Key takeaways
- Zapier is not HIPAA compliant on any plan. Its own documentation says it cannot sign a Business Associate Agreement and that PHI should not be sent through the platform.
- Make offers no BAA and publishes no HIPAA program, so it is off-limits for PHI on every plan too.
- n8n changes the question: n8n Cloud offers no standard BAA, but self-hosted n8n runs on your own infrastructure, so the BAA you need is with your cloud provider, not with n8n.
- Twilio signs a BAA on its HIPAA-eligible products, including SMS and SendGrid email, but only through its sales process, never automatically with an account.
- The automation layer is where compliant stacks usually break: a covered database sending reminders through an uncovered automation tool is a violation.
Zapier is not HIPAA compliant, on any plan, and that comes straight from Zapier: its data privacy documentation states that it does not support regulated healthcare data, cannot sign Business Associate Agreements, and that PHI should not be transmitted through the platform.
That answers the question people type. It does not answer the question that matters, which is what happens to the rest of your automation stack, because Zapier is never alone in it.
I build automations for compliance-heavy service businesses every week, on exactly the tools this post covers. This is where each one stands, from the vendors’ own documentation, and what we actually do when a workflow touches patient data.
Where the automation and messaging tools stand
| Tool | Signs a BAA? | On what terms | What that means for PHI |
|---|---|---|---|
| Zapier | No | No plan, no exception; their docs say PHI is unsupported | Never route PHI through it |
| Make | No | No published HIPAA program on any plan | Never route PHI through it |
| n8n Cloud | No standard BAA | Their hosted service | Not for PHI without a written agreement |
| n8n self-hosted | Not needed from n8n | Runs on your infrastructure; the BAA is with your cloud provider | Compliant when your hosting, controls and downstream vendors are |
| Twilio (SMS, Voice) | Yes | HIPAA-eligible products, executed through sales | Usable for PHI once the BAA is signed |
| SendGrid | Yes, via Twilio | Not on standard accounts; through Twilio’s enterprise BAA process | Usable once covered; standard accounts are not |
Three of the six answers have an asterisk on them, and the asterisks are where real builds go wrong.
Why won’t Zapier and Make sign a BAA?
Signing a Business Associate Agreement makes a vendor legally liable for breaches of the health data it touches: mandatory safeguards, audit trails, breach notification, the full weight of the regulation. A general-purpose automation platform with millions of users would be taking on that liability for workflows it cannot see into. Most decline, the same way Softr and Bubble decline on the platform layer.
That is not a flaw in the products. We build on Make constantly, and it is excellent at what it does. It is a boundary: these tools are for the workflows that never touch patient data, and in a healthcare business there are plenty of those, billing reminders that carry no clinical detail, internal task routing, marketing to prospects who are not patients.
Is n8n HIPAA compliant?
n8n is the interesting answer, because it depends on which n8n. n8n Cloud, the hosted service, offers no standard BAA, which puts it in the same category as Zapier and Make for PHI.
Self-hosted n8n is a different question. The software runs on infrastructure you control, inside your own cloud account, so n8n the company never touches your data and there is nothing for them to sign. The compliance question moves down a layer: your cloud provider needs to sign a BAA (AWS, Google Cloud and Azure all do), your deployment needs real controls, encryption, access management, audit logging, and every downstream tool the workflow calls still needs its own coverage.
That distinction is the reason our HIPAA builds use self-hosted automation rather than any hosted automation platform. Not because self-hosting is fashionable, because it is the only version of the automation layer where the BAA chain closes.
What about email and SMS: SendGrid and Twilio?
Notifications are part of the same chain, and they carry their own trap.
Twilio signs BAAs for its HIPAA-eligible products, including SMS, voice, and SendGrid email. Two details matter. First, the agreement is executed through Twilio’s sales process, so a standard self-serve SendGrid account is not covered no matter what the parent company offers. Second, eligibility is per product, not per company: being covered for SMS does not cover anything else you use from them.
