Is ChatGPT or Claude HIPAA Compliant? Which Tools Sign a BAA

A signed business associate agreement (BAA) is the starting line, not the finish. Each BAA covers one organization and named products, and both vendors exclude some features even on covered plans. Claude has a third covered route, Claude in Microsoft Foundry with its HIPAA configuration enabled. Personal accounts and the mid-tier team plans (ChatGPT Business, Claude Team) are never covered, so keep patient information out of them.

We read each vendor's own pages in September 2026. We rechecked OpenAI's BAA terms, its HIPAA Implementation and Configuration Guide and its API data controls, Anthropic's help center and API documentation, and Microsoft's Copilot terms, on November 7, 2026; Google's pages were last checked on October 10, 2026. The regulatory text comes from the Code of Federal Regulations as published on eCFR. This is general information, not legal advice. For what AI tools do with ordinary business data, see our AI data privacy questions for small business; this post covers patient data only.

Why does HIPAA require a BAA before an AI tool sees PHI?

Because the Privacy Rule says so. Under 45 CFR 164.502(e), a covered entity may let a business associate create, receive, maintain or transmit protected health information on its behalf only after obtaining satisfactory assurance that the business associate will safeguard it, and that assurance must be documented in a written contract that meets 45 CFR 164.504(e). That contract has to establish the permitted uses and disclosures, require appropriate safeguards and Security Rule compliance for electronic PHI, require reports of any non-permitted use or disclosure including breaches of unsecured PHI, flow the same restrictions down to subcontractors, and make the vendor's practices available to the Secretary. An AI vendor that receives a patient's details in a prompt is doing exactly what that paragraph describes, which is why the vendor's willingness to sign, and the exact product the signature covers, decide the question before any security feature does.

Which AI tools will sign a BAA?

OpenAI, Anthropic and Microsoft rows checked on November 7, 2026; Google rows checked on October 10, 2026. Sources are listed at the end of this post.

Will OpenAI sign a BAA for ChatGPT?

For some products, and not for the one most small practices buy first. OpenAI's help center article on getting a BAA with OpenAI says it does not offer a BAA for ChatGPT Business, and that a sales-managed ChatGPT Enterprise or Edu account gets one through sales. OpenAI's HIPAA Implementation and Configuration Guide (PDF, posted July 9, 2026), which forms part of its BAA, names the ChatGPT services the BAA can cover: ChatGPT for Healthcare, ChatGPT for Clinicians, and ChatGPT Enterprise or Education with the Regulated Workspace, plus any other service the BAA itself names. It states that consumer ChatGPT (Free, Plus, Pro) and ChatGPT Business are not eligible. OpenAI's list of HIPAA-eligible products and functionality adds ChatGPT FedRAMP and the API offerings with Modified Retention, and says a feature is covered only when it is used from an eligible workspace and enabled for the member's role. All of this was checked on November 7, 2026.

The guide also sets the limits. Early access features are not covered. Codex in the cloud is excluded outright, and Codex on a local machine is covered only after OpenAI marks it HIPAA-eligible in the workspace settings. Connectors, MCP servers and other third-party tools stay outside the BAA. The practice must manage access through single sign-on, may not put PHI in user names, email addresses, the workspace name or support tickets, and remains responsible for device encryption, monitoring of staff use and its own backups.

On the API, the same guide says PHI may go only through an organization whose BAA names the OpenAI API Services, and each organization ID and project must have a Modified Retention feature activated. OpenAI's developer documentation on data controls adds the retention mechanics: API data has not been used for training since March 1, 2023 unless a customer opts in, abuse-monitoring logs are kept for up to 30 days by default, Zero Data Retention and Modified Abuse Monitoring require OpenAI's prior approval, and Web Search with live internet access is not HIPAA eligible. OpenAI's Business Associate and Healthcare Addendum (PDF) was still posted on November 7, 2026. One structural point for planning: the BAA reaches the API only if it names the API Services, so a BAA arranged for a ChatGPT workspace does not automatically cover API work, or the reverse.

Can Claude be used with patient data?

Yes, on three Anthropic products and only after the BAA is in place: Claude Enterprise, the first-party Claude API, and Claude in Microsoft Foundry with its HIPAA configuration enabled. Anthropic's help center article on BAAs, read October 17, 2026, says its BAA covers those HIPAA-ready services and covers only the single organization that accepted it. Everything else in the Claude line, including the personal plans and Claude Team, is outside.

Which Anthropic products offer a BAA?

• Claude Enterprise. Anthropic's HIPAA-ready Enterprise plans article says the feature is available for Enterprise plans only, both self-serve and sales-assisted. The Primary Owner opens Organization settings, Data and privacy, HIPAA Compliance, downloads the BAA and the Implementation Guide and clicks Enable. Anthropic calls it a one-way decision; the self-serve BAA cannot be modified, and enabling it resets certain settings to their defaults. As of October 2026 Enterprise is $20 per seat per month billed annually with a 20-seat minimum self-serve (50 seats sales-assisted), with usage billed at API rates.
• The Claude API (Claude Platform). Per Anthropic's API data retention documentation, an administrator enables HIPAA readiness in the Console's privacy settings with the standard BAA, or contacts sales for a negotiated one. Once enabled it is permanent, it applies to the whole organization, and the API returns an error for features that are not eligible, so Anthropic suggests a separate organization for non-HIPAA work.
• Claude in Microsoft Foundry. Covered when the Foundry HIPAA configuration is enabled. Third-party cloud purchases such as Vertex AI are outside Anthropic's BAA.

