Is ChatGPT HIPAA Compliant? When a BAA Applies (2026)
ChatGPT is not HIPAA compliant by default. OpenAI signs a Business Associate Agreement only for some products. Here is which ones, as of October 2026, and how clinicians can use AI without exposing PHI.
Short answer: not by default. The ChatGPT most people use (Free, Plus, Pro) and ChatGPT Business come with no Business Associate Agreement (BAA), so you should not enter protected health information (PHI) into them. OpenAI does sign a BAA for some products: sales-managed ChatGPT Enterprise and Edu, ChatGPT for Healthcare, ChatGPT for Clinicians (eligible accounts) and the OpenAI API. Even then, OpenAI itself says a BAA alone does not make your use HIPAA compliant.
Disclosure: Arkangel AI wrote this article and makes a clinical AI tool. Facts about OpenAI come from OpenAI's own pages, checked as of October 2026; plans and eligibility change often, so confirm with OpenAI before relying on them. This is not legal advice.
Why "HIPAA compliant ChatGPT" depends on the plan
HIPAA applies to covered entities (health plans, clearinghouses and providers that conduct certain electronic transactions) and to their business associates. A covered entity may share PHI with a vendor only after the vendor gives written assurances, usually a BAA, that it will safeguard the data (HHS on business associates). HHS even lists a third-party AI chatbot that handles patients' PHI for a provider as an example of a business associate.
So the question is not whether ChatGPT is "compliant" as software, but whether OpenAI has signed a BAA covering the exact product you use, and whether your organization runs the safeguards around it.
Which ChatGPT options come with a BAA (as of October 2026)
| Option | Who it is for | BAA with OpenAI | Notes from OpenAI |
|---|---|---|---|
| ChatGPT Free, Plus, Pro | Individuals | Not offered | OpenAI's BAA guidance lists only the products below |
| ChatGPT Business | Teams | No | "We do not offer a BAA for ChatGPT Business" |
| ChatGPT Enterprise / Edu (sales-managed) | Organizations, universities | Available through sales | Data not used for training by default; admin-controlled retention |
| ChatGPT for Healthcare | Hospitals and health systems | Yes | Launched January 8, 2026; data residency, audit logs, customer-managed keys; content not used for training |
| ChatGPT for Clinicians | Verified U.S. physicians, NPs, PAs and pharmacists | Optional, for eligible accounts (in-product flow) | Free since April 22, 2026; conversations not used for training |
| OpenAI API | Developers and vendors | Yes, self-serve for eligible organizations | Requires an established history of API usage, or contact baa@openai.com |
Sources: OpenAI Help Center, Getting a BAA for the OpenAI API (includes the ChatGPT BAA rules); Introducing OpenAI for Healthcare; Making ChatGPT better for clinicians; Enterprise privacy at OpenAI.
Two points from OpenAI's own help article matter for compliance teams: once HIPAA support is enabled for an API organization it cannot be disabled in settings, and you must not include PHI in support requests or screenshots sent to OpenAI.
What a BAA does not do
- It does not make your use compliant by itself. OpenAI says accepting a BAA "do[es] not, by themselves, make your application HIPAA compliant"; you still own your risk analysis, access controls, minimum-necessary rules and training.
- It covers only the eligible product and configuration. A clinician with a personal Plus account is outside the BAA their hospital signed for an Enterprise workspace.
- It does not cover patients. When patients upload their own records to a consumer chatbot, that use is generally not protected by HIPAA, as Harvard Law School's I. Glenn Cohen explains (Harvard Law Today).
What clinicians may paste into consumer ChatGPT
Nothing that identifies a patient. HHS's Safe Harbor method lists 18 identifiers to remove, including names, geographic units smaller than a state, all date elements except the year, phone and fax numbers, email, SSN, medical record and health plan numbers, account and license numbers, device and vehicle identifiers, URLs, IP addresses, biometrics, full-face photos and any other unique code (HHS de-identification guidance). Initials and partial numbers still count, and so do identifiers buried in pasted notes.
A safe prompt looks like: "Adult with type 2 diabetes, eGFR 38, on metformin: which second-line agents are preferred and why? Cite guidelines." A risky one is a copied discharge summary.
Safe alternatives for clinicians
- Use your organization's approved tool. If your employer runs ChatGPT for Healthcare, Enterprise or another tool under a BAA, use that account for anything involving PHI.
- Use a clinician product with a BAA you are eligible for, such as ChatGPT for Clinicians in the U.S., and check that your employer allows it.
- Ask de-identified questions in a cited medical search tool. For evidence questions, identity is rarely needed; tools built for clinicians cite the studies so you can check them. General chatbots have fabricated references in studies (47% of references generated by ChatGPT-3.5 in one evaluation, Cureus 2023).
- Keep documentation in the EHR, and turn off chat history or sharing when your plan allows it.
Arkangel AI is one such cited tool: answers link to studies and guidelines in English, Spanish, Portuguese and French. It is ISO 27001:2022 certified and offers HIPAA compliance and a signed BAA on Enterprise plans only; on the self-serve Free, Pro and Team plans, inputs are not covered by HIPAA, so remove identifiers before asking (security and compliance, Trust Center, pricing). For a full comparison, see ChatGPT for doctors, AI for doctors and our guide to whether OpenEvidence is HIPAA compliant.
Frequently asked questions
Is ChatGPT HIPAA compliant?
Not by default. Consumer ChatGPT (Free, Plus, Pro) and ChatGPT Business come with no BAA. OpenAI offers a BAA for sales-managed ChatGPT Enterprise and Edu, ChatGPT for Healthcare, eligible ChatGPT for Clinicians accounts and the OpenAI API, and says a BAA alone does not make your use compliant.
Is there a HIPAA compliant version of ChatGPT?
Yes, in the sense that some OpenAI products can be used with PHI under a BAA: ChatGPT for Healthcare for health systems, sales-managed ChatGPT Enterprise, ChatGPT for Clinicians for eligible verified U.S. clinicians, and the API. Your organization still has to configure and govern them.
Does OpenAI sign a BAA for ChatGPT Plus?
OpenAI's BAA guidance does not list ChatGPT Plus, Free or Pro among the products with a BAA, and it states plainly that it does not offer a BAA for ChatGPT Business. Treat those plans as unsuitable for PHI.
Is ChatGPT for Clinicians HIPAA compliant?
OpenAI describes "optional support for HIPAA compliance" through a BAA for eligible accounts. It is free for verified U.S. physicians, nurse practitioners, physician assistants and pharmacists as of October 2026. Check that your employer permits it before entering PHI.
Can doctors use ChatGPT without violating HIPAA?
Yes, if they keep PHI out of tools without a BAA. Remove the 18 HIPAA identifiers and describe the case in general terms, or use a product your organization has approved under a BAA. Always verify clinical answers against the cited sources.
Does OpenAI train on what I type?
For its business products (Business, Enterprise, Healthcare, Edu and the API), OpenAI says it does not train on your data by default. OpenAI also says ChatGPT for Clinicians conversations are not used for training. Consumer settings differ, which is another reason to keep PHI out of them.
Sources (checked October 2026)
- OpenAI. Getting a Business Associate Agreement for the OpenAI API; Introducing OpenAI for Healthcare (January 8, 2026); Making ChatGPT better for clinicians (April 22, 2026); Enterprise privacy.
- U.S. Department of Health and Human Services. Business associates; De-identification guidance.
- Harvard Law School. Does HIPAA protect what you tell ChatGPT? (July 15, 2026).
- Cureus (2023). Fabricated references generated by ChatGPT.
- Arkangel AI. Trust Center.