Amplitude Analytics is a product analytics platform that helps organizations understand how users interact with websites, applications, and other digital products. It provides behavioral analytics, session replay, experimentation, and data governance capabilities.

With Amplitude, organizations can analyze customer journeys, identify where users encounter difficulties, measure engagement, and use those findings to improve digital experiences.

Is Amplitude Analytics HIPAA compliant? Yes, Amplitude Analytics can support HIPAA compliant use.

 

What changed this year?

As of August 2026, our review identified that Amplitude publicly states that it can enter into a business associate agreement (BAA) with HIPAA covered entities and business associates.

Moreover, Amplitude stated in March 2026 that its AI features can be covered by an existing BAA. Its Main Service Agreement, last updated May 13, 2026, continues to prohibit health information under the standard terms. Therefore, healthcare organizations must obtain an executed BAA that expressly permits their intended use before transmitting protected health information (PHI).

We did not identify any other publicly disclosed 2026 policy changes that narrow Amplitude’s stated HIPAA scope.

 

Will Amplitude Analytics sign a BAA?

Yes, Amplitude Analytics can enter into a BAA with customers who are covered entities or business associates, as described on its security and privacy page.

Amplitude does not publish its complete BAA for unrestricted public review. Its Trust Center provides an “Amplitude & HIPAA” document that customers can request access to.

 

What does the Amplitude Analytics BAA cover?

Amplitude does not publicly disclose the complete text of its BAA. However, its security and privacy materials state, “all of Amplitude’s AI features are covered under our BAAs.”

Based on Amplitude’s public statements (as a physical one is available upon request), its BAA covers:

  • All Amplitude AI features are covered under its BAAs.
  • Amplitude maintains corresponding BAAs with its third-party AI subprocessors.

Amplitude’s healthcare analytics page also states that the company recognizes the importance of protecting PHI and can enter into a BAA to help customers maintain HIPAA compliance.

Healthcare organizations should review the actual BAA, order form, and applicable product documentation to confirm that every service they intend to use is covered.

 

What does the Amplitude Analytics BAA exclude?

Amplitude does not publicly list every exclusion contained in its BAA. However, its standard Main Service Agreement prohibits customers from transmitting customer data that includes “health information, biometric or genetic data” and other sensitive personal information.

Therefore, healthcare organizations should not submit PHI under Amplitude’s standard terms. An executed BAA and any related contractual amendment must expressly authorize the organization’s intended handling of PHI.

Amplitude’s terms also state that providers of customer-selected third-party products “shall not be considered subcontractors or Sub-processors of Amplitude.” As such, integrations connected to Amplitude may require separate HIPAA reviews and BAAs.

Amplitude’s public materials do not confirm that BAA coverage is available for every pricing plan, free trial, beta service, or third-party integration. Healthcare organizations should obtain written confirmation of their specific account and service coverage before sending PHI to the platform.

 

Conclusion

Amplitude Analytics may be HIPAA compliant, but only when the healthcare organization has an executed BAA and limits its use to the services and data permitted by that agreement.

Learn more: HIPAA Compliant Email: The Definitive Guide

 

FAQs

What is a BAA?

A BAA is a legally binding contract establishing a relationship between a covered entity under HIPAA and its business associates. The purpose of this agreement is to ensure the proper protection of PHI as required by HIPAA regulations.

 

What is HIPAA?

HIPAA sets national standards for protecting the privacy and security of certain health information, known as PHI.

HIPAA is designed to protect the privacy and security of individuals’ health information and to ensure that healthcare providers and insurers can securely exchange electronic health information. Violations of HIPAA can result in significant fines and penalties for covered entities.

 

Who does HIPAA apply to?

HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.