Topic guide

HIPAA for AI tools: what a Business Associate Agreement actually covers

Independent compliance reference from Janus Compliance. Reviewed by Michael K. Onyekwere, CIPP/E. Last reviewed 2026-10-15. Not legal advice.

Share this HIPAA for AI tools: what a Business Associate Agreement actually covers profile:Share on X Bluesky

TL;DR. HIPAA protects the protected health information (PHI) held by US Covered Entities and their Business Associates, and the AI vendor only becomes a Business Associate when the deployment processes PHI on behalf of a Covered Entity or another Business Associate. OpenAI (on the API without an enterprise agreement), Anthropic, Google (Google Cloud and Google Workspace other than the legacy free edition, not the Gemini Developer API), Perplexity (under its Enterprise and API terms) and ElevenLabs (Enterprise only) all sign BAAs on specific API or enterprise products, and Microsoft (including Azure OpenAI) includes its BAA by default in its DPA for in-scope services. Consumer plans do not come with a BAA. One free product is an exception: ChatGPT for Clinicians, which is free for verified US clinicians and lets an individual clinician sign a BAA in the product. A signed BAA is necessary but not the whole job: the rest of the HIPAA Security Rule still applies on the buyer's side.

When HIPAA enters the AI procurement conversation

HIPAA (the US Health Insurance Portability and Accountability Act, as amended by HITECH) applies to:

Covered Entities (CEs): health plans, health care clearinghouses, and health care providers that transmit any health information electronically in connection with a transaction covered by the HIPAA rules (45 CFR § 160.103)
Business Associates (BAs): a person that, on behalf of a Covered Entity, creates, receives, maintains or transmits PHI for a function or activity regulated by the HIPAA rules, or provides services such as legal, consulting, data aggregation, management or administrative services that involve the disclosure of PHI (§ 160.103)
Subcontractors of BAs: a subcontractor that creates, receives, maintains or transmits PHI on behalf of a Business Associate is itself a Business Associate (§ 160.103)

PHI is individually identifiable health information in any form or medium, other than in excluded records such as education records and a Covered Entity's employment records (§ 160.103). A Covered Entity may disclose PHI to an AI vendor acting as its Business Associate only once it has satisfactory assurance that the vendor will safeguard the information, documented in a written contract that meets § 164.504(e) (§ 164.502(e)). That contract is the BAA, and it has to be in place before any PHI reaches the system. Inputs that look benign (a transcribed clinical conversation, a summarised radiology report, a draft patient letter) can be PHI.

A non-US healthcare body, such as an NHS Trust or an EU public health body, is a Covered Entity only if it meets one of these definitions, for example by transmitting health information electronically in connection with a transaction covered by the HIPAA rules. Otherwise its obligations come from its own law, which the non-US section below outlines.

What a BAA actually requires

A Business Associate Agreement is the written contract that 45 CFR § 164.504(e) requires. Among its other terms, it must require the BA to:

Not use or further disclose PHI other than as the contract permits or requires, or as required by law
Use appropriate safeguards and comply, where applicable, with the Security Rule for electronic PHI
Report to the Covered Entity any use or disclosure not provided for by the contract, including breaches of unsecured PHI
Make PHI available for individuals' access and amendment requests (§§ 164.524 and 164.526)
Make available the information needed for an accounting of disclosures (§ 164.528)
Make its internal practices, books and records available to HHS for determining the Covered Entity's compliance
Return or destroy PHI at termination where feasible, or extend the contract's protections to it where that is not feasible
Ensure that any subcontractor that handles PHI on its behalf agrees to the same restrictions and conditions

A BAA does not, on its own, satisfy the Security Rule. The Covered Entity still has to do its own risk analysis, design its own administrative safeguards, train its own workforce, and document its own decisions. The Security Rule applies directly to both Covered Entities and Business Associates (§ 164.302), and the BAA adds the contractual terms that § 164.504(e) requires.

