Conditional A BAA is available for Perplexity Enterprise (Enterprise Pro / Enterprise Max) and the API, not for Free or Pro (individual); the vendor's own terms bar PHI unless a BAA has been executed (checked 2026-10-20). The main exclusion is that Free and individual Pro have no BAA and no self-serve path to one.
Short answer
Perplexity signs a BAA only by separate execution with Enterprise and API customers. Its terms prohibit processing PHI unless a BAA has been executed. Perplexity Pro (individual) is not listed with a BAA, so a clinic cannot put PHI into it, even on a paid personal subscription.
Perplexity publishes no public sign-up path and no plan list for the BAA beyond Enterprise and API. This page therefore states the status as "BAA available on plan X for services Y," not as a product property. For the terms BAA and PHI, see the HIPAA glossary. For other tools, see All vendor HIPAA checks.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Free | No (excluded) | No path | Not applicable |
| Pro (individual) | No (excluded) | No path | Not applicable |
| Enterprise (Enterprise Pro / Enterprise Max) | Available | Executed separately with Perplexity through sales; not self-serve | Not published by the vendor |
| API | Available | Executed separately with Perplexity through sales; not self-serve | Not published by the vendor |
Enterprise Pro is listed from $40 per seat per month on Perplexity's pricing page. That is the seat price only. The cost of the BAA, any minimum seat count and the sales process are not published by the vendor.
What the BAA covers and what it excludes
Covered by the BAA offering:
- Perplexity Enterprise
- Perplexity API (Sonar)
Excluded:
- The vendor publishes no list of excluded features.
- Free and Pro (individual) sit outside the BAA offering.
A BAA covers only the vendor's own service. If a front-desk workflow pulls Perplexity output into other tools, each of those tools that touches PHI needs its own BAA.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Yes |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Yes |
SOC 2 and ISO/IEC 27001 are security attestations. HIPAA has no certification, and none of these entries is a HIPAA certification.
How to use Perplexity with PHI
- Execute the BAA with Perplexity before any PHI enters the product.
- Use only Enterprise or the API for PHI.
- Keep staff off Free and individual Pro for anything containing PHI. A billing specialist pasting a patient's note into a personal Pro account is a disclosure with no BAA behind it.
- Ask Perplexity sales, in writing, for the unpublished controls: encryption at rest, audit logging, access controls and data residency.
- Configure SSO and manage user access, including removing accounts at offboarding.
- Write a staff policy on what may be entered and train staff on it.
Compliance depends on the signed BAA, your configuration and your policies, not on the tool alone. Perplexity's outputs are not a substitute for clinical judgment, and this page makes no claim about their reliability.
Alternatives with a BAA
See HIPAA-compliant AI tools for the full category.
- Amazon Bedrock: yes, all AWS accounts.
- Microsoft Azure: conditional.
- OpenAI ChatGPT and OpenAI API: conditional; ChatGPT for Healthcare.
- Anthropic Claude: conditional; Claude Enterprise.
- Doximity GPT: yes; Member, free.
Sources
- Perplexity Enterprise Terms and Conditions — Terms, checked 2026-10-20. "Customer may not use the Services to create, receive, maintain, transmit, or otherwise process any information that includes or constitutes "Protected Health Information", as defined under the HIPAA Privacy Rule, unless Customer and Perplexity have executed a Business Associate Agreement."
- Perplexity API Terms of Service — Terms, checked 2026-10-20. "Customer may not use the Services to create, receive, maintain, transmit, or otherwise process any information […] unless Customer and Perplexity have executed a Business Associate Agreement."
- Security at Perplexity — Trust center, checked 2026-10-20. "SOC 2 Type 2 certified by independent auditors — ensuring your information remains protected at all times."
- Enterprise Pricing and Billing: Frequently Asked Questions — Pricing page, checked 2026-10-20. "Enterprise Pro: Each seat is $40 per month or $400 per year (a discount of approximately 16.7% versus monthly subscriptions)"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Is Perplexity Pro HIPAA compliant?
No BAA is listed for Pro (individual). Do not use it with PHI. A BAA is available only by separate execution for Enterprise and API customers.
Does Perplexity sign a BAA, and for which plans?
Yes, for Perplexity Enterprise (Enterprise Pro / Enterprise Max) and the API (Sonar). It is executed separately through sales and is not self-serve. The BAA cost is not published by the vendor. Free and Pro (individual) are excluded.
Can I enter PHI into the free version of Perplexity?
No. Perplexity's terms prohibit processing PHI unless a BAA has been executed, and Free has no BAA.
Does SOC 2 Type 2 mean Perplexity is HIPAA compliant?
No. SOC 2 Type 2 is an independent security attestation, not a HIPAA determination. For PHI, what matters is whether a BAA covers the plan and service you use. Here that means Enterprise or API, after the BAA is signed.