Yes Doximity's help article says a BAA is included with each verified Doximity member account, and Enterprise BAAs are available to health systems. The main limit is that membership is for verified U.S. healthcare professionals, and the vendor lists no excluded features (checked 2026-10-20).
Doximity Ask is the current name of the product searched as DoximityGPT, Doximity GPT or DoxGPT.
Short answer
Doximity makes a BAA available on the Member (free) and Enterprise accounts for the Doximity platform, including Doximity Ask / DoximityGPT. Doximity Ask is free for clinicians and runs on desktop and mobile.
This page reports what Doximity publishes. It does not audit the vendor, and a BAA does not make a practice compliant by itself. For other tools, see Is it HIPAA compliant? All vendors.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Member (free) | Included with each member account | Comes with the verified member account | Not published by the vendor |
| Enterprise (health systems) | Available | Request via [email protected] | Not published by the vendor |
The vendor lists no excluded plans. Minimum seats: Not published by the vendor.
Membership is limited to verified U.S. healthcare professionals. A non-verified or non-U.S. user should not assume a BAA applies to them.
What the BAA covers and what it excludes
Covered, per Doximity:
- The Doximity platform
- Doximity Ask / DoximityGPT
Excluded: the vendor lists no excluded features on the pages checked. This page does not infer any. Ask Doximity in writing whether any feature, such as file upload or a mobile-only function, sits outside the BAA.
Doximity states that patient data and uploaded documents are handled within a secure framework designed for healthcare environments.
The BAA says nothing about whether the AI output is accurate or suitable for clinical decisions. Reviewing that output is the clinician's responsibility.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
The encryption entries rest on the help-article statement on encryption in transit and at rest.
"Not published" means the vendor does not state it on the pages checked. It does not mean the control is absent.
How to use Doximity GPT with PHI
Compliance depends on the signed BAA, your configuration and your organization's own policies. Definitions of BAA and PHI are in the HIPAA glossary.
- Confirm the BAA is in place for the account or health system before anyone enters PHI.
- Confirm every user is a verified Doximity member. A front-desk employee or billing contractor without a verified account is not covered by the member route.
- For health-system use, route the Enterprise BAA request through the contact Doximity lists, and file the executed copy in your vendor inventory.
- Limit PHI to the covered services above. Do not paste PHI into other tools that have no BAA.
- Set a written policy on what may be typed or uploaded. For example, decide whether scanned referral letters or lab reports may be uploaded.
- Train staff on that policy, and on reviewing AI output before it affects care or the chart.
- Ask Doximity in writing about the unpublished controls: audit logging, access controls, SSO and data residency. Record the answers and the date.
Alternatives with a BAA
Verdicts below follow each vendor's published BAA terms and are separate from this check.
| Vendor | Verdict | BAA starting plan |
|---|---|---|
| Amazon Bedrock | Yes | All AWS accounts |
| Microsoft Azure | Conditional | All Azure customers under a volume licensing or online subscription agreement (no plan tiers) |
| OpenAI ChatGPT and OpenAI API | Conditional | ChatGPT for Healthcare |
| Anthropic Claude | Conditional | Claude Enterprise (HIPAA enabled by the Primary Owner) |
| Fireflies.ai | Conditional | Enterprise |
Browse more options in HIPAA-compliant software by category.
Sources
- Is Doximity HIPAA/HITECH Compliant? – Help Center — Help article, checked 2026-10-20. "Doximity includes a BAA with each member and Enterprise BAAs are available to health system clients. Please reach out to [email protected] for more information."
- Is Doximity HIPAA/HITECH Compliant? – Help Center — Help article, checked 2026-10-20. "We employ industry-leading encryption standards to protect all data in transit and at rest."
- Doximity Ask — Vendor page, checked 2026-10-20. "Free on desktop and mobile."
- Doximity Ask — Vendor page, checked 2026-10-20. "Patient data and uploaded documents are handled within a secure framework designed specifically for healthcare environments."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
Changes
No changes recorded since first verification on 2026-10-20. See Recent changes in vendor HIPAA status.
FAQ
Is Doximity GPT HIPAA compliant?
Verdict: yes. Per Doximity's help article, a BAA is included with each verified member account and Enterprise BAAs are available for health systems. Compliance in practice depends on the signed BAA, your configuration and your organization's policies.
Is DoximityGPT the same as Doximity Ask?
Yes. Doximity Ask is the current name of the product formerly called DoximityGPT.
Do I need to pay for a BAA with Doximity?
The Member account is free for clinicians, and the BAA comes with each verified member account. Any extra cost for the BAA or for Enterprise is Not published by the vendor.
Does Doximity encrypt data in transit and at rest?
Doximity's published materials state both. Other controls, including audit logging, access controls, SSO, data residency, HITRUST and ISO 27001, are Not published by the vendor.