Which AI vendors sign BAAs and on what tier

| Vendor | BAA-eligible | Consumer / free tier | Profile | |---|---|---|---| | OpenAI | Yes: the API Platform (an organisation admin accepts the standard BAA in settings, which requires an established history of API usage, otherwise email baa@openai.com; no enterprise agreement required), ChatGPT Enterprise and ChatGPT Edu on sales-managed accounts, ChatGPT for Healthcare (launched January 2026) and ChatGPT for Clinicians (an individual BAA in the product, free for verified US clinicians) | No: Free, Go, Plus and Pro, and OpenAI states that it does not offer a BAA for ChatGPT Business (formerly ChatGPT Team) | OpenAI | | Azure OpenAI | Yes: Azure OpenAI in Microsoft Foundry is one of the Foundry Models sold by Azure, which Microsoft's Azure Compliance Offerings (September 2026) list in scope for the HIPAA BAA. Microsoft makes the BAA available by default through its Product Terms and DPA to customers who are covered entities or business associates, with no separate signature | No: Previews (the DPA's HIPAA terms do not apply to them unless a Preview allows personal data processing), and components operated by third-party model providers | OpenAI | | Anthropic (Claude) | Yes: the first-party Claude API and Claude Enterprise. On Enterprise the Primary Owner activates HIPAA compliance in organisation settings and accepts the BAA. Anthropic's own pages differ on how the API BAA is enabled and on whether Claude in Microsoft Foundry is covered (see the FAQ below). Covered Models require 30-day retention and are not available with ZDR unless Anthropic authorises it | No: Free, Pro and Max, the Claude Console, Cowork in the cloud and beta features such as Claude in Office. Anthropic does not name Team among its HIPAA-ready services | Anthropic | | Google Gemini | Yes: Gemini Enterprise Agent Platform (formerly Vertex AI) and Gemini Enterprise on Google Cloud, and in Google Workspace the Gemini app (excluding Gemini in Google Chrome), Gemini in Google Workspace and the Gemini Mac app, once a super administrator accepts the BAA (any Workspace edition except the legacy free edition). Google's terms restrict clinical use of these generative AI services | No: consumer Gemini on personal accounts, the Gemini Developer API (free or paid, including AI Studio), Gemini Notebook in Workspace, Gemini in Chrome | Google Gemini | | Microsoft 365 Copilot | Yes: Microsoft Copilot (formerly Microsoft 365 Copilot) and Copilot Chat are listed in scope for Microsoft's BAA, which the DPA includes by default for covered-entity and business-associate customers. Generated web search queries are excluded | No: Copilot in Microsoft 365 Family, Personal, consumer | Microsoft 365 Copilot | | Perplexity | Yes: the Enterprise Terms (s 5.2) and API Terms (s 6.2) prohibit PHI unless a BAA has been executed with Perplexity. No BAA template is published, so confirm which products and models it covers. The trust portal holds a HIPAA Security Rule gap assessment as of 1 March 2026 (the API documentation refers to a 2025 assessment) | No: Free, Pro and Max (consumer plans) | Perplexity | | ElevenLabs | Yes, Enterprise only, arranged through the account representative. The BAA covers the Text to Speech API, the Speech to Text API and ElevenAgents, each only with Zero Retention Mode enabled, and for ElevenAgents only conversation content (agent configuration data is outside it) | No: Free, Starter, Creator, Pro, Scale and Business | ElevenLabs |

Across the table, the BAA is offered on enterprise or API products and is reached through sales or an acceptance flow in the product or its settings. ChatGPT for Clinicians is the one free product with a BAA. A Covered Entity or Business Associate that discloses PHI to a vendor without a BAA makes a disclosure the Privacy Rule does not permit, which is presumed to be a breach (§ 164.402), and a BAA signed later does not undo it.

What the BAA does not cover

The BAA addresses the contractual relationship. The buyer still owns:

1. The Security Rule risk analysis

Required by 45 CFR § 164.308(a)(1)(ii)(A). The Covered Entity has to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic PHI. Adding an AI vendor to the workflow is an operational change affecting the security of electronic PHI. The Security Rule requires a periodic technical and nontechnical evaluation in response to such changes (§ 164.308(a)(8)), and the risk analysis needs to cover the new data flows.

2. The minimum-necessary rule

45 CFR § 164.502(b). When using or disclosing PHI, or requesting it from another Covered Entity or Business Associate, a Covered Entity or Business Associate must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose. The rule does not apply to some disclosures, including disclosures to or requests by a health care provider for treatment (§ 164.502(b)(2)). A clinical summarisation tool pointed at a full chart processes far more PHI than a tool that summarises only the consult note, so the input set is a buyer-side design decision.

