W&B's platform is not set up by default to handle medical or health data, and you cannot use it with that type of data unless you separately negotiate and sign a HIPAA Business Associate Agreement with W&B.
If you work in healthcare or handle patient data and use W&B without a signed BAA, you — not W&B — bear full HIPAA compliance risk, including potential civil and criminal penalties for unauthorized disclosure of Protected Health Information.
Cross-platform context
See how other platforms handle HIPAA Exclusion — No Default BAA and similar clauses.
Compare across platforms →Healthcare organizations or researchers who upload patient data or Protected Health Information to W&B without a BAA are in violation of HIPAA and face potential federal penalties of up to $1.9 million per violation category per year.
(1) REGULATORY FRAMEWORK: HIPAA Privacy Rule (45 CFR §164.502) and Security Rule (45 CFR §164.312) require covered entities to execute a Business Associate Agreement with any vendor handling Protected Health Information (PHI). Failure to obtain a BAA before uploading PHI to a third-party platform is a per se HIPAA violation enforceable by HHS Office for Civil Rights (OCR). The HITECH Act (42 U.S.C. §17931) extends liability to business associates and imposes breach notification requirements. (2)
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.