Deployment Labs
Deployment NotesAI governance

HIPAA Compliant AI: Which Tools Sign a BAA, and What It Actually Covers

Deployment LabsUpdated 12 min read

There's no such thing as a HIPAA compliant AI tool, only a HIPAA compliant use of one. The vendors that offer business associate agreements cover particular plans, and within those plans particular features. None of them switches it on for you. Even when the agreement is signed, a member of staff who opens a connector, a beta feature or their own personal account has stepped outside it.

What is HIPAA compliant AI?

HIPAA compliant AI means an AI tool used under a signed business associate agreement (BAA) with its vendor, on a plan and with features that agreement covers, for no more patient data than the task needs. The tool alone can't be compliant. Microsoft's own compliance page says there's "currently no certification standard" that the Department of Health and Human Services approves to demonstrate it.

This guide is for operations, IT and compliance leads at healthcare providers, health plans and the firms that work for them. It sets out which AI vendors sign a BAA as of October 2026, what each agreement leaves out, and what to do before patient data goes into a chatbot. It isn't legal advice.

Does HIPAA apply to your organisation?

HIPAA applies to covered entities: health care providers, health plans and health care clearinghouses. It also applies to their business associates. The regulation defines a business associate as a person who "creates, receives, maintains, or transmits protected health information" on behalf of a covered entity. That includes anyone providing "legal, actuarial, accounting, consulting" or management services where the work involves the client's protected health information (PHI).

So three kinds of organisation in our readership are in scope:

  • Providers and health plans, such as clinics, dental and therapy practices, and home-care agencies.
  • Firms that serve them. An accounting firm, law firm or consultancy that receives a healthcare client's PHI to do its work is a business associate.
  • Their vendors. A subcontractor that handles PHI on a business associate's behalf is a business associate too.

The third point is the one that catches AI. When a covered entity or business associate puts PHI into an AI tool, the AI vendor is receiving and maintaining it on their behalf. Microsoft says it plainly: when a covered entity uses a cloud service provider, "the cloud service provider is a business associate under HIPAA."

Employers that sponsor a group health plan have a narrower question. The plan's documents must bind the employer, as plan sponsor, not to use plan information "for employment-related actions and decisions". Keep health plan data out of the AI tools your HR team uses for decisions about people.

Why an AI vendor needs a business associate agreement

Under the Privacy Rule, you may give PHI to a business associate only after you get "satisfactory assurance" that it will safeguard the information. That assurance is a written contract with set contents. Among other things, the vendor must:

  • use and disclose the PHI only as the contract permits;
  • apply the Security Rule's safeguards to electronic PHI;
  • report any use or disclosure the contract doesn't allow, including breaches;
  • bind its own subcontractors to the same terms;
  • return or destroy the PHI when the contract ends, where feasible.

You also have to be able to end the contract if the vendor breaks a material term. Don't expect to send your own template. Microsoft says it can't use a customer's own BAA, and Anthropic and Google offer theirs for acceptance in their admin settings. So the practical question is not "will they sign?" but "what does their standard agreement cover?"

Which AI tools will sign a BAA?

All four of the big platforms offer one, on their business offerings only, and each covers less than the full product.

Where the BAA comes from Offerings it covers Who has to act Left out (examples)
OpenAI (ChatGPT) OpenAI BAA; for the API, a Business Associate and Healthcare Addendum ChatGPT for Healthcare, ChatGPT for Clinicians, Regulated workspaces; eligible API endpoints You agree a BAA with OpenAI, and OpenAI sets up your account Live web search in the API; third-party plugins and apps
Anthropic (Claude) Anthropic BAA, accepted in settings HIPAA-ready services: Claude Enterprise, the first-party API, Claude in Microsoft Foundry Enterprise Primary Owner activates HIPAA and accepts the BAA Connectors, skills, Claude in Chrome, Cowork in the cloud, beta features
Microsoft (Copilot) HIPAA BAA inside the Data Protection Addendum, by default Microsoft Copilot and Copilot Chat, among in-scope Office 365 services Nothing to sign; included by default Personal accounts; Anthropic models "with Data Retention"
Google (Gemini) Google Workspace BAA, accepted in the Admin console Gemini app (not in Chrome), Gemini in Workspace, Gemini Mac app A super administrator accepts it Gemini in Chrome; third-party add-ons

The details differ enough that each one needs its own answer.

Is ChatGPT HIPAA compliant?

Only on the ChatGPT offerings OpenAI covers under a BAA, and personal or standard business accounts aren't among the ones it names. OpenAI's developer documentation says that if you use "ChatGPT for Healthcare, ChatGPT for Clinicians, or a Regulated workspace" and have "an applicable OpenAI Business Associate Agreement", OpenAI handles the PHI it receives consistent with that agreement. For its Codex agent, OpenAI adds that signing in with ChatGPT "requires a HIPAA-eligible account."

