Which AI Tools Sign a HIPAA BAA? ChatGPT, Claude, Gemini, Copilot and AWS Bedrock (2026)

A clinic manager wants to paste visit notes into ChatGPT to draft patient letters. A health-tech founder wants Claude to summarize intake forms. Somebody asks the obvious question: "Is it HIPAA compliant?" That's the wrong question. The right one is narrower. Will this vendor sign a business associate agreement, on the plan we actually pay for, covering the feature we actually use?

This page answers that for the five vendors most US teams ask about: OpenAI, Anthropic, Google, Microsoft and AWS. Every row comes from the vendor's own BAA or HIPAA page. The definition of a BAA comes from HHS. Where a vendor's page doesn't say something, neither do I.

What is a HIPAA BAA, and when do you need one?

A BAA is the written contract HIPAA requires before a vendor handles protected health information (PHI) for a covered entity or its business associate. HHS calls it the "satisfactory assurances" that the vendor "will appropriately safeguard the information." If your AI vendor creates, receives, stores or transmits PHI for you, you need one first.

HIPAA's covered entities are health plans, health care clearinghouses and health care providers that bill electronically. A business associate is anyone who handles PHI on their behalf. So is any subcontractor of that business associate. If you build software for clinics, you are probably a business associate, and the AI API you call is your subcontractor.

HHS now uses an AI tool as its own example. Its business associates page lists a "Third-party vendor Artificial Intelligence (AI) chatbot on a provider's patient portal that provides services involving the patient's PHI such as symptom assessment, medical reminders, and appointment scheduling."

What goes in the contract? HHS publishes sample provisions. In short, the vendor agrees to:

• use or disclose PHI only as the agreement allows or the law requires
• use appropriate safeguards, including the HIPAA Security Rule for electronic PHI
• report any use or disclosure outside the agreement, breaches of unsecured PHI and security incidents
• bind its own subcontractors to the same terms
• return or destroy the PHI when the agreement ends, where feasible

Two more HHS points matter for AI tools. Encryption doesn't get a vendor out of it: HHS's cloud computing guidance says a cloud provider is a business associate "even if the CSP processes or stores only encrypted ePHI and lacks an encryption key." And HHS picks no winners: "OCR does not endorse, certify, or recommend specific technology or products." Nobody can sell you a HIPAA certificate.

Which AI tools will sign a BAA, and on which plans?

All five sign, on business plans only. OpenAI and Anthropic draw the line at the enterprise tier for their chat apps but sign for their APIs without one. Google and Microsoft attach the BAA to their workplace suites. AWS covers Bedrock in an account under its BAA. Consumer and small-team plans are out everywhere.

The details, vendor by vendor, follow. The fine print is where the risk lives.

OpenAI: API, ChatGPT Enterprise and the healthcare products

OpenAI signs a BAA for its API and for its enterprise and healthcare ChatGPT products. It does not sign one for ChatGPT Business. For the API, the BAA works only once your organization is provisioned with what OpenAI calls Modified Retention. Requests go to baa@openai.com and are reviewed one at a time.

The API. OpenAI's BAA help page says "To use our API platform with PHI, you'll first need a BAA with OpenAI." You email baa@openai.com with your company and use case. OpenAI says it will "respond within 1-2 business days" and reviews "each BAA request on a case-by-case basis." It approves most, "but occasionally a use case doesn't pass." You don't need an enterprise contract: "an enterprise agreement is not required to sign a BAA."

The condition sits on a second page. OpenAI's HIPAA eligible products list says API eligibility "is contingent on Customer's account being provisioned with Modified Retention, unless otherwise specified by OpenAI." It then lists 22 eligible endpoints, including chat completions, responses, embeddings, audio, images, files, fine-tuning and batches.

One tool is a common trip-up. OpenAI's data controls docs state: "Web Search with live internet access is not HIPAA eligible and is not covered by a BAA." A cache-only mode can be covered, but only from a zero data retention project.

ChatGPT. The help page is blunt: "Only ChatGPT Enterprise or Edu customers that have a sales-managed account are eligible for a BAA for ChatGPT at this time. Please note that we don't offer a BAA for ChatGPT Business." The eligible-products list names ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT FedRAMP and ChatGPT for Clinicians.

ChatGPT for Clinicians is the odd one. It's free for verified US clinicians (physicians, nurse practitioners, physician assistants and pharmacists). Each clinician signs their own BAA in ChatGPT under Settings, then Agreements. It covers one person. For more users, OpenAI points you to ChatGPT for Healthcare.

What isn't covered in ChatGPT. OpenAI lists features outside the BAA, including internet access in Canvas and code blocks, browser and network access for cloud Work, event-triggered scheduled tasks, Codex in the cloud and improved memory. It adds: "Features not listed here are not automatically covered." Its Codex HIPAA guide repeats the line for developers: "The BAA doesn't cover Codex cloud. Don't use Codex cloud with PHI."

