Bottom line: n8n Cloud does not offer a Business Associate Agreement (BAA) and isn’t HIPAA compliant out of the box — n8n’s own support team confirms this directly. But n8n is open-source and self-hostable, which puts it in a different category than a closed SaaS tool like Zapier: self-hosted on your own BAA-covered infrastructure, with the right configuration, it can be part of a compliant setup. Self-hosting alone doesn’t get you there, though — n8n says as much in its own documentation.
- n8n Cloud does not sign a BAA. n8n’s own support team has confirmed this repeatedly on its community forum, most recently in response to a user asking about medical-niche clients: “Currently, n8n does not offer a Business Associate Agreement (BAA) for HIPAA compliance.”
- n8n aligns its security program to SOC 2 (SOC 2 report available to enterprise customers, SOC 3 publicly available) and hosts cloud data on Microsoft Azure in the EU with encryption at rest and in transit — solid general security, but SOC 2 and HIPAA are not the same thing, and neither is a substitute for a signed BAA.
- Unlike Zapier, n8n is open-source and can be self-hosted on your own infrastructure. That changes the compliance conversation: if you run n8n yourself on infrastructure that is already BAA-covered (your own HIPAA-compliant hosting), n8n stops being a separate business associate you’d need a BAA with in the first place, because it’s your environment, not n8n’s.
- Self-hosting is not automatically compliant, though. n8n’s own security documentation is explicit that for self-hosted instances, “encrypting other data at rest is the responsibility of the user” — the platform doesn’t do this for you the way it does on n8n Cloud.
- The same rule that applies to Zapier, Twilio, or any other automation “pipe” applies to n8n workflows too: every third-party service a workflow touches — email, SMS, EHR, database — needs its own BAA coverage, regardless of whether n8n itself is self-hosted or cloud-hosted.
- n8n shows up in vibe-coded and low-code healthcare apps for the same reason Zapier does — connecting a form, a database, or an AI tool to email/SMS/EHR systems — so it’s easy for it to end up carrying PHI without anyone deciding that deliberately.
Ready to find out if your n8n setup is actually HIPAA compliant?
Book a Free 15-Minute Consultation →
n8n Cloud vs. Self-Hosted n8n: Compliance at a Glance
| n8n Cloud | Self-Hosted n8n | |
|---|---|---|
| HIPAA compliant out of the box | No — depends entirely on setup | |
| Signs a BAA (with n8n directly) | Not applicable — n8n isn't a party to the data flow | |
| Can be part of a HIPAA-compliant architecture | Yes, if hosted on your own BAA-covered infrastructure | |
| SOC 2 aligned | N/A (your infrastructure's responsibility) | |
| Encryption at rest | Yes (Azure-managed) | Your responsibility to configure |
| Encryption in transit | Your responsibility to configure (e.g., TLS reverse proxy) | |
| Who's liable if something goes wrong | n8n, for its own cloud infrastructure | You — it's your servers, your configuration, your BAA with your host |
Why Doesn’t Self-Hosting Automatically Solve This?
This is the part that trips people up. Self-hosted open-source software feels like it should sidestep the whole BAA question — there’s no vendor “in the middle” processing your data, so what’s left to be non-compliant?
The answer is that HIPAA compliance was never just about who’s in the middle. It’s about whether the infrastructure the software runs on, and the way the software itself is configured, meet HIPAA’s technical and administrative safeguards. Self-hosting n8n on a laptop, a personal VPS, or a cloud account with no BAA in place doesn’t make it compliant — it just removes n8n itself from the list of parties you’d need a BAA with. You still need:
- A hosting environment that will sign a BAA with you (AWS, Google Cloud, Azure, or a HIPAA-focused host all offer this at the account level, but it isn’t automatic — it requires actively executing that agreement).
- Encryption at rest and in transit configured correctly, since n8n’s own documentation states this is the self-hoster’s responsibility, not something the platform handles by default.
- Access controls, audit logging, and the same secrets-management discipline any other self-hosted application needs.
In other words, self-hosting turns n8n from “a SaaS vendor that needs its own BAA” into “a piece of software running inside infrastructure you’re responsible for securing.” That’s a meaningful shift — but it moves the compliance work onto you, it doesn’t remove it.
Is n8n Cloud HIPAA Compliant on Any Plan?
No. As of this writing, n8n’s own community support team has stated this plainly and consistently — including a 2021 response (“we cannot offer BAA’s for n8n.cloud instances, nor formal HIPAA compliance”) and a more recent 2025 response to a user with medical-niche clients confirming the same position. There’s no Enterprise tier, add-on, or plan upgrade on n8n Cloud that adds BAA coverage the way some AI coding tools offer a specific HIPAA-eligible configuration. If patient data needs to flow through n8n, the workflow needs to run on a self-hosted instance inside your own BAA-covered environment — not on n8n Cloud.
