Is Make.com HIPAA compliant? What a practice can still automate with it
No. Make does not sign the agreement HIPAA requires of any vendor that handles patient information, so that information must not pass through a Make scenario. That does not rule Make out of a healthcare practice altogether: plenty of a clinic's admin never touches a patient, and Make handles that as well as it does anywhere else. The work is in drawing the line correctly.
This is general information to help you ask better questions, not legal advice. Where it turns on your specific facts, it says so, and the person who should sign off is your compliance officer or healthcare counsel.
What is a BAA, and why does it decide the question?
Two terms carry the rest of this page. Protected health information (PHI) is health information that identifies a patient — a name next to an appointment reason is enough. A business associate agreement (BAA) is the contract HIPAA requires between a healthcare organisation and any vendor that creates, receives, stores or transmits PHI on its behalf; the HHS guidance on business associates (opens in new window) sets out what it has to contain.
The agreement is what makes a vendor accountable for safeguarding PHI, reporting breaches and limiting how the data is used. Encryption, security certifications and a careful team on the clinic side are all worthwhile, but none of them stands in for the contract. No BAA means no PHI, whatever else the vendor offers.
What has Make said about HIPAA?
That it does not offer a BAA. The question comes up regularly in Make's community forum, and the replies over several years of threads have been consistent: Make does not sign business associate agreements, and healthcare users are pointed away from sending patient data through it. We have not seen that position change, and nothing on a pricing or feature page reverses it.
If you are evaluating Make for a healthcare team, ask the vendor directly and keep the reply. A written “no” settles the design question; a written “yes” would only count if it arrives as a signed agreement naming the product and plan you use.
Why can't patient data pass through a scenario?
Because Make does more than relay data. Every run reads data from one app, processes it on Make's infrastructure and sends it to another, and a scenario's execution history keeps a record of what each module handled. Data stores and stored incomplete executions can hold copies too. That makes Make a vendor receiving, storing and transmitting PHI, which is exactly what HIPAA requires a signed agreement for.
This holds even when both ends are covered. If your EHR and your messaging tool each sit under their own BAA, a Make scenario between them is still a third vendor in the data path, and neither agreement reaches it. The decision in front of you is therefore about design — keeping PHI out of every scenario — rather than about settings.
Which healthcare automations can stay in Make?
The ones that never see a patient. Staff scheduling, accounts payable, inventory, content publishing and internal alerts are ordinary business admin, and Make's visual builder suits them well. The test is the data in each scenario, not the kind of business running it. The table below sorts the common cases.
| Automation | Touches PHI? | Run it in Make? | What to use instead |
|---|---|---|---|
| Staff shift changes posted to a team chat | No | Yes | Nothing needed |
| Supplier invoices filed into accounting | No | Yes | Nothing needed |
| Blog posts or announcements pushed to social channels | No | Yes | Nothing needed |
| Newsletter sign-ups from a website opt-in form | Not if the list is built from the form, not from patient records | Yes, with that boundary kept | Never segment the list by patient status or treatment |
| Job applications routed to a hiring tracker | No, if the form collects nothing drawn from patient records | Yes | Nothing needed |
| Website enquiry form into a CRM | Depends on what the form asks | Only if it collects nothing about health or treatment | A form and CRM covered by BAAs if clinical detail is needed |
| Appointment reminder with the patient's name and time | Likely yes | No | The scheduling system's built-in reminders, under that vendor's BAA |
| Intake form answers copied to a spreadsheet or EHR | Yes | No | A direct integration, or a form tool and destination both under BAA |
| Lab results or referral letters routed to a clinician | Yes | No | The EHR's own routing, or self-hosted automation under BAA-covered hosting |
The reminder row surprises people. A text that says only “your appointment is Tuesday at 10” carries no clinical detail, but the scenario that sends it still receives a patient's name and phone number from a healthcare practice, which can be enough to identify them as your patient. That is why reminders belong in a system already under an agreement, not in a scenario in between.
What should you use when PHI is involved?
Four routes, and most practices use more than one. What they share is that every system PHI reaches is either under a signed agreement or under your own control, and that the arrangement is written down before anything connects.
