Samsung Notes is a note-taking app that allows users to create typed and handwritten notes, add images and voice recordings, annotate PDFs, and sync notes through Samsung Cloud.

Is Samsung Notes HIPAA compliant? No, based on our research, Samsung Notes should not be treated as HIPAA compliant for cloud-based PHI storage without an applicable BAA.

 

What changed this year?

As of October 2026, our review found no publicly disclosed changes that establish HIPAA coverage or BAA availability for Samsung Notes. Samsung’s updated U.S. service terms and privacy policy do not provide a Samsung Notes BAA.

 

Will Samsung Notes sign a business associate agreement (BAA)?

Our review of Samsung’s U.S. service terms did not identify a BAA for Samsung Notes or a public commitment to provide one. Healthcare organizations must obtain an applicable BAA before using a vendor’s cloud services to store or process PHI on their behalf.

 

Conclusion

Samsung Notes has no publicly confirmed BAA offering, so its cloud-connected features should not be used for PHI without an applicable agreement and the required HIPAA safeguards. Local-only use requires a separate assessment of the configuration and safeguards; providing software alone does not necessarily make the vendor a business associate.

Learn more: HIPAA Compliant Email: The Definitive Guide

 

FAQs

What is a BAA?

A BAA is a legally binding contract establishing a relationship between a covered entity under HIPAA and its business associates. The purpose of this agreement is to ensure the proper protection of PHI as required by HIPAA regulations.

 

What is HIPAA?

HIPAA sets national standards for protecting the privacy and security of certain health information, known as PHI.

HIPAA protects the privacy and security of individuals’ health information and ensures that healthcare providers and insurers can securely exchange electronic health information. Violations of HIPAA can result in significant fines and penalties for covered entities.

 

Who does HIPAA apply to?

HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.