Is BastionGPT HIPAA compliant?
BastionGPT includes a BAA on every plan, including the free trial. It takes effect through the terms with no separate signature.
- Maker
- FortaTech Security, LLC d/b/a Bastion Intelligence
- Last checked
- November 11, 2026
Plan by plan
A business associate agreement (BAA) is the contract HIPAA requires before a tool handles patient information.
| Plan | BAA available | Detail |
|---|---|---|
| Free trial | Yes | The pricing page says the BAA applies on every plan, including the free trial. |
| Professional | Yes | BAA included. |
| Professional Plus | Yes | BAA included. A customizable BAA is an add on for practices with 50 or more users. |
| Ultra | Yes | BAA included, with a customizable BAA by default. |
What that means in practice
The BAA is part of the customer agreement on every plan. It takes effect when a covered entity or business associate accepts the agreement and first sends protected health information to the service. No separate signature or setting is required. A mutually signed copy is available for customers who want one.
The agreement is posted in full with an effective date of April 27, 2026. It names FortaTech Security, LLC, doing business as Bastion Intelligence, as the business associate.
Larger customers can negotiate the wording. A customizable BAA is an add on for Professional Plus practices with 50 or more users and comes by default on the Ultra plan.
What the agreement leaves out
The BAA says the service is designed to receive protected health information only through the BastionGPT application itself. Its Schedule A lists channels that are not covered for patient information: support channels unless the company directs otherwise, other business email, public websites, billing and payment, product feedback, community channels, and account and profile fields.
How to read this answer
HIPAA has no certificate a product can hold. The part that can be checked is whether the maker signs a business associate agreement, and for which plans.
A signed agreement is where compliant use starts. The practice still has to set the tool up correctly, control who can use it, and train staff.
This page records what FortaTech Security, LLC d/b/a Bastion Intelligence documents. It is not legal advice. See the regulatory compliance guide or the HIPAA status of other AI tools.