- Native features of systems already under a BAA. Your EHR, practice-management or scheduling vendor may already send reminders, recalls and review requests, or offer a direct integration with the other system. That is the shortest path, because it adds no new vendor.
- A HIPAA-focused platform whose vendor will sign a BAA. Some automation and integration vendors do, often only on particular plans or products. Get the agreement in writing, naming the specific product and plan you use, before any PHI goes in — do not rely on a marketing page, including any comparison of ours.
- Self-hosted n8n on BAA-capable hosting. Running n8n on your own server takes the automation vendor out of the data path, and n8n's visual workflow builder is the closest like-for-like move from Make — our page on migrating from Make.com to n8n explains how scenarios are rebuilt. The hosting provider still needs to sign a BAA, and access control, logging and patching become your job; our n8n Cloud vs self-hosted comparison covers that trade-off in detail.
- A redesign so PHI never leaves. Sometimes the automation only needs to know that something happened, not who it happened to. Be careful here: HHS's de-identification guidance (opens in new window) treats record numbers and other unique codes as identifiers, so whether a given field is safe to pass is a question for your compliance officer, not an assumption.
If an existing scenario turns out to have been carrying PHI, turn it off but do not delete it. Whether past runs need assessing as a potential breach is a question for your compliance officer, and the scenario, its execution history and your notes are the evidence they will need.
What we build, and what we do not claim
There is no government HIPAA certification for software or consultants, and we hold none. What we do is map the data flow in every existing scenario, separate the automations that can stay in Make from the ones that cannot, rebuild the latter on systems covered by an agreement or under your control, and hand over documentation your compliance officer can review. They decide what is acceptable; we build to that decision.
Where to go next
If your non-PHI scenarios need building, tidying or fixing, the Make.com automation consultant page covers that work. If you are weighing the alternatives, the guide to Zapier and HIPAA reaches the same verdict for the other big no-code platform, and the guide to GoHighLevel and HIPAA explains why a platform's agreement stops at its own edge — including any scenario connected to it.
Common questions about Make.com and patient data
Will Make.com sign a business associate agreement?
No. Make does not offer a business associate agreement, and replies in its community forum have said so across several years of threads. Without that agreement, protected health information should not pass through any scenario: not the trigger, not a router or filter, and not the module that sends it on.
Does a higher Make plan or an enterprise contract change the answer?
Not unless Make puts a signed business associate agreement in front of you, naming the product you use. Larger plans add features, support and security controls, but none of those is a substitute for the contract. If a sales conversation suggests otherwise, get the agreement itself in writing before any patient data goes in.
Can a healthcare practice still use Make.com?
Yes, for work that never touches patient information: staff scheduling, supplier invoices, internal alerts, content publishing, and marketing lists built from opt-in forms rather than patient records. The test is the data in each scenario, not the kind of business running it. Anything identifying a patient belongs elsewhere.
Does our EHR's BAA cover a Make scenario connected to it?
No. A business associate agreement binds only the vendor that signs it. The moment a scenario pulls patient data out of a covered system, that data is on Make's side of the line, and no agreement you hold with the source system reaches it.
Is self-hosted n8n automatically HIPAA compliant?
No. Self-hosting takes the automation vendor out of the data path, but the server, the hosting provider and every connected service still need to be covered, and access control, logging and policies remain yours. It is a way to build a compliant flow, not a substitute for one.
Does Lightray AI hold a HIPAA certification?
No, and there is no government HIPAA certification for software or consultants to hold. What we offer is a documented data flow, workflows that keep patient information out of tools without an agreement, and a build your compliance officer can review before anything goes live.
Free consultation
Tell us what is costing you the most time
Describe the process. You get a straight read on whether it is worth automating, roughly what it would take, and what we would tackle first — on a call that costs nothing.
- Under an hour, free, and no obligation
- Fixed price per stage, agreed before any work starts
- You own everything we build, documented and in your accounts
- If you do not need us, we will say so on that call
The form is the fastest way to reach us — we reply from a real person, usually within one business day.