Not in the consumer apps; conditionally through the xAI API. xAI offers a BAA for its enterprise API on request, and PHI may only go through the zero-data-retention (ZDR) enabled API. grok.com, the iOS and Android apps and Grok on X are not covered.
Is Grok HIPAA compliant? BAA by plan, covered services and exclusions
Conditional A BAA is available for the xAI API (enterprise) on request; the main exclusion is the consumer Grok apps (grok.com, iOS/Android, Grok on X). Verdict date: 2026-10-20.
This page reports xAI's published terms. It does not audit xAI, and it is not legal advice. See all vendor HIPAA checks for other tools.
Short answer
xAI hands out its BAA through a questionnaire for API customers. PHI can only be sent through the ZDR-enabled API under that signed BAA. The consumer Grok apps have no BAA, so patient information stays out of them.
xAI says it can support a customer's HIPAA obligations "under some circumstances." Approval after review is not automatic, and a completed questionnaire is not a signed BAA.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| API (enterprise) | Available | Complete the BAA Questionnaire at x.ai/legal/baa; xAI reviews it and follows up | Not published by the vendor |
| Grok consumer apps (grok.com, iOS/Android, Grok on X) | Not offered | Not applicable | Not published by the vendor |
Minimum seats: Not published by the vendor.
What the BAA covers and what it excludes
The terms require the customer to have a BAA in place and to use the ZDR-enabled API in order to submit PHI. For the meaning of those terms, see the HIPAA glossary (BAA, PHI).
Covered
- The xAI API, ZDR-enabled.
Excluded
- API endpoints that are not ZDR-enabled.
- The consumer Grok apps: grok.com, the iOS and Android apps, and Grok on X.
A clinic example: a billing team that pastes a denial letter with patient names into Grok on X has disclosed PHI to a service with no BAA. The same text sent by a developer through the ZDR-enabled API, after a BAA is signed, falls inside the covered scope.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Yes |
| Access controls | Not published by the vendor |
| SSO | Yes |
| Data residency | Available for the API (enterprise controls) |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
These statuses come from the enterprise API page. Do not extend them to the consumer apps.
How to use Grok with PHI
HIPAA responsibility is shared between xAI and the customer. A practical checklist:
- Sign the BAA before any PHI reaches xAI.
- Send PHI only through the ZDR-enabled API, never through other endpoints.
- Block PHI in the consumer apps with a written policy, and say so explicitly for Grok on X, where staff may already be logged in personally.
- Limit who holds API keys, review that access regularly, and revoke keys at offboarding.
- Confirm data residency and audit logging settings with xAI.
- Train staff on which Grok surfaces are allowed and which are not.
- Record xAI in the vendor inventory with the BAA date, the scope and the owner.
Compliance depends on the signed BAA, configuration and the organization's own policies, not on the tool alone.
Alternatives with a BAA
Order does not depend on payment. Verdicts are as recorded on each vendor's card.
- Amazon Bedrock: yes; BAA covers all AWS accounts.
- Microsoft Azure: conditional.
- OpenAI ChatGPT and API: conditional; ChatGPT for Healthcare.
- Anthropic Claude: conditional; Claude Enterprise.
- Doximity GPT: yes; free for Members.
Browse the full list under HIPAA-compliant AI tools.
Sources
- Enterprise FAQs | SpaceXSI — Help article, checked 2026-10-20. "Under some circumstances, we can support a customer's HIPAA compliance obligations. To inquire about a Business Associate Agreement (BAA), please complete our BAA Questionnaire. A member of our team will review your responses and reach out with next steps."
- Terms of Service – Enterprise | SpaceXSI — Terms, checked 2026-10-20. "will not intentionally submit […] any "protected health information" as defined under the HIPAA Privacy Rule (45 C.F.R. § 160.103) unless Customer has first entered into a Business Associate Agreement or Amendment ("BAA") with SpaceXSI that amends this Agreement and also uses SpaceXSI's ZDR-Enabled API to submit that data."
- SpaceXSI API: Grok Models, API Keys & Pricing | SpaceXSI — Vendor page, checked 2026-10-20. "Yes. The SpaceXSI API supports enterprise controls including SSO, audit logging, SOC 2, HIPAA-eligible deployments with a BAA, data residency, monthly invoicing, custom rate limits, and dedicated support."
- SpaceXSI API – BAA Questionnaire | SpaceXSI — BAA page, checked 2026-10-20. "This form is for customers requesting a Business Associate Agreement (BAA) from SpaceXSI to enable HIPAA compliance when using SpaceXSI APIs."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Can I put patient information into the Grok app or Grok on X?
No. xAI offers no BAA for the consumer apps (grok.com, iOS/Android, Grok on X). Treat them as out of scope for PHI and say so in your acceptable-use policy.
How do I request a BAA from xAI for the API?
Complete the BAA Questionnaire at x.ai/legal/baa. xAI reviews your answers and follows up. Whether it supports your HIPAA obligations is decided in that review, "under some circumstances," so wait for a signed BAA before sending PHI.
Does a BAA let me send PHI to any xAI API endpoint?
No. The terms require the ZDR-enabled API for submitting PHI. Endpoints that are not ZDR-enabled are excluded.
What security controls does xAI publish for the API?
The enterprise API page lists audit logging, SSO and SOC 2, and says data residency is available for the API. Encryption in transit, encryption at rest, access controls, HITRUST and ISO 27001 are not published by the vendor.