Your AI Prototype Works. Is It Ready for Healthcare?
HIPAA Vault reviews your architecture, addresses compliance gaps, and deploys your application into secure, managed infrastructure.
Book a Free 15-Minute ConsultationWhere This Actually Shows Up
n8n gets adopted for the same reason Zapier does — it’s a fast way to connect a form, a database, an EHR, or an AI tool to whatever needs to happen next (an email, an SMS reminder, a CRM update). The difference is that n8n’s flexibility and self-hosting option make it more likely to show up as the backend automation layer behind a custom or AI-built healthcare app, not just a marketing-stack add-on.
That’s exactly the kind of connection HIPAA Vault’s own AI-to-HIPAA Migration Checklist calls out under “Third-Party Routing”:
Mapped every place patient contact info, appointment data, or symptoms flow to a third party. Confirmed each service is on a BAA-covered tier — not the free/consumer default AI tools suggest. Confirmed TLS encryption in transit for all of these integrations.
If an n8n workflow is the thing routing a patient intake form to a database and an appointment confirmation to email or SMS, every one of those downstream services needs its own BAA — whether n8n itself is self-hosted compliantly or not.
What Josh Vidals Says
In a live session on vibe coding and HIPAA, Josh Vidals, Cloud Engineer at HIPAA Vault, described how AI-generated code tends to reach for whatever automation tool is easiest, without anyone checking whether it’s covered:
“When the AI is writing the code on your behalf, a lot of times it’ll use whatever is the most common tool. For example, if you’re going to be sending PHI from your application… the AI will code it and it will work. You could test it… sure enough, you get the email. So you’re happy. What you don’t realize is that AI just used whatever common email platform or function they could find. But that particular email relay doesn’t have a BAA signed… under the hood, AI could be using these — let’s just call them pipes — different pipes to do different work. And if those pipes don’t have a BAA and they’re not protected, you’re just relying on whatever choice AI decided to use on your behalf to send information out of the platform into the world.”
An automation platform like n8n is a more deliberate, visible version of exactly that “pipe” — which makes it easier to audit, but only if someone actually does.
Common Misconceptions Worth Correcting
“It’s open source, so there’s no vendor risk.” Open source removes n8n as a business associate you’d need a BAA with, but it doesn’t remove the compliance work. You still need a BAA-covered host, correct encryption configuration, and access controls — n8n’s own documentation says as much for self-hosted instances.
“We’re SOC 2, so we’re basically HIPAA compliant.” SOC 2 and HIPAA overlap in places (access controls, monitoring, incident response) but they’re different frameworks with different legal requirements. SOC 2 alignment is a good sign of general security maturity; it isn’t a HIPAA certification and doesn’t replace a BAA.
“n8n Cloud is easier, we’ll just keep PHI out of it.” That works only if every workflow touching PHI is deliberately kept off n8n Cloud and moved to a compliant self-hosted instance instead — and that requires someone to actually track which workflows touch PHI in the first place.
What to Do Instead
- Inventory every n8n workflow that touches patient data. Don’t assume — check triggers, actions, and every downstream service each workflow calls.
- If any of them touch PHI, they don’t belong on n8n Cloud. Move those workflows to a self-hosted instance inside infrastructure that has signed a BAA with you.
- Configure encryption yourself on self-hosted instances. n8n’s documentation is explicit that this is not handled automatically outside of n8n Cloud.
- Confirm every downstream service in the workflow is BAA-covered too. A compliant n8n host doesn’t help if the email, SMS, or EHR integration on the other end isn’t covered.
- Keep n8n Cloud for what doesn’t touch PHI. Internal notifications, non-clinical marketing automation, and general business workflows are reasonable uses of the cloud version.
Not sure whether your self-hosted n8n instance is actually compliant? HIPAA Vault can review your architecture, scope out exactly what needs to change, and deploy it to a BAA-covered production environment.
Book a Free 15-Minute Consultation →
Questions to Ask Before You Trust an n8n Workflow With Patient Data
- Is this workflow running on n8n Cloud or self-hosted? If it’s Cloud and touches PHI, that’s the first thing to fix.
- If self-hosted, is the underlying infrastructure actually BAA-covered? Self-hosting on a personal server or an uncovered cloud account doesn’t change anything.
- Is encryption at rest and in transit actually configured? n8n doesn’t do this for you on self-hosted instances — confirm it’s been set up, not assumed.
- What does every node in this workflow connect to? Map each downstream service and confirm it’s BAA-covered too.
- Who’s responsible for keeping this instance patched and monitored? Self-hosting means the ongoing security work is yours, not n8n’s.
FAQ
For informational purposes only, not legal advice — consult qualified counsel for your specific HIPAA obligations. Reflects n8n’s published documentation and support responses as of the publish date and the perspectives of Gil Vidals, CTO and Co-Founder, and Josh Vidals, Cloud Engineer, at HIPAA Vault.
