n8n HIPAA Compliance in 2026: What You Must Do Yourself
Oct 19, 202614 min read
n8n doesn't make you HIPAA compliant, and no plan on its pricing page should be read as a promise of a BAA or a HIPAA attestation, a caution that applies just as much to any other automation tool, including Activepieces.
A BAA is a signed contract, so if n8n hasn't signed one with you, you don't have one, whatever the marketing implies. Ask n8n for it in writing, name the plan, and keep the signed copy.
Understand n8n's HIPAA compliance limits
**A BAA is a signed contract, so if n8n hasn't signed one with you, you don't have one, whatever the marketing implies.
What HIPAA actually requires of an automation tool
The law has no certification for software; it sets obligations on you and on every vendor that touches protected health information (PHI).
Four things have to hold at once:
- where n8n runs
- a BAA with each vendor touching PHI
- configured safeguards
- a documented risk analysis
If you hold a signed BAA but run a badly configured instance, PHI is still exposed.
n8n cloud versus self-hosted HIPAA responsibilities
On n8n's hosted cloud, n8n holds your workflow data, so it's a business associate and you need its BAA before PHI enters a workflow. Self-hosting changes the question: n8n doesn't see your data, but you now own:
- encryption
- access control
- logging
- patching
When you compare options, Activepieces included, you face that same split between a vendor's hosting and your own.
Self-hosting also doesn't remove the vendors your workflows call, such as an email service or an AI model. Each of those needs its own BAA if PHI reaches it.
Everything below works on Activepieces' free plan. Start without code or a credit card.
What n8n says about HIPAA and security
Since n8n is one of those vendors, its BAA position matters, and nothing confirmed on its trust centre, docs or pricing page says it will sign one. This table records only what was confirmed, and "not stated" means no page confirmation, not a "no".
Self-hosting is the only row with a confirmed statement.
| Requirement | What n8n states | Source page | Plan and cost | Date checked |
|---|---|---|---|---|
| HIPAA BAA | Not stated | Not stated | Not stated | Not stated |
| SOC 2 | Not stated | Not stated | Not stated | Not stated |
| SSO | Not stated | Not stated | Not stated | Not stated |
| RBAC | Not stated | Not stated | Not stated | Not stated |
| Audit logs | Not stated | Not stated | Not stated | Not stated |
| EU residency | Not stated | Not stated | Not stated | Not stated |
| Self-hosting | Available under n8n's fair-code licence | Licence and docs | Free edition; paid tiers not stated | Not stated |
Before PHI touches a workflow, each empty row needs a written answer from n8n.
Check the pricing page row by row for SSO, RBAC and audit logs, because access controls and audit trails are the features vendors most often reserve for higher tiers.
I won't name a tier I haven't confirmed. If a control you need sits above the plan you budgeted, your cost model is wrong before you start.
What n8n's licence and pricing mean for self-hosting costs
Once the data moves into your environment, patching, backups, access reviews and logging move onto your team too. For most teams, I'd expect staff time to outweigh the server bill. That estimate comes from experience, not a measured figure.
The licence also limits what you may do commercially with the software, so read it before building a product on top.
How patient data duplicates across n8n
Once patient data enters n8n through a trigger, it gets copied into execution history, logs, stored credentials and every third-party service a node calls.
Common healthcare workflows built in n8n
You will find n8n doing appointment reminders, intake forms that write into an electronic health record (EHR), lab result routing to the right clinician, and billing handoffs.
Each one starts with a webhook or schedule that receives names, dates of birth, diagnoses or claim details.
Where PHI ends up in n8n
By default, n8n stores the data each node received and returned for every run, so the execution store becomes a database of patient records nobody planned to build. Server logs can capture payloads when something fails.
Error workflows often email the failing item, which pushes PHI into an inbox that sits outside the platform entirely. Retention settings and execution-saving options exist, but you have to set them deliberately.
Whoever reaches n8n's database reaches the systems behind it, because the keys for your EHR and messaging accounts sit there.
Third-party nodes and AI vendors in n8n HIPAA
Send a text through an SMS node and the message text goes to a messaging provider. Use an AI node and a prompt, possibly stuffed with clinical notes, goes to a model vendor.
