. Covered entities and their business associates are in scope; counsel decides the edge cases.
- Contact Airtable's account team. Request Enterprise Scale and the Health Information Exhibit together.
- Decide on AI. Either accept the Supplemental AI Terms for Health Information, or keep Airtable AI disabled in every workspace that will hold PHI.
- Clean up names. Rename any base, table, interface or workspace that carries patient detail.
- Audit automations and integrations. Every email action, webhook, script and sync is listed and checked against the restrictions below.
- Then load data. PHI goes in only after the signed exhibit is back and the steps above are done.
Which Airtable automations break the rules?
The ones that carry record contents outside the base. An automated email that puts a patient name and appointment reason in the subject line breaks Airtable's own rule, because it cannot guarantee encryption if the receiving server lacks TLS. So does a webhook or script that pushes a record to a tool with no agreement of its own.
TLS (Transport Layer Security) is the encryption that protects email between servers. Airtable uses it whenever possible, but the datasheet is plain that it cannot control the other end. The fix is a neutral notification — “a new intake record needs review” with a link back into Airtable — so the clinical detail never leaves the covered environment.
Integrations follow the same logic. Airtable says customers who connect other systems are responsible for making those integrations HIPAA compliant, and that it is not responsible for data once it leaves the Airtable environment. A Zap, Make scenario or n8n workflow that reads a record needs its own BAA with that vendor, or a design that strips PHI before the record is passed on.
Why can't Airtable be a patient portal?
Because Airtable says so. Its datasheet states plainly: do not use Airtable as a patient portal at this time. Patients logging in to view or submit their own records is a use case Airtable has excluded, so a shared interface or form built for patients is out of bounds even on Enterprise Scale with a signed addendum.
Airtable can still sit behind the scenes — staff working a referral queue or an intake checklist — while patients use a purpose-built portal from a vendor that signs a BAA for that role. Treat a patient portal as a separate system and integrate deliberately.
What are the alternatives if Enterprise Scale is not justified?
Keep PHI out of Airtable. Many practices use Airtable for operations that never need patient identity — supply tracking, marketing pipelines, staff scheduling, vendor lists — and leave clinical records in the EHR (electronic health record) system they already have a BAA with. A record number can link the two without carrying a name or diagnosis.
| Approach | What goes in Airtable | The trade-off |
|---|---|---|
| Operations only | Non-clinical work with no patient identifiers | Staff must keep PHI out, enforced by field design and training |
| De-identified tracking | Record numbers that point back to the EHR | The lookup table stays in the covered system, never in Airtable |
| Covered system as the hub | Nothing clinical; automation runs from the EHR or a tool with a BAA | Fewer building blocks than Airtable offers |
| Enterprise Scale with the addendum | PHI in records, within the datasheet's restrictions | Top-tier plan, kept for as long as PHI is stored |
Does HIPAA even apply to your organisation?
HIPAA applies to covered entities and their business associates. Covered entities are health plans, clearinghouses, and providers that transmit health information electronically in standard transactions, such as insurance claims. A practice billing insurance almost certainly qualifies; a cash-only wellness business may not. That is a question for counsel.
HHS publishes a guide to who counts as a covered entity (opens in new window), and it is worth reading before you upgrade anything. Airtable's datasheet also names California's CMIA (Confidentiality of Medical Information Act), a reminder that state medical-privacy laws can apply even where HIPAA does not.
What we build, and what we do not claim
There is no government HIPAA certification for software or consultants, and we hold none. What we do is map the data flow before anything connects, keep patient information out of tools that have no agreement, design bases and automations that carry the minimum, and hand over documentation your compliance officer can review. They decide what is acceptable; we build to that decision.
Where to go next
If you already run Airtable and need bases, automations and integrations built around a clear data boundary, the Airtable automation consultant page covers that work. If a Zap or Make scenario reads from your bases, read whether Zapier is HIPAA compliant and whether Make.com is HIPAA compliant before patient data flows through either. The same agreement-stops-at-the-edge pattern runs through the guide to monday.com and HIPAA, the guide to HubSpot and HIPAA and the guide to GoHighLevel and HIPAA. For the clinical side of automation, see AI automation for healthcare practices.
Common questions about Airtable and patient data
Can we store patient data on a plan below Enterprise Scale?
No. Airtable's health information datasheet says customers subject to HIPAA who intend to store ePHI must be on the Enterprise Scale plan and sign its Business Associate Addendum. On any other plan there is no agreement in place, so patient information should not go into a base.
How do we get Airtable's BAA signed?
Through your Airtable account team. The addendum is part of Airtable's Health Information Exhibit, and the datasheet says to contact a member of your account team to begin executing it. Keep PHI out of every base until the signed exhibit is back and your restrictions are in place.
Can an Airtable automation email a patient's details?
Not in the email itself. Airtable's datasheet says not to include ePHI in the body or subject line of an automated email, because it cannot guarantee encryption if the receiving server lacks TLS. Send a neutral notice that points staff back to the record inside Airtable instead.
Does signing the BAA let us use Airtable AI on patient records?
Not on its own. Airtable says AI is available to customers with an executed health information agreement who have also accepted its AI Terms, including the Supplemental AI Terms for Health Information. Until both are in place, keep PHI out of any workspace where Airtable AI is enabled.
Does Lightray AI hold a HIPAA certification?
No, and there is no government HIPAA certification for software or consultants to hold. What we offer is a documented data flow, workflows that keep patient information out of tools without an agreement, and a build your compliance officer can review before anything goes live.
Free consultation
Tell us what is costing you the most time
Describe the process. You get a straight read on whether it is worth automating, roughly what it would take, and what we would tackle first — on a call that costs nothing.
- Under an hour, free, and no obligation
- Fixed price per stage, agreed before any work starts
- You own everything we build, documented and in your accounts
- If you do not need us, we will say so on that call
The form is the fastest way to reach us — we reply from a real person, usually within one business day.