Which OpenAI products come with a BAA?
OpenAI lists these as HIPAA-eligible with a BAA:
- ChatGPT for Healthcare
- ChatGPT for Enterprise with Regulated Workspace
- ChatGPT FedRAMP
- ChatGPT for Clinicians
- API with Modified Retention
- API FedRAMP with Modified Retention
Even inside those products, OpenAI lists features that aren’t covered by the BAA, such as improved memory, and says PHI shouldn’t be entered when using them. Self-serve ChatGPT Business isn’t on the list; OpenAI says BAAs need a contracted offering. Anthropic lists a “HIPAA-ready offering” on its Enterprise plan.
What HIPAA requires when a vendor touches PHI
- A business associate agreementA covered entity needs a BAA with any vendor that creates, receives, maintains or transmits PHI on its behalf.
- Minimum necessaryUse and disclose only the PHI needed for the task.
- Access controlsUnique user logins and role-based access.
- Audit controlsRecords of who accessed what.
- Encryption and transmission securityProtect PHI at rest and in transit.
- A risk analysisDocumented, and updated when you add a new tool.
Does running AI on-site remove HIPAA obligations?
No. Keeping PHI on your own hardware means no AI vendor receives it, which avoids one business-associate relationship. The Security Rule’s safeguards still apply to your own systems, and anyone else who can access PHI on them, such as an IT provider with remote access, may be a business associate too.
AdminOnsite is built for law, accounting and insurance offices. We don’t market it as a HIPAA product, and nothing on this page is a compliance claim.
What about de-identified data?
Data de-identified under HIPAA’s Safe Harbor or Expert Determination methods isn’t PHI. Truly de-identifying free-text notes is harder than it looks, because names, dates and small details can identify a person. HHS publishes guidance on both methods.
Questions
Is ChatGPT HIPAA compliant?
Consumer ChatGPT plans aren’t covered by a BAA. OpenAI offers BAAs for specific products, including ChatGPT for Healthcare and ChatGPT Enterprise with a Regulated Workspace, and only for listed features.
Is ChatGPT Business HIPAA compliant?
OpenAI says self-serve Business customers who need BAAs should use a contracted offering instead.
Is Claude HIPAA compliant?
Anthropic lists a HIPAA-ready offering as part of its Enterprise plan. Check the current terms with Anthropic.
Can a HIPAA-covered office use AI at all?
Yes, with a BAA from any vendor that handles PHI, the safeguards above, and policies on what goes in.
Is AdminOnsite HIPAA compliant?
We don’t make that claim. AdminOnsite is designed for law, accounting and insurance offices.