Anthropic: Claude API and Claude Enterprise

Anthropic signs a BAA for its own API and for Claude Enterprise, once an organization is switched to "HIPAA-ready." Claude Team, Free, Pro and Max can't be. On Enterprise, only the Primary Owner can accept, and the switch is permanent. Claude Code is covered only with zero data retention, and the newest models need 30-day retention.

Anthropic's BAA article says it "provides a BAA covering our HIPAA-ready services, such as use of our first-party API or Enterprise plans." Its HIPAA-ready Enterprise page draws the plan line: "Team plans and individual plans (Free, Pro, and Max) can't enable HIPAA."

How you get it on Enterprise. The Primary Owner goes to Organization settings, then Data and privacy, and clicks "Accept and enable HIPAA." That click is the BAA. No other admin can do it. Anthropic warns that "This is a one-way decision," that enabling resets some settings, and that the self-serve BAA "can't be modified." Buying Enterprise isn't enough: "Standard Claude Enterprise plans do not include BAA coverage without action from a Primary Owner."

How you get it on the API. Anthropic's API docs say eligible organizations can sign the BAA and turn on HIPAA readiness in the Claude Console, or go through sales for a negotiated BAA. The change is permanent. After that, the API blocks features outside the BAA with an error rather than letting them through. The docs also note: "you do not also need ZDR" for PHI on the API.

What's covered, and what isn't. On the API, the Messages API is covered, with prompt caching, structured outputs, memory, web search and the bash and text editor tools. The Batch API, Files API, Skills API, code execution, computer use and web fetch are not, and are blocked. On Enterprise, chat, projects, artifacts, voice, web search, research and skills are covered. Connectors, Claude in Chrome and enterprise search are usable, but data sent to third parties through them isn't covered. Cowork is not covered.

Two strings attached. First, retention. Anthropic designates its newest, most capable models as Covered Models, currently Claude Fable 5 and 5.1 and Mythos 5 and 5.1. They "require 30-day data retention and aren't available with zero data retention (ZDR) enabled." Second, coding agents. Claude Code is covered "only with ZDR enabled" for qualified accounts. Put those together and you get Anthropic's own conclusion: "There's currently no configuration that allows BAA-covered access to Covered Models in Claude Code or Cowork."

Claude through a cloud. Anthropic's HIPAA readiness doesn't extend to Claude on Amazon Bedrock or Google Cloud. Its docs say to refer to "those platforms' compliance documentation," meaning your BAA with AWS or Google. HIPAA readiness "is not available" on Claude Platform on AWS or Microsoft Foundry.

Google Workspace and Gemini

Google covers Gemini in Workspace, the Gemini app (except Gemini in Chrome) and the Gemini Mac app under its Workspace BAA. An administrator has to accept that BAA in the Admin console before any PHI goes in. Third-party add-ons aren't covered. A personal Google account has no Admin console, so there's no way to accept it there.

Google's Workspace HIPAA page puts it plainly: "Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services." The BAA is "made available to customers for electronic acceptance via their Admin console." A super administrator finds it under Account settings, then Legal and compliance.

The covered list is Google's HIPAA Included Functionality page. "As of August 31, 2026," it lists 18 entries. The AI ones are the Gemini app (excluding Gemini in Chrome), the Gemini Mac App and Gemini in Workspace. The rest include Gmail, Drive with Docs, Sheets and Slides, Meet, Chat, Calendar, AppSheet and Apps Script. Google adds that Gmail's "help me write, contextual smart replies, and side-panel features are covered."

Two exclusions are worth printing. "Third-party applications including add-ons are not included." And the BAA terms don't reach Google's "Additional Google Services." Gemini Notebook, which sits next to the Gemini app in Google's product menu, wasn't on the Workspace list I read.

Building on Google Cloud instead? That's a separate Google Cloud BAA. Its product list includes Generative AI on Agent Platform, Gemini Enterprise and Gemini Code Assist. Google says not to use pre-GA (preview) offerings with PHI.

Microsoft 365 Copilot and Azure

Microsoft gives a BAA by default to customers who are covered entities or business associates, through its standard Data Protection Addendum. Microsoft 365 Copilot and Copilot Chat are on the in-scope list. Web search queries are not covered. Neither are the Anthropic models that need data retention. Microsoft lists services, not plan names.

Microsoft's HIPAA page says its BAA "is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA." You don't sign a separate document. You also can't swap in your own: "Microsoft can't use a customer's Business Associate Agreement."

The Office 365 commercial in-scope list includes Microsoft Copilot, Microsoft Copilot Chat, Exchange Online, Teams, SharePoint Online and OneDrive for Business. That's why "is Microsoft 365 Business Premium HIPAA compliant" has no plan-level answer. Microsoft's page names services, not plans. Check that each service you use is on the list.

