Best HIPAA compliant AI assistants
6 tools compared. Checked 6 Nov 2026.
Pasting a patient’s details into an AI chat sends them to the vendor. Consumer plans are usually outside any BAA, even when the same company offers one on business plans.
Where to start
Start with the company you already have a BAA with. On Google Workspace, look at Gemini. On Office 365, look at Copilot. Otherwise compare ChatGPT and Claude on their Enterprise offerings. Consumer plans of these tools aren’t covered.
| Tool | Result | Where the BAA applies |
|---|---|---|
| CChatGPT | On some plans | Enterprise, Edu, Healthcare, Clinicians, API |
| CClaude | On some plans | Enterprise with HIPAA on, and first-party API |
| GGoogle Gemini | On some plans | Through a Workspace or Google Cloud BAA |
| MMicrosoft Copilot | On some plans | Organization licenses, Commercial or GCC |
| NNotebookLM | On some plans | Enterprise on Google Cloud, not in Workspace |
| OOpenEvidence | Not clear | Vendor’s pages disagree; confirm in writing |
ChatGPT
On some plansOpenAI offers a BAA for sales-managed ChatGPT Enterprise and Edu, ChatGPT for Healthcare, ChatGPT for Clinicians and the API, and says consumer plans and ChatGPT Business are not covered.
Covered: ChatGPT for Healthcare; ChatGPT for Clinicians (eligible individual clinicians, in-product BAA); ChatGPT Enterprise and Edu with the Regulated Workspace (sales-managed); OpenAI API (eligible organizations).
Left out: Early access features, and more.
See the full ChatGPT result and proofClaude
On some plansAnthropic offers a click-to-accept BAA on Claude Enterprise once HIPAA is activated and a signed BAA for its first-party API, and says Team and individual plans cannot enable HIPAA.
Covered: Claude Enterprise with HIPAA activated; First-party Claude API with a signed BAA.
Left out: Claude Console, and more.
See the full Claude result and proofGoogle Gemini
On some plansGoogle lists the Gemini app as a Workspace core service and Gemini in Workspace as included functionality under its Workspace BAA, and lists Gemini Enterprise under its Google Cloud BAA, but excludes Gemini in Chrome.
Covered: Gemini app as a Google Workspace core service, and the Gemini Mac App, with Workspace BAA accepted; Gemini in Google Workspace apps, with Workspace BAA accepted; Gemini Enterprise and related Gemini services on Google Cloud, under the Google Cloud BAA.
Left out: Gemini in Chrome, and more.
See the full Google Gemini result and proofMicrosoft Copilot
On some plansMicrosoft includes its BAA by default in the Online Services Data Protection Addendum for covered entities and business associates, and lists Microsoft Copilot and Copilot Chat as in scope for organizational use, excluding web search queries.
Covered: Microsoft Copilot licensed by an organization (Commercial and GCC Office 365 environments); Microsoft Copilot Chat for organizations signed in with Microsoft Entra accounts (Commercial and GCC).
Left out: Web search queries, which Microsoft says are outside the DPA and BAA, and more.
See the full Microsoft Copilot result and proofNotebookLM
On some plansGoogle says Gemini Notebook, formerly NotebookLM, is not covered by its BAA in Workspace, while the separate Gemini Notebook Enterprise on Google Cloud appears on its list of HIPAA-supported Cloud services.
Covered: Gemini Notebook Enterprise on Google Cloud, under the Google Cloud BAA.
Left out: Gemini Notebook in Workspace is outside the BAA even though it is a Workspace core service.
See the full NotebookLM result and proofOpenEvidence
Not clearOpenEvidence’s May 6, 2025 terms, announcement and security page say covered entities’ PHI is handled under its BAA, but an undated copy of its terms says inputs are not HIPAA-covered. Confirm directly.
Covered: US covered entities that choose to enter PHI, under the Terms of Use.
Left out: Public share links may be used only for conversations without PHI.
See the full OpenEvidence result and proofBefore you choose
- Confirm the BAA covers your exact plan and every feature you’ll use.
- Get the BAA signed before any patient data goes in.
- Turn on the settings the vendor requires, and train your staff on them.
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm before you sign. PHI means protected health information, which includes patient data.