Is Airtable HIPAA compliant?
Yes, if you are on the Enterprise Scale plan and sign Airtable's Health Information Exhibit — but Airtable says not to use it as a patient portal, and health data must stay out of emails, record sends and anything you name.
Applies to Airtable. Last reviewed against Airtable's own documentation. Next review December 16, 2026.
Reviewed by Lisa Tran, CISSP — Healthcare Information Security Executive.
What you must do
- Be on the Enterprise Scale plan. The Health Information Exhibit is available on that plan only.
- Execute the Health Information Exhibit, which contains Airtable's business associate addendum and a California medical information addendum.
- Contact your Airtable account executive to begin. If you use Enterprise Hub, gather your org unit account IDs and share them with your account team; Airtable activates the feature internally after signing.
- Enable single sign-on, audit user access regularly in the admin panel, and either allowlist or fully disable third-party integrations.
- Do not enable Airtable AI in any workspace storing patient information unless you have accepted the supplemental AI terms for health information.
- Do not include patient information in the body or subject line of automation emails, and do not use send-record on a record containing it.
- Do not store patient information in base access requests, base descriptions, or base, table, interface and workspace names — or in support tickets and screenshots.
- If you later downgrade below Enterprise Scale, coverage ends and you must remove all patient and medical information from Airtable.
Does Airtable sign a business associate agreement?
Yes. Airtable offers one. Enterprise Scale Contact your Airtable account executive to begin the Health Information Exhibit process. They guide you through signing, then Airtable enables the feature internally.
What this means in practice
Start with the vocabulary, because it wastes people's time. Airtable no longer offers a standalone business associate agreement; the document is called the Health Information Exhibit, and it bundles the business associate addendum with a California medical information addendum. Searching for the old term produces outdated instructions. It is available on Enterprise Scale only, arranged through your account executive, and Airtable enables the feature internally after signing.
The restrictions land squarely on how people actually use Airtable. Automation emails may not carry patient information in the body or subject line, and send-record cannot be used on a record containing it, which removes the most common notification pattern teams build. Patient information also may not appear in base, table, interface or workspace names, in base descriptions or access requests, or in support tickets and screenshots. Airtable AI is out unless you have separately accepted the supplemental AI terms for health information, and Airtable advises against using the product as a patient portal.
The cliff worth diarising: downgrade below Enterprise Scale and coverage ends, with an obligation to remove all patient and medical information.
How organizations get this wrong
The specific mistakes we see with Airtable, not generic advice.
- Searching for an Airtable business associate agreement, finding nothing current, and concluding none exists rather than asking for the Health Information Exhibit.
- Building an automation that emails staff the record that changed, placing patient details in the subject line or message body.
- Using Airtable bases as a patient-facing portal for form submissions and status updates, which Airtable explicitly advises against.
- Downgrading from Enterprise Scale at renewal to cut costs, which ends coverage and requires removing all patient information from Airtable.
What the agreement does not cover
- Use of Airtable as a patient portal, which Airtable explicitly advises against.
- Automation emails containing patient information, and the send-record function when the record contains it.
- Airtable AI unless the supplemental AI terms for health information have been accepted.
- Third-party integrations. Airtable states it cannot ensure security or privacy once data leaves its boundaries.
- Any environment on a plan below Enterprise Scale, or after a downgrade.
Alternatives
Listed on merit. We take no payment for placement and use no affiliate links.
Caspio
Low-code database platform offering an agreement on mid-tier plans rather than enterprise-only
Knack
Online database builder offering an agreement without an enterprise-scale contract
Signing the agreement is step one. Proving it is step two.
Once you have the agreement with Airtable, someone has to know it exists, where the copy is, when it needs revisiting and who owns it. That register is what a client's security questionnaire is actually asking about, and it is the section of an evidence pack most organizations cannot produce on request.
$79/month, 14-day free trial, no credit card. The checker itself stays free and needs no account.
Sources
Every statement above comes from Airtable’s own published documentation, read on the date shown.
- Understanding HIPAA at Airtable — Airtable. Published July 6, 2026. Read July 29, 2026.
- Health Information Datasheet — Airtable. Published July 23, 2026. Read July 29, 2026.
Change history
- — First published.
This page is information, not certification and not legal advice. It reflects Airtable’s published documentation as read on July 29, 2026; vendors change their terms without notice, so confirm anything you rely on directly with the vendor. Whether your own use is compliant depends on your configuration, your executed agreement and how your staff actually work. No company can be “HIPAA certified” — no such designation exists.
Think something here is wrong or out of date? Tell us at support@hipaacompliancesoftware.org — corrections are published with a dated note in the change history above, never silently. See our editorial standards for how entries are researched and re-verified.