Is n8n HIPAA compliant?

No, based on the latest public statement we could find. In a January 2026 reply on the n8n community forum, n8n wrote: "Currently, n8n does not offer a Business Associate Agreement (BAA) for HIPAA compliance," and pointed to its data processing agreement instead. A DPA is not a BAA.

That means PHI should not run through n8n Cloud. Check with n8n directly before relying on this, because vendor positions change; we'll update this page when it does.

Self-hosting changes who the vendor is. When you run n8n's community or licensed edition on your own servers, n8n (the company) never receives your workflow data. Your hosting provider does, so it needs to sign a BAA (the major clouds offer one for eligible services), and the safeguards are yours to build and run. n8n's own September 2026 article on regulated industries frames self-hosting the same way: as a way to meet data-location rules and run HIPAA-relevant controls such as role-based access and audit logging.

Self-hosting does not make a workflow compliant by itself. In our experience the gaps are usually in the details below.

• Execution data. n8n stores the input and output of each run. By default it prunes finished executions older than 336 hours (14 days) and keeps at most 10,000. For PHI, set EXECUTIONS_DATA_SAVE_ON_SUCCESS=none, keep failed runs only as long as you need to debug, and shorten EXECUTIONS_DATA_MAX_AGE.
• Encryption. TLS for every connection in and out, an encrypted database volume, and a stored-safely N8N_ENCRYPTION_KEY for credentials (lose it and stored credentials can't be decrypted).
• Access. Single sign-on, individual accounts (no shared admin login), least-privilege roles, and the editor UI behind a VPN or allowlist.
• Audit trail. Log who changed which workflow and when, and stream execution events to your log system. Note that n8n lists log streaming and an external secrets vault as paid features.
• Network. Run n8n and its database in a private network; expose only the webhook endpoints that must be public, with authentication.
• Backups. Encrypted, tested restores, kept in a BAA-covered location.
• Environments. No real PHI in development or test instances.
• Every node is a data flow. Each external API a workflow calls (email, SMS, AI model, CRM) receives data. If that data is PHI, that vendor needs a BAA too.

Positions as published by each vendor or its staff, checked 20 October 2026. Ask each vendor in writing before you decide.

Many workflows now call a language model. Model providers' positions differ by product. OpenAI, for example, says organisations must sign a BAA before using the OpenAI API with PHI, and offers one for eligible API customers; that does not extend to consumer ChatGPT plans. Voice platforms vary too: Vapi lists HIPAA compliance as a paid add-on at US$2,000 a month. Check the exact product and configuration each BAA covers.

HIPAA is a US law. Clinics in the UAE fall under the UAE's health data law, which by default keeps health data in the country; see our guide to patient data rules in the UAE. In the UK, health data is special category data under UK GDPR. In both cases self-hosted n8n in an in-country region is often the simplest way to keep control of where data goes.