What does Anthropic's BAA exclude?

Coverage is decided feature by feature, and the exclusions are where practices get caught. On Enterprise, the BAA covers chat, projects, artifacts in chat, file creation and code execution without network access, voice, web search and research. It does not cover the Claude Console, Cowork in the cloud, Claude Code cloud sessions, or beta features such as Claude in Office, Claude Design, Claude Slides and Claude Docs, and even where they are available it excludes MCP connectors and any other connector, Enterprise Search, Claude in Chrome and Skills, because data sent to third parties falls outside the BAA. On the API, Batch, Files, Skills, Code Execution, Computer Use and Web Fetch are not covered, while the Messages API with prompt caching, structured outputs, memory, web search and the bash and text editor tools is. Several Enterprise features are covered only under BAA versions accepted after December 2, 2025, and some API features only under versions accepted after April 1, 2026, so a practice with an older agreement should check its version before assuming coverage.

What changes when the HIPAA configuration is applied?

Claude Cowork and Claude Code are covered only after the Primary Owner also applies Anthropic's HIPAA configuration to them, and Claude Code must connect directly to Anthropic rather than through a cloud provider or gateway. Once applied, cloud features (Claude Code cloud sessions, Remote Control, Cowork in the cloud) are unavailable and the configuration cannot be removed. The configuration also turns off Skills, user-created skills and group sharing. Two more operational points: Anthropic's Fable and Mythos models, which it calls Covered Models, require 30-day retention and cannot run in a zero-data-retention organization, and a HIPAA-ready or customer-managed-key Enterprise organization cannot receive data from a personal account during migration, so staff who built up personal Claude history cannot bring it along.

Claude Team, Pro and Max

Team, Free, Pro, Max and Ultra cannot enable HIPAA, full stop. Team is the natural first workspace for a small practice's non-clinical work (2 to 150 seats, $20 per standard seat per month billed annually or $25 monthly as of October 2026), and that is fine as long as the policy keeps PHI out of it. Our comparison of Claude Team vs Enterprise covers the rest of the difference.

The product-and-BAA boundary: the same test for ChatGPT and Claude

The logic is identical for both vendors, and it is a checklist, not a feeling:

1. Is this exact product on the vendor's eligible list? ChatGPT Business and Claude Team are not; ChatGPT for Healthcare, ChatGPT Enterprise with Regulated Workspace and Claude Enterprise are.
2. Is the BAA executed or enabled for this organization? A plan that could be covered is not covered until the Primary Owner or a signed contract makes it so, and the agreement covers one organization, not your whole company.
3. Is every feature you plan to use inside the BAA? Web search, memory, cloud agents, code execution and browser access are each covered on some products and excluded on others. Read the vendor's exclusion list against your workflow.
4. Where does the data go next? Anything that leaves the vendor through a connector, an app or an action to a third party is outside the agreement on both platforms.
5. Has the configuration been applied and written down? HIPAA mode enabled, retention set, single sign-on on, excluded features off, personal accounts blocked, and the whole arrangement recorded in your risk analysis.

Is Microsoft 365 Copilot covered by Microsoft's BAA?

Yes, with exceptions. Microsoft lists Microsoft 365 Copilot and Copilot Chat among the services covered by its HIPAA BAA. Its enterprise data protection page, checked on November 7, 2026, says they support HIPAA compliance for properly configured implementations, but web search queries sent to Bing are not covered by the Data Protection Addendum or the BAA. Microsoft also says Anthropic models with Data Retention run under Anthropic's own terms rather than Microsoft's, and stay off until an administrator opts in. Copilot works within each user's existing permissions, so oversharing in SharePoint becomes a Copilot problem; our Microsoft 365 HIPAA settings guide covers the tenant side.

Rules to give staff who handle PHI

1. Use only AI tools the practice has approved, signed in with a work account covered by a BAA.
2. Never paste patient details into a personal account, a browser extension, an unapproved connector or app, or a third-party GPT or plugin.
3. Check every output. Both vendors put accuracy on the customer; keep clinical, billing and coding decisions with the licensed people responsible for them.
4. Before using a tool without a BAA, remove all 18 identifiers listed in 45 CFR 164.514(b)(2), often called the safe harbor method.
5. Pick one tool and plan covered by a BAA, accept or sign the BAA, configure it (single sign-on, excluded features off, personal accounts blocked for PHI roles), train on real examples, and record the tool, its BAA and its data flow in your risk analysis before go-live.