For the API, OpenAI's data controls page says customers who have signed its "Business Associate and Healthcare Addendum" can use "BAA-eligible endpoints" for PHI once their organisation is set up for it. Not every feature qualifies. "Web Search with live internet access is not HIPAA eligible and is not covered by a BAA."

OpenAI says Business, Enterprise and Edu workspace data isn't used to train its models by default. That's a privacy setting, not a BAA. A ChatGPT Business workspace that doesn't train on your data still isn't one of the offerings OpenAI names for PHI.

A note on sourcing: OpenAI's help-centre pages, including its list of HIPAA-eligible products, refused our requests while we researched this article. Everything above comes from OpenAI's developer documentation, which links to that list. Ask OpenAI to confirm in writing which plan and features your BAA covers.

Is Claude HIPAA compliant?

Claude is covered on Anthropic's HIPAA-ready services, such as an Enterprise plan or its API, but only after your organisation accepts the BAA, and only for some features. Anthropic says its BAA covers "our HIPAA-ready services, such as use of our first-party API, Claude in Microsoft Foundry, or Enterprise plans." Its pricing page lists the HIPAA-ready offering on Enterprise.

It doesn't switch itself on. "Standard Claude Enterprise plans do not include BAA coverage without action from a Primary Owner," who has to activate HIPAA compliance under "Data and privacy" in the organisation settings and accept the agreement. For the API, the Primary Owner signs the BAA and then asks Anthropic to turn it on. The BAA covers only the one organisation that accepted it.

Inside a HIPAA-enabled Enterprise organisation, Anthropic's coverage table splits the product in two:

  • Covered: chat, projects and artifacts in chat, file creation and code execution (without network access), voice, web search and research.
  • Available but not covered: skills, connectors and MCP servers that send data to third parties, enterprise search, and Claude in Chrome. Skills and Claude in Chrome are off by default in HIPAA organisations; an owner can turn them on.
  • Excluded: the Claude Console, Cowork in the cloud, and beta features such as Claude in Office, Claude Design, Claude Slides and Claude Docs.

That middle list is the trap. A feature can be available to your staff and still sit outside your BAA.

Is Microsoft Copilot HIPAA compliant?

Microsoft lists Microsoft Copilot and Microsoft Copilot Chat among the in-scope services of its HIPAA BAA, and the BAA applies by default to covered entities and business associates on its business cloud. Microsoft says its HIPAA BAA "is available through the Microsoft Online Services Data Protection Addendum by default" to those customers. Copilot and Copilot Chat appear in the list of Office 365 services in scope, alongside Exchange Online, Teams, SharePoint Online and OneDrive for Business.

There's one exception worth checking today. Inside Copilot, Microsoft offers Anthropic's Claude models. For most of them, Anthropic works as Microsoft's subprocessor and Microsoft's Data Protection Addendum applies. Models labelled "Anthropic models with Data Retention", such as Claude Fable 5, are different: their data is stored by Anthropic and is "not subject to your Microsoft Customer Agreement including commitments in the Product Terms and DPA." Because Microsoft's BAA comes through that addendum, our reading is that those models fall outside it. They're off by default, and an admin has to opt in. Keep them off for anyone who handles PHI. Our Claude vs Copilot comparison explains the setting.

Microsoft is also clear about what the agreement doesn't do: "using Microsoft services doesn't on its own achieve HIPAA compliance."

Is Gemini HIPAA compliant?

Google covers the Gemini app and Gemini in Google Workspace under its Workspace BAA, once a super administrator has accepted it. Google's list of Workspace services in its BAA includes the "Gemini App (excluding Gemini in Google Chrome)", "Gemini in Google Workspace" and the Gemini Mac app, along with Gmail, Drive, Meet and Chat.

The agreement is accepted in the Admin console, under Account settings, then Legal and compliance. Until then, Google's instruction is blunt: customers who haven't signed a BAA "must not use PHI in Google Workspace." Third-party apps and add-ons aren't covered, and the BAA doesn't extend to Google services outside the covered list.

Fig. 1A BAA covers features, not the whole product. Claude Enterprise with HIPAA enabled, as of October 2026: staff can still use some features the agreement doesn't cover. Source: Anthropic Privacy Center.

What patient data can go into an AI tool?

A signed BAA lets PHI in. It doesn't make every use reasonable. Two rules decide how much should go in.

Use the minimum necessary. You must "make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose." Pasting a whole chart to draft a referral letter fails that test. The rule doesn't apply to disclosures to a provider for treatment, but it applies to most administrative work, which is where AI tools get used most.

