Datadog will sign a BAA.
Here's how to actually get one.
PJ · Cardiff operator · 858-461-8054
docs.datadoghq.com/account_management/compliance/. The cost step-up is real — Enterprise tier + Sensitive Data Scanner + extended retention typically takes a $15K/year Pro account to $80-120K/year. For early-stage healthcare startups, this is the moment to evaluate Datadog vs. Honeycomb / Grafana Cloud / Splunk on cost-per-HIPAA-scope.
How to actually request the BAA · 3-step process.
Most BAA delays come from going through the wrong channel. Here's the path that minimizes review cycles.
Identify the right contact (in priority order).
(a) Your existing Datadog account manager — fastest path. Email directly: "We need a BAA for HIPAA compliance. Our use case is [PHI-handling workload]. Please initiate the BAA process and confirm which services are eligible for our region."
(b) Datadog Sales if no account manager: sales@datadoghq.com. Same message + your current Datadog org name + contact info.
(c) In-app support as fallback — open a ticket, mention HIPAA + BAA explicitly so it gets routed to the compliance team, not L1.
Confirm the scope BEFORE signing.
Datadog will send you their standard BAA. Read the appendix listing HIPAA-eligible services. Verify the services you actually need (APM, Logs, Synthetic, RUM, etc.) are explicitly listed. If a service you depend on isn't in scope, raise it before signing — adding services post-signature requires another legal cycle.
Also confirm region eligibility. US1, US3, US5 typically support HIPAA. EU1 and AP1 generally do not. If you're already provisioned in a non-eligible region, plan for a region migration before HIPAA workloads start.
Wait for executed BAA + account flag confirmation.
The BAA isn't active just because you signed. Datadog needs to (1) countersign, (2) flag your account as HIPAA-enabled, and (3) confirm in writing that the scoped services are now ready for PHI. Don't send PHI before you have all three confirmations. Get the confirmation in email — your auditor will want it.
What's covered vs. what's not · verify against current docs.
A BAA does not mean "every Datadog feature can receive PHI." Coverage is service-by-service. This list is directional — Datadog updates eligibility quarterly, so always cross-reference the live docs.
| Service / Feature | Typically HIPAA-Eligible | Notes |
|---|---|---|
| Infrastructure Monitoring | ✓ Yes | Core service. PHI minimization still required — don't put patient identifiers in host tags. |
| APM (Application Performance Monitoring) | ✓ Yes | Trace data can carry PHI in spans / attributes. Configure scrubbing at the agent level. |
| Logs | ✓ Yes | The biggest PHI risk surface. Use Sensitive Data Scanner. Set retention to match HIPAA requirements (typically 6 years for audit logs). |
| RUM (Real User Monitoring) | ✓ Yes | Frontend can capture PHI in URLs / form fields. Configure RUM to mask sensitive selectors. |
| Synthetic Monitoring | ✓ Yes | Test scripts shouldn't contain real patient data. Use synthetic test accounts only. |
| Sensitive Data Scanner | ✓ Yes (recommended) | Add-on for detecting/redacting PHI patterns automatically. Often required for audit-ready posture. |
| Beta / Preview features | ⚠ Verify | New services are often NOT yet in HIPAA scope. Check before enabling. |
| Third-party integrations | ⚠ Verify | Some integrations forward data outside Datadog's scope. Confirm each integration's HIPAA posture. |
| EU1 / AP1 regions | ✗ No (typically) | HIPAA eligibility is US-region-only as of 2026. Verify current region scope. |
| Free / Pro tier accounts | ✗ No | BAA requires Enterprise tier. |
The five anti-patterns that fail HIPAA audits.
Each one looks fine until the auditor pulls a sample. Worth a checklist before audit week.
✗Sending PHI to Datadog before the BAA is fully executed
Teams often start collecting logs and traces as part of normal engineering work, then discover the compliance gap during audit. By then, months of PHI have flowed through Datadog under no BAA — that's a violation regardless of whether you later sign one.
✗Assuming the BAA covers every Datadog feature
BAA scope is per-service. A signed BAA doesn't mean PHI can flow through every Datadog feature — only the explicitly-scoped ones in the BAA appendix.
✗Sending unredacted PHI in logs
Even with a BAA, sending raw patient identifiers, SSNs, or PHI in plain log lines fails most HIPAA audits. The expectation is minimum-necessary: redact what you can.
✗Provisioned in EU1 / AP1 with PHI
HIPAA scope is region-specific. Sending US-jurisdiction PHI through a non-eligible region is a violation even with a signed BAA.
✗No written confirmation of HIPAA enablement
Auditors want to see (1) signed BAA, (2) Datadog's written confirmation that your account is HIPAA-flagged, (3) per-service scope appendix. Verbal confirmation from a sales rep doesn't survive an audit.
Why this is an operator-translation problem.
Datadog's HIPAA documentation is technically correct and operationally opaque. The docs answer "what services are eligible" but don't answer "how do I actually get this done at my org with my budget on my timeline." That gap is where small healthcare-adjacent teams stall — not because the BAA is hard to get, but because the path isn't obvious.
The translation layer is the 3-step process: identify the right contact, confirm scope before signing, get all three confirmations in writing. None of that requires legal expertise — it requires knowing which questions to ask in which order. That's operator-translation, not law school.
Datadog will sign the BAA.
The blocker is the request path, not the policy.
Stuck on a Datadog HIPAA question?
If you're trying to figure out scope, region, or whether the Enterprise step-up is worth it for your stage — text the actual constraint and I'll send back which way I'd lean. Operator opinion, not legal advice. Always confirm specifics with Datadog + your compliance counsel.
Text PJ · 858-461-8054