HIPAA compliant AI: what it takes and which plans qualify

Search for HIPAA compliant AI and you get lists of tools with a badge next to each name. None of those badges comes from the government. HHS and its Office for Civil Rights certify no product, and HIPAA puts its duties on the practice and on each vendor that handles patient data for it.

The useful question is narrower: which plan will the vendor sign a business associate agreement for, and what does the practice still owe once it has one? This page answers both for OpenAI, Anthropic, Google and Microsoft. What a front desk actually pastes is on our page for medical practices.

Is ChatGPT HIPAA compliant? How HHS treats an AI vendor

HHS has never answered that question for any product, and says it won’t. In its cloud computing guidance, OCR is asked which cloud services are HIPAA compliant and replies that it does not endorse, certify or recommend specific technology. I read a vendor’s HIPAA page as a description of its contract, nothing more.

The same guidance settles the vendor’s status. A service that creates, receives or maintains electronic PHI for a practice is a business associate, even when the data is encrypted and the vendor holds no key. The conduit exception covers transmission only, the way a mail carrier works. A chatbot that keeps your history is storing.

Using such a vendor without a BAA is, in OCR’s words, a violation of 45 CFR 164.308(b)(1) and 164.502(e). If staff already pasted a chart into a personal account, log it as a security incident today. Clearing that ChatGPT history is one step of the response, never the whole of it.

Business associate agreement requirements under 45 CFR 164.504(e)

Section 164.502(e) lets a practice hand PHI to a business associate once it has satisfactory assurance that the vendor will safeguard it, and requires that assurance in writing. Section 164.504(e)(2) lists what the contract must contain. Any AI vendor’s standard BAA should carry each item.

Two items deserve a slower read with AI. Subcontractors: a model provider may run on another company’s cloud, and the same restrictions have to travel down that chain. Return or destruction: chat history, memory and logs are what must go when the contract ends, or stay protected if they can’t.

Who clicks Accept matters as much as the text. OpenAI asks the API admin to confirm authority to accept for the organization; at Anthropic only the Enterprise Primary Owner can. The name in that field should be the privacy officer’s, or someone the privacy officer signed off on.

A BAA answers HIPAA only. Retention, state privacy terms and subprocessor lists belong to vetting the vendor under US privacy law, a separate check.

HIPAA compliant AI tools: which plans come with a BAA

Each row below comes from the vendor’s own HIPAA documentation as it stood on November 7, 2026; the OpenAI rows come from archived copies of its help center from October 2026. Plans get renamed often, so the product on your invoice has to match the vendor’s current list word for word.

The pattern repeats at all four vendors: the business tier small offices buy first, ChatGPT Business or Claude Team, looks covered and isn’t. A practice already paying for one of those shouldn’t put a single referral into it while the upgrade is pending.

What the BAA leaves out: features to switch off before PHI goes in

Signing covers a list of features, not the whole window. OpenAI says a feature being available doesn’t by itself mean the BAA covers it, and anything missing from its covered list isn’t covered by default. The others make the same point in their own words.

Web search shows how far vendors differ on one button. OpenAI says its HIPAA eligible workspaces search its own index and send no queries to third parties such as Bing. Microsoft says Copilot’s web search queries fall outside its DPA and its BAA alike.

Memory is the row that worries me most: it carries details from one chat into the next, and sooner or later someone switches it on for a good reason. OpenAI also warns that new features may not appear on its page yet, so the list needs a quarterly look.

Software a practice builds on a model API can enforce the same rule in code, with a gateway that strips personal data before each request.

Security Rule risk analysis for an AI tool

Section 164.308(a)(1)(ii)(A) requires an accurate and thorough assessment of the risks to the ePHI a practice holds, and it is marked Required, not addressable. A new AI tool is a new place ePHI lives, so it gets its own entry. OCR expects the practice to understand the vendor’s environment well enough to assess it.

Data location belongs in that entry. HIPAA allows ePHI stored outside the United States under a BAA, but OCR says the risk can vary greatly by location and belongs in the analysis. Keep the entry, the BAA and the policy for six years from creation or last effective date, under 164.316(b)(2)(i).

To my mind the threats line deserves the most care: a personal account on the same laptop sits closer to the problem than any vendor data center. If a paste goes wrong, 164.404(b) requires notice to patients without unreasonable delay, 60 days from discovery at the latest. Deciding whether it was a breach comes first.

The Security Rule overhaul proposed on January 6, 2025, at 90 FR 898, is still a proposal. The latest Unified Agenda on Reginfo.gov lists it under long-term actions, with a final rule penciled in for July 2027. Cyber insurers often ask sharper questions in the meantime, and what a cyber policy excludes shows why.

