Is Airtable HIPAA compliant?
Yes, if you are on the Enterprise Scale plan and sign Airtable's Health Information Exhibit, but Airtable says not to use it as a patient portal, and health data must stay out of emails, record sends and anything you name.
Applies to Airtable. Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
What you must do
- Be on the Enterprise Scale plan. The Health Information Exhibit is available on that plan only.
- Execute the Health Information Exhibit, which contains Airtable's business associate addendum and a California medical information addendum.
- Contact your Airtable account executive to begin. If you use Enterprise Hub, gather your org unit account IDs and share them with your account team; Airtable activates the feature internally after signing.
- Enable single sign-on, audit user access regularly in the admin panel, and either allowlist or fully disable third-party integrations.
- Do not enable Airtable AI in any workspace storing patient information unless you have accepted the supplemental AI terms for health information.
- Do not include patient information in the body or subject line of automation emails, and do not use send-record on a record containing it.
- Do not store patient information in base access requests, base descriptions, or base, table, interface and workspace names, or in support tickets and screenshots.
- If you later downgrade below Enterprise Scale, coverage ends and you must remove all patient and medical information from Airtable.
Does Airtable sign a business associate agreement?
Yes. Airtable offers one. Enterprise Scale Contact your Airtable account executive to begin the Health Information Exhibit process. They guide you through signing, then Airtable enables the feature internally.
What this means in practice
Start with the vocabulary, because it wastes people's time. Airtable no longer offers a standalone business associate agreement; the document is called the Health Information Exhibit, and it bundles the business associate addendum with a California medical information addendum. Searching for the old term produces outdated instructions. It is available on Enterprise Scale only, arranged through your account executive, and Airtable enables the feature internally after signing.
The restrictions land squarely on how people actually use Airtable. Automation emails may not carry patient information in the body or subject line, and send-record cannot be used on a record containing it, which removes the most common notification pattern teams build. Patient information also may not appear in base, table, interface or workspace names, in base descriptions or access requests, or in support tickets and screenshots. Airtable AI is out unless you have separately accepted the supplemental AI terms for health information, and Airtable advises against using the product as a patient portal.
The cliff worth diarising: downgrade below Enterprise Scale and coverage ends, with an obligation to remove all patient and medical information.
How organizations get this wrong
- Searching for an Airtable business associate agreement, finding nothing current, and concluding none exists rather than asking for the Health Information Exhibit.
- Building an automation that emails staff the record that changed, placing patient details in the subject line or message body.
- Using Airtable bases as a patient-facing portal for form submissions and status updates, which Airtable explicitly advises against.
- Downgrading from Enterprise Scale at renewal to cut costs, which ends coverage and requires removing all patient information from Airtable.
What the agreement does not cover
- Use of Airtable as a patient portal, which Airtable explicitly advises against.
- Automation emails containing patient information, and the send-record function when the record contains it.
- Airtable AI unless the supplemental AI terms for health information have been accepted.
- Third-party integrations. Airtable states it cannot ensure security or privacy once data leaves its boundaries.
- Any environment on a plan below Enterprise Scale, or after a downgrade.
Alternatives
Caspio
Low-code database platform offering an agreement on mid-tier plans rather than enterprise-only
Knack
Online database builder offering an agreement without an enterprise-scale contract
Keep a record of your Airtable agreement
Sources
- Understanding HIPAA at Airtable: Airtable. Published July 6, 2026. Read July 29, 2026.
- Health Information Datasheet: Airtable. Published July 23, 2026. Read July 29, 2026.
Airtable can change these terms at any time. If something here no longer matches what Airtable tells you, tell us.