Conditional OpenAI offers a BAA on ChatGPT for Healthcare, ChatGPT Enterprise and Edu with Regulated Workspace, ChatGPT for Clinicians (individual use) and the API with Modified Retention. Consumer plans and ChatGPT Business are not eligible (verified 2026-10-19).
Whether PHI can go into ChatGPT depends on the plan and the feature. The BAA covers specific products and functionality, not everything under the ChatGPT name. Improved memory, event-triggered scheduled tasks and Codex in the cloud are outside it. This page is a sourced data card, not legal advice. For other tools, see Is it HIPAA compliant? All vendors. For the wider topic, see the HIPAA and AI guide on chanty.health.
Disclosure: HIPAA Compliant Wiki is published by Chanty, Inc. Chanty has no relationship with OpenAI.
Which plans include a BAA
A BAA (business associate agreement) is the contract that lets a vendor handle PHI on your behalf. See the HIPAA glossary for the term. At OpenAI it is tied to the plan, and in the API to the Modified Retention setting.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| ChatGPT for Healthcare | Available | Through OpenAI sales | Not published by the vendor |
| ChatGPT Enterprise with Regulated Workspace | Available | Through OpenAI sales | Not published by the vendor |
| ChatGPT Edu with Regulated Workspace | Available | Through OpenAI sales | Not published by the vendor |
| ChatGPT FedRAMP | Available | Not published by the vendor | Not published by the vendor |
| ChatGPT for Clinicians | Available, individual use | Verified US clinicians sign under Settings > Agreements | $0 for individual verified US clinicians |
| OpenAI API with Modified Retention | Available | API admin accepts it self-serve in the API Platform | Not published by the vendor |
| API FedRAMP with Modified Retention | Available | Not published by the vendor | Not published by the vendor |
| ChatGPT Free | Not eligible | — | — |
| ChatGPT Plus | Not eligible | — | — |
| ChatGPT Pro | Not eligible | — | — |
| ChatGPT Business | Not eligible | — | — |
API route. An API admin goes to Settings > Organization > General > HIPAA compliance support and selects Enable. This requires established API usage history. Without it, request the BAA at [email protected]. API usage is pay-as-you-go. Enterprise, Edu and Healthcare agreements run through sales.
What the BAA covers and what it excludes
The BAA covers only products and functionality that OpenAI lists as eligible. The ChatGPT for Healthcare help article states this limit explicitly.
Covered:
- Chat, projects, GPTs, workspace agents, voice, ChatGPT Record, canvas code execution and Library files
- Web search and deep research that use OpenAI's own index
- Trusted clinical search (ChatGPT for Healthcare only)
- Codex local clients
- Office extensions
- Admin features, SSO and the Compliance API
- The API endpoints OpenAI lists as eligible
Excluded:
- Improved memory
- Event-triggered scheduled tasks
- Codex Cloud
- Internet access in Canvas and code blocks
- Browser use and network access for Work in the cloud
- Workspace agents with agent-owned connections
- Third-party GPTs and connected apps
- Execution of the Codex local client on customer machines, and the third-party services it accesses
In a clinic, this means a front-desk lead who pastes a patient's referral letter into a covered chat is inside the BAA. The same lead who connects a third-party GPT or an outside app to that workspace has moved the data outside it.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Yes |
| Access controls | Yes |
| SSO | Yes |
| Data residency | Data residency options (ChatGPT for Healthcare / Enterprise) |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
"Not published by the vendor" means the OpenAI pages listed under Sources do not state it. It does not mean the control is absent.
How to use ChatGPT with PHI
A BAA is one part of HIPAA compliance. Compliance depends on the signed BAA, your configuration and your own policies. Use this checklist, and see the HIPAA guides for related procedures:
- Sign the BAA before any PHI enters the tool.
- Use only an eligible plan, or the API with Modified Retention enabled.
- Keep improved memory and the other excluded features off for PHI work.
- Review third-party GPTs and connected apps separately. Each one that touches PHI needs its own agreement and review.
- Configure admin settings, SSO and access controls, and review the audit log.
- Offboard users when staff leave.
- Train staff and write a policy on what may be entered and which features may be used.
For the broader HIPAA-and-AI guidance, see chanty.health/learn/hipaa-and-ai/.
Alternatives with a BAA
Browse HIPAA-compliant software by category for more options. The tools below have a published BAA route. The list is in no ranked order.
- Amazon Bedrock: verdict yes, all AWS accounts. See Is AWS Bedrock HIPAA compliant?
- Microsoft Azure: verdict conditional.
- Anthropic Claude: verdict conditional, Claude Enterprise. See Is Claude AI HIPAA compliant?
- Doximity GPT: verdict yes, Member (free) plan.
- Fireflies.ai: verdict conditional, Enterprise plan.
Sources
- HIPAA eligible products and functionality | OpenAI Help Center — Help article, checked 2026-10-19. "OpenAI makes the following HIPAA eligible products available with a Business Associates Agreement (BAA): ChatGPT for Healthcare ChatGPT for Enterprise with Regulated Workspace ChatGPT FedRAMP ChatGPT for Clinicians API with Modified Retention API FedRAMP with Modified Retention"
- Getting a Business Associate Agreement for the OpenAI API | OpenAI Help Center — BAA page, checked 2026-10-19. "For a BAA for a sales-managed ChatGPT Enterprise or Edu account, contact sales. We do not offer a BAA for ChatGPT Business."
- ChatGPT for Healthcare | OpenAI Help Center — Help article, checked 2026-10-19. "Your BAA covers only the eligible products and functionality listed in HIPAA Eligible Products and Functionality. Improved memory is disabled by default for ChatGPT for Healthcare and is not covered under your BAA. PHI should not be entered when using this feature."
- HIPAA Implementation and Configuration Guide (July 9, 2026) — Vendor page, checked 2026-10-19. "For clarity, ChatGPT services for consumers (e.g., Free, Plus, Pro) and ChatGPT Business are not Eligible Services."
- ChatGPT for Clinicians | OpenAI Help Center — Help article, checked 2026-10-19. "ChatGPT for Clinicians is designed for individual use, including the ability to sign a Business Associate Agreement (BAA). For centralized deployment, admin controls, or a BAA that covers multiple users, see: ChatGPT for Healthcare."
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
Changes
No changes recorded since first verification on 2026-10-19. See Recent changes in vendor HIPAA status.
FAQ
Is the free or Plus version of ChatGPT HIPAA compliant?
No BAA is available for ChatGPT Free, Plus or Pro. These plans are not eligible, so they should not be used with PHI.
Does ChatGPT Business come with a BAA?
No. ChatGPT Business is not eligible for a BAA. Organizations that need one should look at ChatGPT for Healthcare, Enterprise or Edu with Regulated Workspace, or the API with Modified Retention.
How do I get a BAA for the OpenAI API?
An API admin goes to Settings > Organization > General > HIPAA compliance support and selects Enable. This self-serve route requires established API usage history. Otherwise, email [email protected]. Modified Retention must be in place for the BAA to apply.
Can an individual clinician sign a BAA with OpenAI?
Yes, through ChatGPT for Clinicians. Verified US clinicians sign the BAA under Settings > Agreements for individual use. The cost is $0 for individual verified US clinicians.