Minimum necessary: how much of the chart belongs in a prompt

A BAA makes the disclosure allowed, not unlimited. Under 164.502(b), every use or disclosure of PHI must be limited to the minimum necessary for its purpose. The exception for disclosures to a health care provider for treatment doesn’t reach an AI vendor, which isn’t one.

Section 164.514(d)(3) splits disclosures in two. Routine, recurring ones can follow a standard protocol written once. Everything else gets reviewed individually against written criteria. Drafting prior authorization letters every week is routine, so the practice writes down, once, which details that task needs.

A protocol of five lines per task beats a paragraph about good judgment, because staff can check the five lines and nobody can check judgment. The general version of that list, for any document, is in what personal data to redact.

Minimum necessary isn’t de-identification. A prompt with the name swapped out still carries PHI until all 18 Safe Harbor categories are gone and nothing left points to the patient, which our de-identification guide walks through.

The vocabulary trips people up as well: HIPAA’s de-identified and the anonymized of marketing pages are not the same claim, as deidentified versus anonymized explains.

Can doctors use ChatGPT under HIPAA? A walk for one practice

HIPAA doesn’t ban AI tools and doesn’t name any. It asks for the chain above, in order. The walk below runs it for one tool and one kind of data; run it again for every tool staff open, including the ones nobody approved.

ChatGPT for Clinicians needs its own note. OpenAI offers it free to verified US physicians, nurse practitioners, physician assistants and pharmacists, with a BAA the clinician signs inside the product. The clinician’s old ChatGPT workspace stays one click away in the account switcher, outside that agreement.

OpenAI also tells the clinician not to share PHI unless authorized to sign a BAA for the account. An employed physician may not be the person entitled to sign for the group’s patients. My answer: settle it in the practice’s AI policy by naming the one workspace allowed to hold patient details.

Where HIPAA stops: state health laws and offices outside it

A BAA answers HIPAA and nothing else. Some health data never was PHI, and some offices hold medical records without being covered entities at all. For them the rules come from state law, professional duties or public records statutes, and a vendor’s HIPAA page says nothing about any of those.

The case most practices miss sits inside their own walls: an employee’s FMLA note in the HR file isn’t PHI, yet it is often the most sensitive page in the building.

A BAA on paper, fewer identifiers in each prompt

Everything above is the practice’s job, and no product does it for you, Nonimo included. What Nonimo changes is the size of each disclosure. In the Mac and Windows app, staff select the text and press one key, and the identifiers it recognizes become placeholders on the computer before ChatGPT, Claude or Copilot see anything.

When the reply comes back, the original details return on the same machine. The text is processed on the workstation and never reaches Nonimo, as our security page explains. Placeholders shrink what the vendor receives; they don’t make the text de-identified, and they don’t replace the BAA.

If I ran a practice, the prior authorization desk would get it first: those letters go out every day and carry the most numbers per page. Get the BAA signed for the plan on the invoice, then shrink every disclosure it covers. Nonimo for US offices helps with that second step at the keyboard.

Tiers and word limits are on our pricing page.

Sources

• OpenAI Help Center, HIPAA eligible products and functionality: the eligible products, covered and uncovered features, web search index (read via an Internet Archive copy of October 19, 2026). Its ChatGPT for Clinicians article gives eligibility and the in-product BAA (same archive date).
• OpenAI Help Center, getting a BAA for the OpenAI API: self-serve acceptance, no BAA for ChatGPT Business (read via an Internet Archive copy of October 7, 2026).
• Anthropic Privacy Center, BAAs for commercial customers: covered surfaces and exclusions.
• Claude Help Center, HIPAA-ready Enterprise plans: Primary Owner, irreversible switch, Team and individual plans excluded.
• Google Cloud, HIPAA compliance on Google Cloud and Google Workspace: Workspace services under the BAA, list dated October 28, 2026.
• Google Workspace Admin Help, HIPAA compliance with Google Workspace: no PHI without a signed BAA.
• Microsoft Learn, HIPAA and HITECH offering: BAA by default through the DPA, Copilot Chat in scope.
• Microsoft Learn, enterprise data protection in Copilot: web search queries outside the BAA.
• HHS, guidance on HIPAA and cloud computing: no certification, conduit exception, no BAA as a violation, data abroad (read via an Internet Archive copy of October 23, 2026).
• HHS, minimum necessary requirement: routine protocols and individual review (read via an Internet Archive copy of October 16, 2026).
• eCFR, 45 CFR 164.504 and 164.308: BAA contents, risk analysis, training; 164.502, 164.514(d), 164.316, 164.404 and 164.530 on the same site.
• Reginfo.gov, RIN 0945-AA22: Security Rule proposal, final action July 2027.

Checked on November 7, 2026.