The safer design, and the one we default to, is to keep PHI out of notifications entirely. A message that says “you have a new document in your portal” needs no BAA gymnastics, because it contains nothing protected. The portal architecture guide covers this pattern as one of six layers that each need an answer.
Where compliant stacks actually break
Almost every violation I see in the wild has the same shape: the database was chosen carefully, and the connector was not.
A practice picks a covered records system, then wires appointment reminders through a personal Zapier account because it took twenty minutes. A home care agency stores everything in a covered database, then a coordinator sets up an automation that emails caregiver schedules, with client names, through a tool nobody vetted. The expensive, visible layer is compliant. The three-dollar layer in the middle is the breach. And the stakes of a vendor-side breach are no longer a footnote: business associates now account for most of the breach damage in the federal numbers.
This is the chain rule doing its work: every tool that stores, processes or transmits PHI needs its own agreement, and one uncovered link breaks the whole chain. The automation layer is the usual uncovered link because it is invisible, cheap, and added last, usually by whoever needed the workflow that day.
Where this bites
Not sure which of your workflows touch PHI?
Most stacks we audit have two or three automations quietly carrying patient data that nobody flagged. Mapping them takes one working session, and it is the first thing we do on any compliance-heavy build.
Book a free 30-minute stack reviewWhat we use instead, at service-business scale
For the businesses we build for, home care agencies, clinics, compliance consultancies, the working pattern is:
PHI workflows run on self-hosted automation inside a covered cloud account, or on the native automations of a covered database, which stay inside that vendor’s BAA. Airtable’s own automations, under its Enterprise agreement and its limits, are an example of the second kind.
Everything else runs on Make or Zapier, freely. Prospect follow-up, internal notifications that name no patients, invoicing that carries no clinical detail. The skill is in drawing the line correctly, which is a data-mapping exercise before it is a tooling choice.
Notifications are designed empty: they announce that something happened and link into the authenticated portal, instead of restating protected information in an email body.
A concrete way to see the split, from builds we run:
| Workflow | Touches PHI? | Where it runs |
|---|---|---|
| New patient intake routes documents to the record | Yes | Self-hosted automation, covered infrastructure |
| Caregiver credential expiring in 30 days, alert to ops | Yes (names a person’s records) | Covered database’s native automation |
| ”You have a new document” notification to a client | No (empty by design) | Covered email, or any channel, nothing protected in it |
| Prospect follow-up after a discovery call | No (not a patient) | Make, freely |
| Invoice reminder with no clinical detail | Usually no | Make or Zapier, after the data map confirms |
| Weekly internal KPI digest | No, if aggregated | Anywhere |
The rule that generates the table: the compliance question attaches to the data in the workflow, never to the tool’s logo or the industry of the business.
Frequently asked questions
Is Zapier HIPAA compliant on the Enterprise plan?
No. Zapier does not sign Business Associate Agreements on any plan, including Enterprise, and its documentation states PHI is unsupported across the platform. This is different from platforms like Airtable, where an enterprise tier does carry a health agreement.
Can I use Zapier in a healthcare business at all?
Yes, for workflows that never touch PHI: marketing to prospects, internal operations, finance. The compliance question attaches to the data in the workflow, not to the industry of the business. Map which workflows carry PHI first, then choose tools per workflow.
Does self-hosting n8n make me HIPAA compliant automatically?
No. Self-hosting moves the obligation to you: a covered cloud provider under BAA, encryption, access controls, audit logging, and covered downstream vendors. It makes compliance achievable, not automatic.
Is Make getting HIPAA support?
Make publishes no HIPAA program and offers no BAA as of this writing. If that changes, the change will appear in their legal terms; a vendor’s compliance page, not a blog post, is always the thing to verify before PHI flows.
If you are mapping which parts of your own stack need coverage, the BAA explainer covers the contract itself, the no-code platform comparison covers the database and portal layer, and the AI vendor breakdown covers the model layer. If you want a second pair of eyes on your specific stack, book a call and we will map it with you.