The Hosting Decision Most People Skip
When healthcare professionals discover n8n, they usually go straight to n8n Cloud or spin up a Docker container on the cheapest VPS they can find. The workflow runs. Data flows. Nobody thinks about where that data is sitting.
That matters more with n8n than with most tools, because n8n does not offer a BAA. n8n staff confirmed as much on the company's own community forum in January 2026, and there is no HIPAA page in n8n's documentation. On n8n Cloud, n8n is the one holding your data, and without a BAA that closes the door on PHI. Self hosting flips it: you run the software on infrastructure you control, n8n the company never sees the data, and the only BAA you need is with the host underneath.
For general business automation, this is fine. For healthcare-adjacent automation, it is a compliance gap.
What a BAA Actually Does
A Business Associate Agreement (BAA) is a legal contract between you and a service provider that handles data on your behalf. Under HIPAA the obligation runs the other way from how most people assume. A covered entity or business associate may only disclose PHI to a vendor after it obtains satisfactory assurances in writing, meaning a signed BAA, that the vendor will safeguard the information. The vendor is under no duty to offer you one, and plenty will simply say no. HHS also carves out a narrow conduit exception for services that only transmit PHI without accessing it, like an ISP. If a vendor stores your data or works with it, that exception does not apply and you need the BAA.
AWS offers a BAA that you accept yourself through AWS Artifact. Accepting it does not bless your whole account. AWS is specific about this: you can run any AWS service inside a HIPAA account, but you may only process, store, or transmit PHI in the services AWS names on its HIPAA Eligible Services list, and you have to encrypt all of that PHI at rest and in transit. EC2, EBS, S3, RDS, Elastic Load Balancing, and AWS Certificate Manager are all on that list today, which is why the stack below is built out of exactly those pieces. Anything not on the list can still run in the account, it just cannot touch PHI.
Without a BAA you are operating on the provider's ordinary commercial terms, which are not written with PHI in mind. No contractual limits on how PHI may be used or disclosed, no obligation to report a breach up to you, no HIPAA-specific safeguard commitments. Terms vary by provider, so read yours rather than assuming. The point is that none of the protections HIPAA expects a business associate to give you are in that contract, because that is not what the contract is for.
What My AWS n8n Instance Actually Runs
The n8n instance on AWS handles everything connected to Hunter's Holistic Health:
The intake router receives four types of form submissions (waitlist, support, feature requests, clinical inquiries). Each type is routed to its own Google Sheets tab. Email alerts go out with name, email, category, and timestamp only. No health details in the alerts.
The clinical inquiry flow is the most sensitive. The form itself collects only general interest information with a visible disclaimer telling users not to include lab results or diagnoses. The safeguard here is the form design, not the hosting. The form does not collect clinical detail, so nothing that arrives is PHI to begin with. I still run this flow on the eligible AWS services under the BAA because it is the gateway to the clinical lane and I would rather the legal floor already be in place than have to move the workflow later. Hosting it there is not what makes it safe. Not collecting PHI is.
The daily business briefing pulls data from five Gmail accounts, four Google Sheets tabs, and three Supabase tables. It summarizes everything via Claude Haiku, posts to Telegram, and creates calendar events for anything with a deadline. Worth being blunt about this one: the AWS BAA stops at AWS. Claude, Telegram, and Supabase are separate vendors on separate terms, and the BAA does not travel with the data once it leaves the instance. So this briefing carries operational data only. Revenue, task counts, deadlines, message volume. No client health information goes anywhere near it, which is the only reason it can talk to those three services at all.
The Two-Instance Pattern
I run two separate n8n instances. The AWS instance handles healthcare-adjacent flows. A second instance on Oracle Cloud free tier handles everything else: teaching demos, client workflow builds, personal automations.
This separation costs nothing extra (Oracle free tier is genuinely free for 12 months) and creates a clean boundary between data that needs the BAA umbrella and data that does not.
The Setup
The AWS setup is straightforward. An EC2 t3.micro instance running Ubuntu with Docker. n8n runs as a Docker container with a mounted volume for persistent data. The instance sits behind an Application Load Balancer with an SSL certificate from AWS Certificate Manager.
Total monthly cost: roughly $15 to $20 depending on traffic, well within the free tier for the first year.
The Takeaway
If you are building automation for a health practice, the hosting decision is not just a technical choice. It is a compliance decision. Running n8n on AWS with a BAA does not make your workflows HIPAA-compliant by itself. Not close. It puts one layer, the infrastructure layer, on a defensible legal footing. Everything above it is still on you: what your forms collect, who can reach the data, how it is encrypted, what you log.
Start one step earlier than the hosting question. Work out whether you are a covered entity or a business associate under HIPAA, because that determines whether a BAA is legally required of you or simply good hygiene. A cash-pay educator who never bills insurance electronically may land in a different place than a billing clinic.
This is how I set up my own environment and it is general information, not legal advice. Before you rely on any of it, run your setup past your own healthcare attorney or compliance officer. Your situation, your state, and your payer relationships all change the answer.