Noom offers digital weight management programs that combine behavior-change lessons, food and activity tracking, and coaching. Noom Med also provides access to independent clinical partners for medical weight management.

Is Noom HIPAA compliant? Yes, based on our research, Noom can be HIPAA compliant.

 

What changed this year?

As of September 2026, our review did not identify any publicly disclosed 2026 change to Noom’s HIPAA Notice or a published change to its BAA terms. The notice was last updated December 29, 2025. Noom currently states that Noom Med follows HIPAA rules, but that statement does not establish which services a healthcare customer’s BAA would cover.

 

Will Noom sign a business associate agreement (BAA)?

Our 2025 review says Noom will sign a BAA. However, its link to the agreement opens Noom’s HIPAA Notice, which is a notice to individuals, not a BAA. Noom’s public business terms do not include a BAA either. We could not independently confirm current BAA availability or link to terms that healthcare customers can review. Organizations should ask Noom for a current BAA covering their intended services before giving it protected health information (PHI) to handle on their behalf.

 

What does the Noom BAA cover?

The scope of a Noom customer BAA cannot be confirmed without the agreement. Noom’s HIPAA Notice describes how it may use and disclose PHI for treatment, payment, and healthcare operations. It also says Noom will have “the legally required safeguards to protect the privacy of your health information” when its own business associates handle PHI. That notice does not set out the services, data, or obligations covered by a BAA between Noom and a healthcare organization.

 

What does the Noom BAA exclude?

Noom does not publish a customer BAA with exclusions that we could verify. Its consumer terms say, “Noom Coaches cannot offer advice regarding diagnosis or treatment of any medical or mental health condition or illness.” Those terms distinguish coaching from clinical care; they do not show that treatment-related communications are excluded from a BAA. The same terms say independent clinical partners provide medical services through Noom Med. Healthcare organizations should check the actual agreement for exclusions affecting their program, features, and data flows.

 

Conclusion

Noom signs a BAA and is therefore HIPAA compliant.

Learn more: HIPAA Compliant Email: The Definitive Guide

 

FAQS

What is a BAA?

A BAA is a legally binding contract establishing a relationship between a covered entity under HIPAA and its business associates. The purpose of this agreement is to ensure the proper protection of PHI as required by HIPAA regulations.

 

What is HIPAA?

HIPAA sets national standards for protecting the privacy and security of certain health information, known as PHI.

HIPAA is designed to protect the privacy and security of individuals’ health information and to ensure that healthcare providers and insurers can securely exchange electronic health information. Violations of HIPAA can result in significant fines and penalties for covered entities.

 

Who does HIPAA apply to?

HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.