What NetSys does

Our AI security assessment reviews the AI tools in use, the permissions behind them and how data is handled, then checks each product against the vendor's BAA scope so the approved list matches the paperwork. We help you settle on that list and log each vendor's BAA with the rest of your HIPAA compliance program. If a vendor will not sign, read what to do when a vendor refuses a BAA. Practices weighing AI phone answering can start with our AI receptionist for medical offices, and Google Workspace users can check how Gemini fits Google's BAA. To have an engineer review an AI healthcare workflow before it touches patient data, book a call.

Frequently asked questions

What AI is HIPAA compliant?

No AI tool is HIPAA compliant on its own. As of November 7, 2026, the mainstream options that can hold PHI under a signed BAA are OpenAI's HIPAA-eligible ChatGPT products (ChatGPT for Healthcare, ChatGPT for Clinicians, Enterprise or Edu with Regulated Workspace) and the OpenAI API with Modified Retention, Claude Enterprise with HIPAA enabled and the Claude API with HIPAA readiness on, Microsoft 365 Copilot and Copilot Chat under Microsoft's BAA, and Gemini in Google Workspace under Google's BAA. Each needs the right plan, the BAA in place and the excluded features turned off.

Is ChatGPT Plus or ChatGPT Business HIPAA compliant?

No. ChatGPT Plus is a personal plan with no BAA and training on by default. ChatGPT Business, the renamed Team plan, has no BAA either: OpenAI's help center says it does not offer one for Business. A practice that wants ChatGPT near patient information needs one of OpenAI's HIPAA-eligible products, such as ChatGPT for Healthcare or ChatGPT Enterprise with Regulated Workspace, or an API organization whose BAA names the API.

Is Claude HIPAA compliant?

Claude can be used with PHI only under Anthropic's BAA, on an Enterprise organization whose Primary Owner has enabled HIPAA, on an API organization with HIPAA readiness turned on, or in Microsoft Foundry with its HIPAA configuration. Team and the individual plans cannot enable HIPAA. Claude Code and Cowork also need Anthropic's HIPAA configuration, and cloud features such as Cowork in the cloud stay outside the BAA.

Can I use Claude Team or Claude Pro with patient data?

No. Anthropic says Team, Free, Pro, Max and Ultra cannot enable HIPAA, so no BAA covers what staff type into them. Use Team for non-clinical work if you like, write that limit into your policy, and move PHI workflows to an Enterprise organization with HIPAA enabled or to the API.

Does Anthropic's BAA cover MCP connectors, Claude Code and Cowork?

Connectors, no: Anthropic says data sent to third parties through MCP connectors falls outside the BAA, along with Enterprise Search, Claude in Chrome and Skills. Claude Code and Cowork, yes, but only after the Primary Owner applies the HIPAA configuration, which limits them to local mode and turns off cloud sessions; that configuration cannot be removed later.

Can staff use AI tools with de-identified patient data?

Yes, if the data is truly de-identified. HIPAA allows two methods: an expert determination, or removing all 18 identifiers in 45 CFR 164.514(b)(2), from names and dates to device serial numbers and IP addresses, with no actual knowledge that what remains could identify the patient. Deleting names alone does not qualify.

Does a BAA make AI answers safe for patient care?

No. A BAA covers how the vendor protects PHI, not whether the output is right. Both vendors leave accuracy with the customer. Keep a licensed person responsible for anything an AI tool drafts for a chart, a claim or a patient.

Who handles it if PHI goes into an unapproved AI tool?

Your privacy or security officer, working with your IT provider. Treat it as a possible impermissible disclosure: under 45 CFR 164.402 it is presumed to be a breach unless a documented risk assessment shows a low probability of compromise. Record what was entered and where, ask the vendor about deletion, and decide on notification with counsel.

Sources (checked September to November 2026)

• OpenAI HIPAA Implementation and Configuration Guide (PDF, posted July 9, 2026): eligible ChatGPT services, API requirements and exclusions, checked on November 7, 2026.
• Getting a Business Associate Agreement with OpenAI and HIPAA-eligible products and functionality, OpenAI Help Center, checked on November 7, 2026.
• Data controls in the OpenAI platform, OpenAI developer documentation, checked on November 7, 2026.
• OpenAI Business Associate and Healthcare Addendum (PDF), still posted when checked on November 7, 2026.
• OpenAI enterprise privacy: training defaults and retention for Business, Enterprise and the API, read October 17, 2026.
• Business Associate Agreements (BAA) for Commercial Customers and HIPAA-ready Enterprise plans, Claude Help Center, checked on November 7, 2026.
• API and data retention, Anthropic, checked on November 7, 2026, and Covered Models under a BAA, read October 17, 2026.
• 45 CFR 164.502 and 45 CFR 164.504, eCFR, read October 17, 2026.
• Microsoft HIPAA and HITECH Act offering, Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat and Claude models from Anthropic in Microsoft Online Services, Microsoft Learn, checked on November 7, 2026.
• HIPAA compliance on Google Cloud and Google Workspace, Google's list of Workspace services covered by its BAA, including Gemini, checked October 10, 2026.