3. Workforce training

45 CFR §§ 164.530(b) and 164.308(a)(5). A Covered Entity must train all members of its workforce on its policies and procedures with respect to PHI, as necessary and appropriate for their functions, and must run a security awareness and training programme for its whole workforce. Where adding an AI tool materially changes those policies or procedures, each workforce member whose functions are affected must be trained within a reasonable period after the change takes effect (§ 164.530(b)(2)(i)(C)).

4. Audit controls

45 CFR § 164.312(b). The CE has to implement mechanisms that record and examine activity in information systems that contain or use electronic PHI, and must regularly review records of information system activity, such as audit logs and access reports (§ 164.308(a)(1)(ii)(D)). The AI vendor's logs record activity on its side; the CE's own audit procedures cover the rest.

5. Breach notification

45 CFR §§ 164.400-414. The CE must notify each affected individual without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured PHI (§ 164.404(b)). A breach involving more than 500 residents of a State or jurisdiction also requires notice to prominent media outlets serving that State or jurisdiction, within the same period (§ 164.406). The CE must also notify HHS: at the same time as the individuals for a breach involving 500 or more individuals, and, for breaches involving fewer than 500 individuals, keep a log and notify HHS not later than 60 days after the end of each calendar year of the breaches discovered during that year (§ 164.408(c)). A law enforcement official's statement can delay any of these notices (§ 164.412). An AI vendor acting as a Business Associate must notify the CE of a breach without unreasonable delay and no later than 60 calendar days after discovering it (§ 164.410), and the CE then gives its own notices.

6. State law

HIPAA preempts contrary state law, but not where the state law relates to the privacy of individually identifiable health information and is more stringent than the Privacy Rule, among other exceptions (45 CFR § 160.203). State laws on health information, biometric data or data security can therefore add obligations beyond HIPAA, and the BAA does not address them.

The HIPAA procurement checklist for AI tools

The checklist below assumes a US Covered Entity buying an AI tool that will process PHI.

Confirm BAA eligibility on the specific product and tier. Check the vendor's BAA documentation for the exact product, plan and feature the deployment will use, and get written confirmation from the vendor where that documentation does not state the position or where the vendor's own sources disagree.
Execute the BAA before any PHI enters the system. Disclosing real PHI to a vendor for a pilot, demo or proof of concept without a BAA is a disclosure the Privacy Rule does not permit, and it is presumed to be a breach unless a risk assessment shows a low probability that the PHI has been compromised (§ 164.402).
Run a fresh Security Rule risk analysis covering the AI workflow. A risk analysis completed before the AI tool was introduced will not have assessed the risks the tool adds.
Apply minimum-necessary on the input side. Decide what PHI elements the deployment actually needs and prevent the rest from reaching the vendor.
Document the human oversight checkpoint. HIPAA does not require one, but clinician review of AI output is advisable for any deployment that supports clinical decisions.
Train workforce on the new policy. Software training and HIPAA policy training are different artifacts and both need to be delivered.
Set audit cadence. Decide who reviews vendor and system logs, how often, and how issues are escalated. The Security Rule requires regular review of information system activity records (§ 164.308(a)(1)(ii)(D)).
Document state-law exposure. Identify the state health-information, biometric and data-security laws that apply to the deployment and record each one separately.

The non-US healthcare angle

UK and EU healthcare buyers are subject to their own regimes:

UK: the UK GDPR and the Data Protection Act 2018. In England, all organisations that have access to NHS patient data and systems must also use the NHS Data Security and Protection Toolkit (DSPT), and the National Data Guardian's Caldicott Principles apply to confidential information used within health and social care organisations and when it is shared.
EU: the GDPR, under which data concerning health is special-category data (Article 9(1)), together with national health-data laws.

The BAA does not satisfy any of these. UK and EU buyers should run their AI vendor reviews under the matching local regime, not against the HIPAA structure.

Frequently asked questions

Is OpenAI HIPAA compliant? OpenAI will sign a BAA, which is what HIPAA requires of a vendor that processes PHI. On the API Platform, an organisation admin can accept the standard BAA in settings without an enterprise agreement, although self-serve enrolment requires an established history of API usage (an organisation that is not yet eligible can contact baa@openai.com). A BAA is also available for sales-managed ChatGPT Enterprise and ChatGPT Edu accounts and through ChatGPT for Healthcare (launched January 2026). ChatGPT for Clinicians, which is free for verified US clinicians, lets an individual clinician sign a BAA for their own workspace in the product. OpenAI does not offer a BAA for ChatGPT Business (formerly ChatGPT Team), and the consumer plans (Free, Go, Plus and Pro) are not among its BAA routes. A BAA makes OpenAI usable for PHI; your own Security Rule work still has to be done on top. See the OpenAI profile.

