Is ChatGPT HIPAA compliant?
OpenAI signs a BAA for ChatGPT for Clinicians, ChatGPT for Healthcare, sales managed Enterprise and Edu accounts, and the API. The consumer plans and ChatGPT Business have none.
- Maker
- OpenAI
- Last checked
- November 11, 2026
Plan by plan
A business associate agreement (BAA) is the contract HIPAA requires before a tool handles patient information.
| Plan | BAA available | Detail |
|---|---|---|
| Free | No | OpenAI says its consumer plans are not eligible for a BAA. |
| Go | No | OpenAI says its consumer plans are not eligible for a BAA. |
| Plus | No | OpenAI says its consumer plans are not eligible for a BAA. |
| Pro | No | OpenAI says its consumer plans are not eligible for a BAA. |
| ChatGPT for Clinicians | Yes | A verified United States clinician signs the BAA in ChatGPT under Settings, then Agreements. It covers one user. |
| ChatGPT Business | No | OpenAI says it does not offer a BAA for ChatGPT Business. |
| ChatGPT Enterprise | Yes | For sales managed accounts, arranged through OpenAI sales. The eligible product is Enterprise with a Regulated Workspace. |
| ChatGPT Edu | Yes | For sales managed accounts, arranged through OpenAI sales. |
| ChatGPT for Healthcare | Yes | The route OpenAI names for a BAA that covers multiple users with central controls. |
| OpenAI API | Yes | An organization admin accepts the standard BAA in the API Platform settings. No enterprise agreement is needed. |
What that means in practice
A BAA is available on some ChatGPT products and on the API. OpenAI lists the eligible products as ChatGPT for Healthcare, ChatGPT Enterprise with a Regulated Workspace, ChatGPT for Clinicians, the API with modified retention, and its FedRAMP versions.
An individual clinician can use ChatGPT for Clinicians, a version for verified clinicians in the United States. The clinician signs the BAA inside the product, and it covers that one workspace. A practice that needs a BAA covering several users is pointed to ChatGPT for Healthcare.
OpenAI states that it does not offer a BAA for ChatGPT Business. Its HIPAA guide says the consumer plans, such as Free, Plus and Pro, are not eligible either.
On the API, an organization admin accepts the standard BAA in the platform settings. Only listed endpoints are eligible for patient information.
What the agreement leaves out
Inside an eligible ChatGPT workspace, OpenAI lists these as not covered: improved memory, event triggered scheduled tasks, internet access in Canvas and code blocks, browser use and network access for Work in the cloud, workspace agents shared with agent owned connections, Computer History in Codex and Codex Security administration. They are off by default. OpenAI adds that features not on its covered list are not automatically covered, and that third party services reached from Codex on a local machine fall outside the BAA.
How to read this answer
HIPAA has no certificate a product can hold. The part that can be checked is whether the maker signs a business associate agreement, and for which plans.
A signed agreement is where compliant use starts. The practice still has to set the tool up correctly, control who can use it, and train staff.
This page records what OpenAI documents. It is not legal advice. See the regulatory compliance guide or the HIPAA status of other AI tools.