Is Claude HIPAA compliant?
Checked 6 Nov 2026 from 2 vendor sources
Anthropic offers a click-to-accept BAA on Claude Enterprise once HIPAA is activated and a signed BAA for its first-party API, and says Team and individual plans cannot enable HIPAA. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Free | Not covered |
| Pro | Not covered |
| Max | Not covered |
| Ultra | Not covered |
| Team | Not covered |
| Claude Enterprise with HIPAA activated | Covered |
| First-party Claude API with a signed BAA | Covered |
What the BAA leaves out
- Claude Console
- Claude Design, Claude Slides and Claude Docs (beta)
- Connectors, MCP servers, Enterprise Search and Claude in Chrome when data goes to third parties
- Skills and plugins
- Cowork in the cloud, Claude Code cloud sessions and Claude Code in the mobile app
- Claude Code through Bedrock, Google Cloud, Microsoft Foundry or an LLM gateway
- VS Code and JetBrains extensions
- API features Batch, Files, Skills API, Code Execution, Web Fetch and External MCP
How to get the BAA
On Enterprise the Primary Owner accepts the BAA in organization settings; for the API the Primary Owner signs a BAA and then contacts an Anthropic contact or sales to enable it.
What the vendor says to do
- Primary Owner activates HIPAA under Data and privacy in Enterprise organization settings and accepts the BAA
- Primary Owner applies the separate HIPAA configuration before using Claude Code or Cowork in local mode
- Use PHI only in features marked covered in the vendor’s status list
What we couldn’t confirm
Anthropic also names Claude in Microsoft Foundry as covered, but another of its pages says the BAA doesn’t apply to services bought through a third-party cloud provider. If you buy that way, ask Anthropic. Covered models also need 30-day retention rather than zero data retention, and Dispatch and Remote Control are outside the BAA.
Proof from the vendor
- Business Associate Agreements (BAA) for Commercial CustomersCovered and non-covered products and features, how to obtain coverage, configuration
- Claude support article on HIPAA-ready Enterprise plansEnterprise only, Team and individual plans cannot enable HIPAA, click-to-accept BAA, API BAAs signed before Dec 2, 2025 cover API only
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.