Claude has no single HIPAA status. A BAA is available on Claude Enterprise, the first-party API and Claude in Microsoft Foundry, for the services listed below. The Free, Pro, Max and Team plans cannot enable HIPAA, so a clinic on one of those plans should not put PHI into Claude.
Is Claude HIPAA compliant? BAA by plan, covered services and exclusions
Conditional A BAA is available on Claude Enterprise, the first-party API and Claude in Microsoft Foundry. The main exclusion is that Free, Pro, Max and Team cannot enable HIPAA. Verdict date: 2026-10-19.
A signed BAA alone does not make a deployment compliant. Configuration, access management and staff policies still decide whether PHI is handled correctly.
Short answer
BAA available on Claude Enterprise (click-to-accept, by the Primary Owner) and on the Claude Developer Platform / first-party API and Claude in Microsoft Foundry, for the services listed in this check. Anthropic describes the covered services by product, not by company name, so each feature has to be checked individually.
Out of scope for the BAA: Claude Console, Cowork in the cloud, beta features and third-party connectors. See all vendor HIPAA checks for other tools.
Which plans include a BAA
A business associate agreement (BAA) is the contract that lets a vendor handle PHI on your behalf. For Claude it depends on the plan:
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Claude Enterprise | Available | The Primary Owner enables HIPAA in Organization settings > Data and privacy > HIPAA Compliance and accepts the click-to-accept BAA. 20-seat minimum. | From $20/seat/month billed annually, with usage at API rates |
| Claude Developer Platform / first-party API | Available | The Primary Owner signs a BAA and contacts the Anthropic account contact or Sales to enable it. Custom BAAs go through sales. | Not published by the vendor |
| Claude in Microsoft Foundry | Available | Not published by the vendor | |
| Claude Free | Not available | Not applicable | Not applicable |
| Claude Pro | Not available | Not applicable | Not applicable |
| Claude Max | Not available | Not applicable | Not applicable |
| Claude Team | Not available | Not applicable | Not applicable |
What the BAA covers and what it excludes
Covered:
- Claude Enterprise chat, Projects, Artifacts, file creation and code execution without network access, voice, web search and research under the HIPAA configuration
- Claude Code and Cowork in local mode
- Messages API features and the listed management APIs
- Claude in Microsoft Foundry
Excluded:
- Claude Console
- Cowork in the cloud
- Beta features (Claude in Office, Design, Slides, Docs)
- Batch, Files and Skills APIs
- Code Execution, Computer Use and Web Fetch
- Connectors and MCP servers
- Enterprise Search
- Claude in Chrome
- Skills and plugins
- Claude Code cloud sessions
- The mobile app
- IDE extensions
- Claude Tag (Slack app)
In a clinic, this means a billing manager summarizing a denial letter in Enterprise chat is inside the covered scope. The same user connecting a Slack workspace through Claude Tag, or using the mobile app, is not.
Retention: Covered Models require 30-day retention and are not available with zero data retention (ZDR) unless Anthropic authorizes it. Claude Code used through a Console API key is covered only with ZDR enabled.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Yes |
| Access controls | Not published by the vendor |
| SSO | Yes |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Yes |
How to use Claude with PHI
- Sign or accept the BAA before any PHI goes into Claude. Do not test with real patient data first.
- Have the Primary Owner enable the HIPAA setting in Organization settings.
- Use only covered plans and services. Staff on personal Pro or Max accounts must not paste PHI.
- Keep connectors, MCP servers and beta features off for any workspace that handles PHI.
- Confirm retention and ZDR settings, especially for Claude Code through a Console API key.
- Set user access, SSO and offboarding so departed staff lose access the same day.
- Train staff and set an acceptable-use policy that names what may and may not be entered.
Compliance depends on the signed BAA, configuration and policies, not on the vendor name. More step-by-step material is in the HIPAA guides.
Alternatives with a BAA
- Amazon Bedrock: yes, all AWS accounts.
- Microsoft Azure: conditional.
- OpenAI ChatGPT and API: conditional; ChatGPT for Healthcare.
- Doximity GPT: yes, Member free.
- Fireflies.ai: conditional, Enterprise.
Related AI assistants with their own checks: Microsoft Copilot and Gemini. For other categories, see HIPAA-compliant software by category.
Sources
- Business Associate Agreements (BAA) for Commercial Customers | Claude Help Center — BAA page, checked 2026-10-19. "Anthropic provides a BAA covering our HIPAA-ready services, such as use of our first-party API, Claude in Microsoft Foundry, or Enterprise plans."
- HIPAA-ready Enterprise plans | Claude Help Center — Help article, checked 2026-10-19. "Team plans and individual plans (Free, Pro, and Max) can't enable HIPAA."
- I have a zero data retention agreement with Anthropic. What products does it apply to? — Help article, checked 2026-10-19. "the only products to which zero data retention applies are eligible Anthropic APIs"
- Pricing | Claude — Pricing page, checked 2026-10-19. "HIPAA-ready offering available"
- Trust Center – Anthropic — Trust center, checked 2026-10-19. "Compliance HIPAA SOC 2 Type II ISO 27001:2022 ISO/IEC 42001:2023 FedRAMP High UK Cyber Essentials"
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
FAQ
Is Claude Pro, Max or Team HIPAA compliant?
No BAA is available on Free, Pro, Max or Team, and these plans cannot enable HIPAA. Do not use them with PHI. The route to a BAA is Claude Enterprise, the first-party API or Claude in Microsoft Foundry.
How do I get a BAA for Claude Enterprise?
The Primary Owner enables HIPAA in Organization settings > Data and privacy > HIPAA Compliance and accepts the click-to-accept BAA. Enterprise has a 20-seat minimum and starts from $20/seat/month billed annually, with usage at API rates.
Are Claude Code and Cowork covered by the BAA?
Claude Code and Cowork are covered in local mode. Cowork in the cloud and Claude Code cloud sessions are excluded. Claude Code through a Console API key is covered only with ZDR enabled.
Is the Claude API covered, and does it need a separate BAA?
Yes, the Claude Developer Platform / first-party API is covered for the Messages API features and listed management APIs, but it needs its own BAA. The Primary Owner signs it and contacts the Anthropic account contact or Sales to enable it; custom BAAs go through sales. Claude Console, the Batch, Files and Skills APIs, Code Execution, Computer Use and Web Fetch are excluded.