Each of those is its own vendor with its own terms, and running n8n yourself does nothing to the data once it leaves your server.
Read the diagram as a checklist: it traces one workflow from trigger to third-party call and marks every hop where PHI can leak. If you can't say what is stored, logged or sent at a hop, that hop is your gap.
Mistakes teams make when running n8n with PHI
Four false assumptions about n8n and PHI
Nobody verified four assumptions, and most PHI failures on n8n trace back to them.
Why n8n HIPAA breaches cost more
Getting this wrong costs more here than elsewhere. IBM's 2025 figures put the average healthcare breach at $7.42M against $4.44M across all industries, so the same slip costs about two-thirds more here.
Assuming self-hosted n8n is HIPAA compliant
Yes, self-hosting keeps data in your environment. It doesn't encrypt your disks, restrict your network, or produce an audit trail. Those controls are yours to build and document, and a risk analysis should say who owns each one.
Leaving PHI in n8n execution data
By default, n8n stores execution data, and that data includes the payloads that passed through each node. A workflow that handled one patient record last year may still hold it today.
Turn on pruning with a short retention window, and stop saving successful executions for workflows that carry PHI. Check that logs and backups follow the same rule.
Sending PHI to services without a BAA
If a node posts PHI to a chat tool, an email service, or an AI model API without a signed BAA, the workflow has a disclosure problem, because a workflow is only as covered as its weakest hop.
List every external node, confirm the agreement exists, and strip identifiers before anything leaves your boundary otherwise.
Exposing unauthenticated n8n webhooks
Anyone who finds the URL can send anything to an unauthenticated webhook. Require authentication on every webhook and put it behind your network controls.
Give each integration its own scoped credentials instead of one shared login, so access can be revoked and traced to a person.
Easier to see it running than to read about it: set it up free, no card.
Nine HIPAA controls for self-hosted n8n
Of the nine controls you build yourself, secrets and scoped credentials are one, and they belong in this order:
- Risk analysis
- Network isolation
- Encryption
- SSO and role-based access
- Secrets
- Execution pruning
- Log retention
- Backups
- Patching
Nothing here ships switched on, so each one costs engineer time, and n8n bills none of it.
For 336 hours by default, n8n keeps execution data, so patient data passing through a workflow sits in your database for two weeks. Cut it to 72 hours. That shrinks what a breach exposes, and keeps debugging history to three days.
Put SSO and role-based access in front of the editor so offboarding one person removes their access everywhere. Retain logs for the period your policy sets, and ship them somewhere the n8n admin can't edit.
n8n network, encryption and backup controls
Keep n8n on a private network, terminate TLS at the load balancer, and encrypt the database and its backups.
On AWS, a small deployment ran about $9 a month for compute, $12 for the database and $9 for the load balancer, per Halmob's load test. That's roughly $30, so the real cost is the people maintaining it.
That's 122 critical or high advisories, so expect to patch continuously rather than once a year.
Write the risk analysis around that cadence, and assign someone to own it.
Other ways to meet the same requirement, including Activepieces
Owning the risk analysis doesn't mean n8n is your only route; four others meet the same requirement, and each moves the work somewhere different.
Comparison table of the routes
Read the table below for where the burden lands, not for a winner.
A route light on operations usually pushes more onto a contract, while one light on contracts pushes it onto your engineers.
| Route | Compliance evidence | Data location | Access control | Operations burden |
|---|---|---|---|---|
| n8n self-hosted | None from n8n for your deployment; the evidence is yours | Your own infrastructure | What you configure and what the edition provides | Highest of the hosted options: patching, backups, logging, encryption are yours |
| n8n Enterprise | Documents and terms you must verify on n8n's own pages | Depends on where you deploy it | Enterprise features, checked against their pricing page | Shared, but deployment settings remain yours |
| BAA-signing vendor | A signed agreement, which is the point of choosing it | Vendor's infrastructure | Vendor's model, often less flexible | Lowest, though you still audit what flows through it |
| In-house build | Whatever you document and test yourself | Wherever you put it | Exactly what you build | Everything, permanently |
| Activepieces | SOC 2 Type II; no HIPAA or BAA claim | EU or US managed cloud, self-host, or air-gapped | SSO, SCIM, custom RBAC, audit logs | Low on managed cloud, yours when self-hosted |
Do you need a signed vendor BAA?