The web search gap. Microsoft's Copilot data protection page says Copilot and Copilot Chat "support HIPAA compliance for properly configured implementations." Then: "HIPAA compliance doesn't apply to web search queries as they aren't covered by the DPA and Business Associate Agreement (BAA)." Copilot turns your prompt into a short query for Bing. If PHI can end up in that query, web search is a setting to look at.

The Claude-in-Copilot gap. Microsoft now runs Anthropic models inside Copilot. For the newest ones, its subprocessor page says the data "is stored by Anthropic and not subject to your Microsoft Customer Agreement including commitments in the Product Terms and DPA." Microsoft's BAA lives in that DPA. So these models sit outside it. They're off by default; keep them off for PHI workloads unless your counsel says otherwise.

Azure. Microsoft lists "Azure and Azure Government" as in scope and offers the BAA through its Product Terms. The per-service list sits in Microsoft's Azure compliance offerings document on its Service Trust Portal, which I couldn't open. Confirm that Azure OpenAI is on that list for your tenant before you rely on it.

AWS Bedrock

AWS lists Amazon Bedrock and Bedrock AgentCore as HIPAA eligible services. You accept AWS's standard BAA in AWS Artifact, in the console. PHI may go only into services on the eligible list, though the account can run others. Generally available features of a listed service are covered unless AWS notes an exclusion.

AWS's HIPAA FAQ says "AWS has a standard Business Associate Addendum (BAA) we present to customers for signature," managed in AWS Artifact. Its eligible services list, last updated 3 September 2026, has about 170 entries. AI ones include Bedrock, Bedrock AgentCore, Amazon Q Business, SageMaker AI (with exclusions), Comprehend Medical, Transcribe with HealthScribe, and Kiro (excluding Kiro Web).

The rule that matters: "Customers may use any AWS service in an account designated as a HIPAA account, but they should only process, store, and transmit protected health information (PHI) in the HIPAA-eligible services." AWS also covers the SaaS case. If you build on AWS and sell to clinics, you sign a BAA with AWS, and each clinic signs one with you.

Claude on Bedrock follows AWS's BAA, not Anthropic's. For Anthropic's Covered Models, retention has to be on, and Anthropic says the "retained data stays in AWS."

How do you get each BAA signed?

It's a different door at each vendor. Microsoft's is already open in its standard terms. Google and AWS put a click-to-accept in the admin console. Anthropic has a click-to-accept for the Enterprise Primary Owner and the API console. OpenAI reviews API requests by email and ChatGPT deals through sales.

Before anyone clicks accept, do the boring part. Make a list of every AI tool your team uses, on which plan, and which features touch patient data. Then compare it with the vendor's covered list, not the marketing page.

What do these BAAs leave out?

Every vendor's BAA covers a list, not a product. Web search, third-party connectors, beta features and cloud coding agents are the usual gaps. Retention is the other one. OpenAI ties its API BAA to Modified Retention, and Anthropic's newest models require 30-day retention. A covered plan with an uncovered feature switched on is still an exposure.

Notice the pattern. The features that reach outside the vendor, like web search, connectors and browser agents, are the ones that fall outside the BAA. That makes sense. The vendor can't promise how a third party will treat the data. Anthropic and OpenAI both put the burden on you: administrators who enable these features are responsible for how their staff use them.

This is also where your own customers will push. If you sell software to clinics, their security questionnaire will ask which AI vendors see PHI and under what agreement. The answer templates for that tab are in the AI questions enterprise buyers ask. And if the tool you built with is the problem, is your vibe-coding stack SOC 2 ready lists which of those platforms offer a BAA at all.

Is a signed BAA enough to be HIPAA compliant?

No. A BAA makes it permissible to share PHI with the vendor. It doesn't make your setup compliant. Microsoft says using its services "doesn't on its own achieve HIPAA compliance." AWS says "There is no HIPAA certification" for a cloud provider. The rest of HIPAA is still yours.

That rest includes your own risk analysis, access controls, the settings above and staff training. It includes the vendors behind your vendor: OpenAI's Codex guide notes that its BAA "doesn't make another vendor a HIPAA-compliant destination." It also includes the boring paperwork a buyer will ask for. The SOC 2 side of that is in SOC 2 for AI startups, and the questionnaire you'll get first is in your first enterprise customer asked for SOC 2.

If you're choosing between assistants for a team that will never touch PHI, the plan comparison in ChatGPT vs Copilot vs Gemini vs Claude for business is the better starting point.

Every vendor here will sign. None signs for everything. Before patient data goes in, find the vendor's covered-features page, match it to the plan you pay for and the switches you've turned on, and keep a dated copy. More compliance guides for small teams are on the Security & Compliance hub.