Is Notion HIPAA Compliant for Therapists?
Quick Answer
No, unless you are on Notion's Enterprise plan. Notion's own help center states you must subscribe to the Enterprise plan to be eligible for a Business Associate Agreement — Free, Plus, and Business plans do not qualify. Even on Enterprise, Notion AI and other beta features are explicitly excluded from BAA coverage, so client PHI cannot appear in workspace names, pages, or AI prompts under any plan.
Written & fact-checked by the Therapy HIPAA Hub editorial team — see our editorial standards.
Verified August 2026 against Notion's official HIPAA help page
BAA Available?
Yes
On Which Plan
Enterprise plan only — AI features excluded even then
Because most therapists use Notion's Free, Plus, or Business plan for personal organization, treat any Notion workspace as off-limits for client names, session content, or diagnoses by default — including in page titles and file names, which are easy to overlook as 'just organizational' but still count as PHI if they identify a client.
What to Use Instead for Client Work
For clinical documentation that actually needs to hold PHI, SimplePractice's note-taking is covered under its BAA on every paid plan — Notion can still be useful for the non-clinical side of running a practice (marketing calendar, blog drafts, general to-dos) where no client data is involved.
Affiliate link — we may earn a commission at no extra cost to you.
The Enterprise-Only Gate
Notion is explicit that only its Enterprise plan is eligible for a Business Associate Agreement — a tier aimed at larger organizations, both in price and minimum commitment. Free, Plus, and Business, the plans most solo and small-practice therapists actually use, are excluded outright, with no partial compliance option.
Notion AI Is Excluded Even on Enterprise
Signing Notion's BAA on Enterprise does not clear Notion AI or other beta features for PHI use — Notion's own documentation carves these out separately. This matters because AI-assisted note summarization is exactly the kind of feature a therapist might reach for, and it remains off-limits for client data regardless of your plan.
Trusted by 225,000+ Therapists
50% Off Your First 4 Months of SimplePractice
SimplePractice is the #1 HIPAA-compliant practice management platform for therapists. Includes a signed BAA, encrypted messaging, telehealth, and full insurance billing.
Limited-time summer offer · No credit card required for trial
Need HIPAA-compliant email only? See Hushmail for Healthcare →
FAQ — Notion and HIPAA
Can I use Notion's free plan to store client session notes?
No. Notion's Free plan is not eligible for a Business Associate Agreement, so it should never hold PHI — including client names, diagnoses, or session content, even in page titles.
Does Notion AI work with a BAA on the Enterprise plan?
No. Notion explicitly excludes AI and beta features from BAA coverage, even for Enterprise customers. Avoid using Notion AI on any content that touches client PHI, regardless of plan.
Is Notion safe for non-clinical practice organization?
Yes — a marketing calendar, blog outline, or general task list with no client-identifying information is fine on any Notion plan. The compliance issue is specifically about client PHI, not the tool itself.