Is Claude HIPAA compliant?
Anthropic signs a BAA for Claude on the Enterprise plan and the API. The Free, Pro, Max, Ultra and Team plans have none.
- Maker
- Anthropic
- Last checked
- November 11, 2026
Plan by plan
A business associate agreement (BAA) is the contract HIPAA requires before a tool handles patient information.
| Plan | BAA available | Detail |
|---|---|---|
| Free | No | Individual plans cannot turn on HIPAA. |
| Pro | No | Individual plans cannot turn on HIPAA. |
| Max | No | Individual plans cannot turn on HIPAA. |
| Ultra | No | Individual plans cannot turn on HIPAA. |
| Team | No | Team plans cannot turn on HIPAA. |
| Enterprise | Yes | The Primary Owner turns on HIPAA in organization settings and accepts the BAA. |
| Claude API | Yes | Turned on in the Claude Console under the standard BAA, or through an account team. Only listed features are covered. |
| Claude Code | Yes | Only on an Enterprise plan with the HIPAA configuration applied, or with a Console API key and zero data retention. Local sessions only. |
| Cowork | Yes | Only in Claude Desktop on an Enterprise plan with the HIPAA configuration applied. Cowork in the cloud is not covered. |
What that means in practice
A BAA is available two ways: on the Enterprise plan and on the API. On Enterprise, the organization's Primary Owner turns on HIPAA in organization settings and accepts the BAA there. On the API, most organizations can turn it on in the Claude Console under Anthropic's standard BAA. Organizations that need a negotiated agreement work with an Anthropic account team.
The Free, Pro, Max and Ultra plans and the Team plan cannot turn on HIPAA. Anthropic's pricing page marks the HIPAA offering as unavailable on each of them.
Turning on HIPAA for an Enterprise organization covers chat. Claude Code and Cowork need a second step, called the HIPAA configuration, which Anthropic makes available only to organizations that have an Anthropic account team. It covers sessions that run on the member's own computer.
Anthropic also lists Claude in Microsoft Foundry as eligible under its BAA once the HIPAA configuration is applied to the Azure subscription.
What the agreement leaves out
Anthropic lists these as outside the BAA: the Claude Console interface, the Batch API, the Files API, code execution and web fetch on the API, and beta features unless they are listed as eligible. Connectors, MCP servers, skills and Claude in Chrome are not covered where they send data to third parties. Claude Code and Cowork sessions in the cloud, Claude Code in VS Code or JetBrains, and Claude Code routed through another cloud provider or a gateway are not covered. An API BAA signed before December 2, 2025 covers API use only and does not extend to the Enterprise plan.
- Anthropic: Business Associate Agreements (BAA) for Commercial Customers
- Claude help center: HIPAA ready Enterprise plans
- Claude help center: Claude Code and Cowork in local mode on a HIPAA ready Enterprise plan
- Claude pricing
- Claude Platform docs: API and data retention
- Claude Code docs: Legal and compliance
How to read this answer
HIPAA has no certificate a product can hold. The part that can be checked is whether the maker signs a business associate agreement, and for which plans.
A signed agreement is where compliant use starts. The practice still has to set the tool up correctly, control who can use it, and train staff.
This page records what Anthropic documents. It is not legal advice. See the regulatory compliance guide or the HIPAA status of other AI tools.