Is ChatGPT HIPAA compliant?
Checked 6 Nov 2026 from 3 vendor sources
OpenAI offers a BAA for sales-managed ChatGPT Enterprise and Edu, ChatGPT for Healthcare, ChatGPT for Clinicians and the API, and says consumer plans and ChatGPT Business are not covered. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Free | Not covered |
| Plus | Not covered |
| Pro | Not covered |
| ChatGPT Business | Not covered |
| ChatGPT for Healthcare | Covered |
| ChatGPT for Clinicians (eligible individual clinicians, in-product BAA) | Covered |
| ChatGPT Enterprise and Edu with the Regulated Workspace (sales-managed) | Covered |
| OpenAI API (eligible organizations) | Covered |
What the BAA leaves out
- Early access features
- Codex Cloud, including Codex through ChatGPT Enterprise on web or apps
- Third-party services, connectors and MCP servers (stated in the Codex Local section of the guide)
- API traffic outside listed HIPAA endpoints or outside Org IDs and Projects with Modified Retention active
How to get the BAA
For ChatGPT Enterprise or Edu contact OpenAI sales; for the API an eligible admin accepts it under Settings, Organization, General, HIPAA compliance support, or emails [email protected] if shown as not eligible; ChatGPT for Clinicians uses an in-product flow.
What the vendor says to do
- Have a BAA in place before using PHI
- Configure SSO and access management
- Keep PHI out of support requests, profile names, emails, and workspace names and images
- Do not create accounts for patients, plan members, their families or employers
- Do not use the service to maintain a designated record set
- Confirm invited users belong to the organization and may access PHI
- Enable sharing only if all workspace members may access any shared PHI
- Delete PHI no longer needed using self-service tools
- For the API, activate Modified Retention for each Org ID and Project handling PHI and send PHI only through HIPAA endpoints
Proof from the vendor
- OpenAI help article 8660679 on BAAsAPI self-serve BAA, Enterprise and Edu through sales, Clinicians in-product flow, no BAA for ChatGPT Business
- HIPAA Implementation and Configuration Guide (July 9, 2026)Covered and non-covered ChatGPT offerings, configuration requirements, Codex limits, early access exclusion
- Introducing OpenAI for HealthcareBAA listed as an option for ChatGPT for Healthcare, API BAA for eligible customers
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.