Is Azure OpenAI HIPAA compliant? Microsoft covers Azure OpenAI under its HIPAA BAA. Azure OpenAI models are Foundry Models sold by Azure, and Microsoft's Azure Compliance Offerings document (September 2026) lists Foundry Models in scope for the HIPAA BAA, limited to models sold by Azure and excluding components operated by third-party model providers unless Microsoft states otherwise. Microsoft makes the BAA available through its Product Terms and DPA by default to customers who are covered entities or business associates, so there is no separate BAA to sign. The DPA's HIPAA terms do not apply to Previews unless a Preview allows personal data processing, so check the release status of each model and feature before sending PHI to it.

Does Anthropic (Claude) sign a BAA? Yes. Anthropic's privacy centre gives the first-party API, Claude in Microsoft Foundry and Enterprise plans as examples of the HIPAA-ready services its BAA covers. On Claude Enterprise, the Primary Owner activates HIPAA compliance under Data and privacy in the organisation settings and accepts the BAA; a standard Enterprise plan has no BAA coverage until that is done. Cowork in local mode is covered only with the HIPAA configuration applied, and Claude Code only with that configuration or with zero data retention for Claude Code (available to qualified accounts). Anthropic's own pages differ on two points. Its privacy centre article on BAAs (updated 14 October 2026) says that to use the API with PHI the Primary Owner signs the BAA and then asks Anthropic to turn it on, while its API documentation (checked 15 October 2026) says most organisations can accept the standard BAA themselves in the Claude Console. The same documentation says HIPAA readiness is not available on Microsoft Foundry, which the privacy centre article lists as covered. Covered Models (models Anthropic designates for additional safeguards) require 30-day data retention and are not available with zero data retention unless Anthropic authorises it. The BAA does not cover the consumer Free, Pro and Max plans, the Claude Console, Cowork in the cloud or beta features such as Claude in Office, and Anthropic does not name Claude Team among its HIPAA-ready services. Claude on Amazon Bedrock and Google Cloud falls under those platforms' own compliance terms. See the Anthropic profile.

Is Google Gemini HIPAA compliant? Gemini can be used with PHI only on the services Google lists under its BAA, and only once the BAA is in place. On Google Cloud these include Gemini Enterprise Agent Platform (formerly Vertex AI), with Generative AI on Agent Platform, and Gemini Enterprise. The Google Cloud BAA covers Google Cloud's infrastructure and the listed services, and Google tells customers not to use pre-GA offerings with PHI. In Google Workspace, Gemini in Google Workspace, the Gemini app (excluding Gemini in Google Chrome) and the Gemini Mac app are covered on any edition except the legacy free edition, once a super administrator accepts the BAA in the Admin console. Gemini Notebook in Workspace, Gemini in Chrome, the Gemini Developer API (free or paid) and consumer Gemini on a personal account are not covered. Google's Cloud and Workspace terms also restrict use of these generative AI services for clinical purposes, although non-clinical research, scheduling and other administrative tasks are not restricted. See the Google Gemini profile.

Does Perplexity offer a BAA? Perplexity's Enterprise Terms (s 5.2) and API Terms (s 6.2) both prohibit processing PHI unless the customer and Perplexity have executed a BAA, and the clause has been in the Enterprise Terms since at least the version of 23 May 2025. Perplexity does not publish a BAA template, so confirm in writing which products and models a BAA covers, particularly where the Agent API sends queries to third-party model providers. Its trust portal holds a HIPAA Security Rule gap assessment by Insight Assurance as of 1 March 2026, while its API documentation refers to a 2025 HIPAA gap assessment. The consumer Free, Pro and Max plans follow Perplexity's consumer data policy rather than the Enterprise or API terms. See the Perplexity profile.

Is Microsoft 365 Copilot HIPAA compliant? Microsoft lists Microsoft Copilot (formerly Microsoft 365 Copilot) and Microsoft Copilot Chat in scope for its BAA, which the DPA includes by default for covered-entity and business-associate customers. Generated web search queries sent to Bing are outside HIPAA compliance, so a healthcare tenant should decide whether to allow web search. Copilot in Microsoft 365 Family, Personal, and other consumer plans is not covered. See the Microsoft 365 Copilot profile.