W&B's platform is not set up by default to handle medical or health data, and you cannot use it with that type of data unless you separately negotiate and sign a HIPAA Business Associate Agreement with W&B.
This analysis describes what Weights & Biases's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision clarifies the regulatory scope of the standard service offering by excluding HIPAA-covered use cases from the default agreement structure. It establishes that HIPAA compliance requires a separate contractual arrangement and explicitly prohibits HIPAA-regulated data flows under the standard terms, creating a binary framework: either use the service without PHI, or negotiate specialized BAA terms.
The updated agreement no longer includes language stating that a previously executed written agreement between Customer and W&B would govern and supersede the master service agreement. This removal eliminates explicit recognition of contractual hierarchy that may have applied to customers with signed agreements predating the master terms. The practical effect depends on whether such customers have separate agreements in place and how contract interpretation and applicable law would treat the relationship between a posted master agreement and a signed customer agreement absent explicit supersession language.
View change record →The updated Terms of Service no longer include the previous statement that services would become inaccessible from certain locations starting September 1st, 2025. This removal means the geographic restriction that was previously announced in the agreement is no longer formally stated in the current terms. Users who were affected by or concerned about the prior restriction should review current documentation to confirm whether any geographic limitations remain in effect.
View change record →If you work in healthcare or handle patient data and use W&B without a signed BAA, you — not W&B — bear full HIPAA compliance risk, including potential civil and criminal penalties for unauthorized disclosure of Protected Health Information.
How other platforms handle this
In assessing misuse, we consider factors such as evidence that a report was motivated by bias or hatred (e.g., based on protected characteristics such as race, sexual orientation, or gender identity) or other malicious intent.
We review account behavior and content that Members create, send, and publish in Mailchimp, including Campaigns and Websites.
We allow Content that names individuals in the highest positions in a company who have broad influence over the work environment, as long as the Content describes the individual's behavior or performance at work.
"The Services are not designed for use with Protected Health Information (as defined under HIPAA) and W&B does not offer a Business Associate Agreement as a standard part of this Agreement. Customer agrees not to submit any Protected Health Information to the Services unless Customer has entered into a separate Business Associate Agreement with W&B.Excerpt from Weights & Biases's Terms of Service
(1) REGULATORY FRAMEWORK: HIPAA Privacy Rule (45 CFR §164.502) and Security Rule (45 CFR §164.312) require covered entities to execute a Business Associate Agreement with any vendor handling Protected Health Information (PHI).
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision clarifies the regulatory scope of the standard service offering by excluding HIPAA-covered use cases from the default agreement structure. It establishes that HIPAA compliance requires a separate contractual arrangement and explicitly prohibits HIPAA-regulated data flows under the standard terms, creating a binary framework: either use the service without PHI, or negotiate specialized BAA terms.
If you work in healthcare or handle patient data and use W&B without a signed BAA, you — not W&B — bear full HIPAA compliance risk, including potential civil and criminal penalties for unauthorized disclosure of Protected Health Information.
ConductAtlas has identified this type of provision across 142 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Weights & Biases.