Patient info and AI: the BAA guide
The short version: if you work with patient health info for a healthcare provider, health plan or their vendors, only paste it into an AI plan that comes with a signed Business Associate Agreement (BAA), and only into the features that BAA covers.
A short summary, not legal advice.
What is a BAA?
A contract HIPAA requires before a vendor handles patient info for a healthcare organization.
Show detailsHide details: What is a BAA?
A Business Associate Agreement is a contract required by HIPAA, the US health privacy law. It's signed between an organization that handles protected health information (PHI) and a vendor that touches that info for them. It sets out what the vendor may do with the info, requires them to protect it, and requires them to report problems such as breaches.
Who needs one?
Healthcare providers, health plans, clearinghouses, and the vendors who work for them.
Show detailsHide details: Who needs one?
- Covered entities: healthcare providers, health plans and healthcare clearinghouses.
- Their business associates: people or companies (not their own staff) who do work for them that involves patient info, plus those businesses' subcontractors.
If you're in either group and want an AI tool to see PHI, that AI vendor needs to sign a BAA with your organization first. Not sure if HIPAA applies to you? Ask your compliance advisor.
A BAA alone isn't HIPAA compliance
Signing a BAA is one piece. You still need your own policies, training, access controls and settings.
Show detailsHide details: A BAA alone isn't HIPAA compliance
A BAA is one piece. Microsoft, Google and the others all say the same thing: signing their BAA doesn't make you compliant on its own. You still need your own policies, training, access controls and correct settings. And each BAA covers only certain features. For example, connectors to other apps, browser add-ons and beta features are often not covered.
AI plans that offer a BAA
ChatGPT, Claude, Microsoft 365 Copilot and Google Workspace with Gemini offer one, only on certain business plans.
Show detailsHide details: AI plans that offer a BAA
Checked on each vendor's official page on . Vendors change this often, so check the linked page before you rely on it.
ChatGPT (OpenAI)
Plans on OpenAI's eligible list: ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT for Clinicians, ChatGPT FedRAMP, the API with Modified Retention, and API FedRAMP with Modified Retention.
How to get it: through OpenAI, on one of those plans. For the API, you need a signed BAA and Modified Retention set up on your account.
Watch out: some features aren't covered, such as improved memory and event-triggered scheduled tasks.
Claude (Anthropic)
Plans covered: Claude Enterprise (HIPAA-ready), the Anthropic API, and Claude in Microsoft Foundry.
How to get it: on Enterprise, the organization's Primary Owner turns on HIPAA under "Data and privacy" in settings and accepts the BAA. A standard Enterprise plan isn't covered until they do. For the API, the Primary Owner signs the BAA, then contacts Anthropic to have it turned on.
Watch out: connectors, Claude in Chrome and beta features aren't covered.
Microsoft 365 Copilot
Plans covered: Microsoft Copilot and Microsoft Copilot Chat are on the list of Office 365 services in scope for Microsoft's BAA, for commercial and GCC customers.
How to get it: Microsoft includes its BAA by default in the Online Services Data Protection Addendum for customers who are covered entities or business associates.
Watch out: Microsoft says HIPAA compliance doesn't apply to the web search queries Copilot generates. Ask your admin about turning web search off.
Google Workspace with Gemini
Plans covered: Gemini in Google Workspace, the Gemini app and the Gemini Mac app, used with a Workspace account. Gemini in Google Chrome is not covered.
How to get it: a Workspace admin reviews and accepts the BAA in the Admin console before anyone uses PHI.
Watch out: third-party apps and add-ons aren't covered.
Google: HIPAA on Cloud and Workspace · Google Workspace HIPAA help
Plans not on a vendor's BAA list
Free and personal plans, ChatGPT Business and Claude Team aren't on a vendor's BAA list.
Show detailsHide details: Plans not on a vendor's BAA list
As of October 23, 2026, none of these appears on its vendor's published BAA list, so keep patient info out of them.
- ChatGPT Free, Plus, Pro and Business. Only the plans listed above are eligible.
- Claude Free, Pro, Max and Team. Anthropic's BAA covers Enterprise and the API.
- The Gemini app with a personal Google account. Google's BAA covers Workspace customers.
- Copilot with a personal Microsoft account, including Microsoft 365 Personal and Family. Microsoft's BAA comes through its business Data Protection Addendum, which these plans aren't sold under.
Before you paste patient info: a checklist
Seven quick checks before anyone pastes patient info into an AI tool.
Show detailsHide details: Before you paste patient info: a checklist
- Does HIPAA apply to you? Check with your compliance advisor.
- Is your organization on a plan from the list above, not a personal or consumer plan?
- Has your organization actually signed or accepted the BAA? Ask your admin. Being on the right plan isn't enough.
- Are you signed in with your work account?
- Is the feature you're about to use covered? Connectors, browser add-ons, memory and beta features often aren't.
- Does your organization's policy allow this use?
- Are you sharing only the minimum info the task needs?
Not legal advice; talk to your compliance advisor. This page sums up what vendors publish. It doesn't say any plan makes you HIPAA compliant. We don't earn anything from the links on this page.