Is ServiceNow HIPAA Compliant?

• Is ServiceNow HIPAA compliant? Yes — ServiceNow signs a BAA and offers healthcare products, so it can be HIPAA compliant with proper configuration.
• ServiceNow routinely holds patient records in cases and incidents, HR service records with health data, and knowledge articles — PHI the moment a covered entity uses it.
• The newest risk is AI over MCP: connecting ServiceNow to an assistant like Claude Cowork (which carries no BAA) can pull that PHI to a model outside your BAA.
• Strac keeps PHI safe either way — redacting it on the MCP path and stopping it from being entered where it should not be.

✨ Is ServiceNow HIPAA Compliant?

Yes — ServiceNow signs a BAA and offers healthcare products, so it can be HIPAA compliant with proper configuration. HIPAA compliance is never automatic — it depends on a signed Business Associate Agreement (BAA) with the vendor plus how you configure and use the tool. Below is where ServiceNow stands, where PHI ends up, and the AI/MCP gap most teams miss.

Does ServiceNow Sign a BAA?

ServiceNow signs BAAs and offers healthcare-focused products, so it can be part of a HIPAA-compliant workflow. But 'can be' is not 'is' — you need the BAA in place, scoped access, encryption, and tight control over the integrations and AI features that move records out of the platform.

Where PHI Ends Up in ServiceNow

Even teams that "don’t use ServiceNow for health data" accumulate PHI in it: patient records in cases and incidents, HR service records with health data, and knowledge articles. Under HIPAA, a single identifier tied to health information is enough to trigger the rules — so the question isn’t whether PHI could land in ServiceNow, it’s what protects it when it does.

✨ The New Risk: ServiceNow + AI Agents via MCP

Here is the gap even a BAA doesn’t close. The moment someone connects ServiceNow to an AI assistant over the Model Context Protocol (MCP), an agent can query it and pull PHI straight into the model’s context. If that model is Claude Cowork — which Anthropic will not sign a BAA for — the PHI now sits outside your BAA perimeter, a reportable exposure even though ServiceNow itself is configured correctly.

How Strac Protects PHI in ServiceNow

Strac MCP DLP sits on the MCP path, detects PHI in every request and response, and redacts, masks, or blocks it before it reaches the assistant — so an AI that won’t sign a BAA never sees regulated data. And Strac browser and endpoint DLP catch PHI before it is pasted or typed into ServiceNow in the first place. Every action is audit-logged for HIPAA. See MCP integrations and ServiceNow MCP server.

How to Use ServiceNow with PHI Safely

1. Execute the BAA, scope roles and ACLs tightly, encrypt sensitive fields, and audit every integration and AI feature that reads case data.
2. Put Strac browser/endpoint DLP in front so PHI is caught before it is entered.
3. If you connect to AI/MCP, run Strac MCP DLP so PHI is redacted before it reaches the model.
4. Keep an audit trail of what PHI was detected, redacted, and by whom.

🌶️ Spicy FAQs on ServiceNow HIPAA Compliance

Is ServiceNow HIPAA compliant in 2026? Yes — ServiceNow signs a BAA and offers healthcare products, so it can be HIPAA compliant with proper configuration.

Can I use ServiceNow with Claude or ChatGPT and stay HIPAA compliant? Only if PHI never reaches a model that isn’t under a BAA. Claude Cowork does not sign one, so connecting ServiceNow over MCP can expose PHI. Strac MCP DLP redacts PHI on the MCP path before it reaches the assistant.

Does ServiceNow store PHI? It can — patient records in cases and incidents, HR service records with health data, and knowledge articles. Whether or not that’s intended, it needs to be protected.