If your compliance position depends on a signed BAA from your automation vendor, Activepieces isn't that route. It doesn't give you a HIPAA certification or a BAA, and nothing I can point at says otherwise.
What it does offer is a way to keep data out of the vendor's hands. A regulated team can self-host, or run it air-gapped, so workflow data stays inside its own environment.
Self-host it and the HIPAA obligations are yours to meet, the same as with n8n self-hosted.
The table's "what the edition provides" question is where that route usually costs you, since a self-hosted build is often the cut-down one, with the controls kept for the vendor's cloud.
Activepieces doesn't split it that way: single sign-on, SCIM provisioning, custom roles, audit logs, release management and secret manager hookups are all in the air-gapped edition, just as they are on the managed cloud, which runs in an EU or US region and holds SOC 2 Type II.
MoneyGram, Moneypenny, Alan and FundingSocieties run Activepieces in production.
Those are the controls a reviewer will ask to see, and you don't have to build them.
If data residency is the constraint rather than PHI handling, the managed cloud in an EU or US region may be enough.
Treat all of this as claims to check. Ask for the SOC 2 report itself, ask which of these controls sit on which plan, and ask exactly what changes between cloud and self-hosted. The security documents and enterprise pricing are available at activepieces.com/sales.
Request n8n's HIPAA and security documentation
Get n8n's BAA position in writing, along with its SOC 2 report, subprocessor list and data location, then map every workflow that touches PHI and run a dated risk analysis.
HIPAA questions to ask any workflow vendor
Don't rely on a sales call, because a verbal "yes, we support HIPAA" binds nobody.
Ask for the BAA position as a signed document or a written statement, and ask which product it covers. A BAA for a hosted offering says nothing about a copy you run yourself.
Ask for the SOC 2 report itself, not the badge, and read the scope: if the audited systems don't include the service you'd use, the report doesn't cover you.
Ask for the subprocessor list and for where data is stored and processed, because each subprocessor is another party handling PHI on your behalf.
Internal steps before running PHI in n8n
Start by mapping each workflow that reads, writes or passes PHI, including the ones that only log it or send it in an error notification.
Then run a risk analysis and date it, so an auditor can see what you knew and when. If a workflow isn't on the map, you can't say it was reviewed.
Taken together, this is the list to bring to Monday's meeting:
- n8n's BAA position, in writing
- n8n's current SOC 2 report
- The subprocessor list
- Where data is stored and processed
- A map of every PHI workflow
- A dated risk analysis
- The alternative vendor's security documents, requested through activepieces.com/sales
A missing BAA or an unclear data location means the workflow stays off PHI, or moves to infrastructure you control, until the gap is closed.
Frequently asked questions
Where the body leaves questions open, the answers below hold as of October 2026. Check each against n8n's own pages before you rely on it.
Does n8n sign a BAA? Assume no until n8n's trust page or a signed document says otherwise.
A BAA is a contract, so a marketing claim of "HIPAA-ready" doesn't substitute for one. If you can't produce the signed agreement, keep PHI out of n8n's hosted service.
Is self-hosted n8n HIPAA compliant? No. Self-hosting moves the data into your environment, which can remove the need for a BAA with n8n for that data. Encryption, access control, logging, backups, and patching then become yours to configure and prove.
Can I send PHI to an AI node in n8n?
Not unless the model provider behind the node has signed a BAA with you and you've confirmed the specific endpoint is covered. The node is just a connector, and the PHI goes to whoever runs the model.
A demo that works on synthetic data tells you nothing about this. Without that agreement, strip or tokenize identifiers before the call, or run a model you host yourself.
Is n8n SOC 2 compliant, and does that cover HIPAA? SOC 2 is an audit of a vendor's controls. Whether n8n holds a current report is something to confirm on its trust page and request directly.
Even with a report, it doesn't cover HIPAA. It can support your vendor review, but it's not a BAA or a HIPAA attestation.
What is the penalty for a HIPAA violation by an automation tool? You take the penalty, not the tool. Regulators fine covered entities and business associates, and the amount scales with how negligent the failure was.
A workflow that leaked PHI through a missing agreement or an open webhook counts as your failure to manage a vendor and safeguard data.