Or de-identify it properly. Health information that's de-identified under HIPAA isn't PHI, so the BAA question falls away. There are two ways to get there:

  • Safe Harbor: remove 18 kinds of identifiers, for the patient and for their relatives, employers and household members. They include names, any address detail smaller than a state (with a narrow exception for the first three digits of a zip code), every element of a date about the patient except the year (such as birth, admission and discharge dates), phone numbers, email addresses, medical record and account numbers, and full-face photographs. You must also have no actual knowledge that what's left could identify someone.
  • Expert determination: a qualified expert applies statistical methods, finds the risk of identifying someone is "very small", and documents how.

Removing names isn't de-identification. A discharge summary with a date of admission, a town and a rare diagnosis is still PHI.

Finally, any new AI tool belongs in your risk analysis. The Security Rule requires "an accurate and thorough assessment of the potential risks and vulnerabilities" to electronic PHI, and a chatbot that staff paste records into is a new place that PHI lives.

Fig. 2Three checks before PHI goes into an AI tool. A personal account fails the first, a connector to another system fails the second, and a whole chart pasted in to draft one letter fails the third. Sources: 45 CFR 164.502 and the vendors' BAA pages.

Where teams get caught

The common failures aren't about the vendor. They're about the distance between the contract and the way people work:

  • Personal accounts. A clinician or billing lead uses their own ChatGPT or Claude account because the company one is slower to get. Every BAA above belongs to an organisation's account. Anthropic's covers "the single organization that accepted it", Google's is accepted by a Workspace administrator, and Microsoft's comes with its business Data Protection Addendum. A personal account sits outside all of them.
  • The right vendor, the wrong plan. A practice on a business plan assumes the vendor's BAA applies to it. For OpenAI and Anthropic, it's specific offerings and a step someone has to take.
  • The right plan, the wrong feature. A covered workspace with a connector to a third-party system, a browser extension or a beta feature turned on. Each vendor's BAA stops at its own covered services.
  • Agreements nobody accepted. On Anthropic and Google, an administrator accepts the BAA in settings. If nobody has, there's no BAA, whatever the plan.

All four are list problems. You can't check a BAA against tools you don't know about. Our framework starts with guardrails for exactly this reason: an approved-tools list and a data map that says which data may go where. Approved tools, in module 2 of our free course, sets out how to name the tools people may use and for what. Data map, in the same module, sorts your data into classes so that "PHI only in the covered workspace" becomes a rule people can follow. The AI usage policy generator writes the staff rule for you.

How to make your AI use HIPAA compliant

There are five steps, in order. Each one gives the next what it needs.

01 · List every AI tool that might touch PHI

Include personal accounts, browser extensions, AI features inside your practice-management or billing software, and transcription tools. The free Shadow AI Audit covers the built-in features most lists miss. The output is a list with an owner on every row.

02 · Check each tool against its vendor's BAA

For each tool, record three things: whether a BAA is in place, which plan it covers, and which of the features your staff use are covered. Use the vendor's own coverage page, not its marketing. Where the answer isn't in writing, as with OpenAI's plan list at the time we checked, ask the vendor and keep the reply.

03 · Switch the agreement on, and the rest off

Accept the BAA where it's done in settings: Anthropic's Primary Owner, Google's super administrator. Then turn off the features the BAA doesn't cover for the people who handle PHI: connectors, browser extensions, beta features and, in Copilot, Anthropic models with Data Retention.

04 · Write the rule for staff

One sentence does most of the work: PHI goes only into the covered workspace, never into a personal account, and only as much as the task needs. Add what de-identified means, so nobody thinks removing a name is enough. Then add your AI tools to your risk analysis.

05 · Close the gaps and recheck

Move the people using personal accounts onto the covered workspace, then close the personal accounts for work use. Vendors change their coverage lists often (Anthropic's page was updated the week we checked it), so put a review date on every row of your list. If you'd like help with the whole job, our AI governance work starts here.

What's still open

  • OpenAI's plan list. We couldn't read OpenAI's help-centre list of HIPAA-eligible products. We'll add it when we can.
  • Beta features. Anthropic excludes its beta features from the BAA. They may be added as they leave beta, or not.
  • Agents. Agent features that act across systems are spreading faster than vendors' coverage tables. Assume a new agent feature isn't covered until the vendor's BAA page says it is.

We'll update this article when any vendor's coverage changes. The date at the top of the page shows when we last checked.

Sources

Questions

Common questions

Start with step one

Find the AI your staff already use with patient data.

The free Shadow AI Audit builds a list of every AI tool in use, including personal accounts and the AI features switched on inside software you already pay for. That list is where your BAA check starts. The score isn't gated.

Run the Shadow AI AuditWrite your AI usage policy