plaud.ai/blogs/articles/is-chatgpt-hipaa-compliant

**Standard consumer versions of ChatGPT are not HIPAA compliant.** [[1]](https://www.hipaajournal.com/is-chatgpt-hipaa-compliant/) However, OpenAI offers specialized tiers—specifically **ChatGPT Enterprise** and **ChatGPT for Healthcare** —that can support HIPAA-compliant use. These tiers only become compliant once your organization signs a formal **Business Associate Agreement (BAA)** with OpenAI.[](https://help.openai.com/en/articles/20001046-chatgpt-for-healthcare) [[1]](https://help.openai.com/en/articles/20001046-chatgpt-for-healthcare)[[2]](https://witness.ai/blog/chatgpt-enterprise-hipaa-compliance/)[[3]](https://www.plaud.ai/blogs/articles/is-chatgpt-hipaa-compliant) The Compliance Breakdown | ChatGPT Version | HIPAA Eligible? | BAA Available? | Data Used for Training? | |---|---|---|---| | **Free / Plus / Pro** | **No** | No | Yes (unless opted out) | | **Team / Business** | **No** | No | No | | **Enterprise / Edu** | **Yes** | Yes | No | | **ChatGPT for Healthcare** | **Yes** | Yes | No | | **OpenAI API Platform** | **Yes** | Yes | No | Why Consumer ChatGPT Fails HIPAA Standards - **No Business Associate Agreement:** OpenAI will not sign a BAA for Free, Plus, or Team accounts. Sharing Protected Health Information (PHI) without a BAA is an automatic HIPAA violation.[](https://www.hipaavault.com/resources/hipaa-compliant-chatgpt/) [[1]](https://www.hipaavault.com/resources/hipaa-compliant-chatgpt/)[[2]](https://www.hipaajournal.com/is-chatgpt-hipaa-compliant/)[[3]](https://compyl.com/blog/is-chatgpt-hipaa-compliant/) - **Data Training Risks:** Standard tiers use your prompts to train future AI models. This means entered patient data could theoretically resurface in responses to other users.[](https://www.hipaavault.com/resources/hipaa-compliant-chatgpt/) [[1]](https://www.hipaavault.com/resources/hipaa-compliant-chatgpt/)[[2]](https://www.hipaajournal.com/is-chatgpt-hipaa-compliant/)[[3]](https://www.strac.io/blog/is-chatgpt-hipaa-compliant)[[4]](https://www.medesk.net/en/blog/hipaa-compliant-medical-dictation/)[[5]](https://witness.ai/blog/chatgpt-enterprise-hipaa-compliance/) - **Lack of Access Control:** Consumer accounts lack the audit trails, access management, and strict encryption controls required by the HIPAA Security Rule.[](https://www.strac.io/blog/is-chatgpt-hipaa-compliant) [[1]](https://www.strac.io/blog/is-chatgpt-hipaa-compliant)[[2]](https://www.hipaajournal.com/is-chatgpt-hipaa-compliant/) How to Use OpenAI Technologies Compliantly To legally process PHI using OpenAI, you must execute a specific setup:[](https://www.paubox.com/blog/how-chatgpt-can-support-hipaa-compliant-healthcare-communication) [[1]](https://www.paubox.com/blog/how-chatgpt-can-support-hipaa-compliant-healthcare-communication)[[2]](https://www.plaud.ai/blogs/articles/is-chatgpt-hipaa-compliant)[[3]](https://www.brellium.com/newsroom/is-chatgpt-hipaa-compliant-the-truth-about-patient-data-security) 1. **Upgrade to Eligible Tiers:** Procure ChatGPT Enterprise or use the OpenAI API platform. 2. **Execute a BAA:** Contact OpenAI directly to sign a BAA before inputting any sensitive data. 3. **Configure Internal Safeguards:** A BAA only covers OpenAI's backend. Your organization remains fully responsible for user access controls, multi-factor authentication, employee training, and audit logging.[](https://www.hipaavault.com/resources/hipaa-compliant-hosting-insights/hipaa-compliant-ai-chatbot/) [[1]](https://www.hipaavault.com/resources/hipaa-compliant-hosting-insights/hipaa-compliant-ai-chatbot/)[[2]](https://witness.ai/blog/chatgpt-enterprise-hipaa-compliance/)[[3]](https://compyl.com/blog/is-chatgpt-hipaa-compliant/)[[4]](https://www.plaud.ai/blogs/articles/is-chatgpt-hipaa-compliant) If you are looking to deploy AI in a medical setting, what is your **specific use case** (e.g., patient communication, medical scribing, or clinical research)? I can help you evaluate **pre-built HIPAA-compliant alternatives** or map out the necessary **security configurations** for your workflow. Standard consumer versions of ChatGPT are not HIPAA compliant. **Standard consumer versions of ChatGPT are not HIPAA compliant.** [[1]](https://www.hipaajournal.com/is-chatgpt-hipaa-compliant/) In most cases the answer is no. Most ChatGPT-based services cannot be configured to prevent unauthorized access, use, or disclosur... However, OpenAI offers specialized tiers—specifically ChatGPT Enterprise and ChatGPT for Healthcare —that can support HIPAA-compliant use. These tiers only become compliant once your organization signs a formal Business Associate Agreement (BAA) with OpenAI. However, OpenAI offers specialized tiers—specifically **ChatGPT Enterprise** and **ChatGPT for Healthcare** —that can support HIPAA-compliant use. These tiers only become compliant once your organization signs a formal **Business Associate Agreement (BAA)** with OpenAI.[](https://help.openai.com/en/articles/20001046-chatgpt-for-healthcare) [[1]](https://help.openai.com/en/articles/20001046-chatgpt-for-healthcare)[[2]](https://witness.ai/blog/chatgpt-enterprise-hipaa-compliance/)[[3]](https://www.plaud.ai/blogs/articles/is-chatgpt-hipaa-compliant) Support for HIPAA-compliant use ChatGPT for Healthcare supports HIPAA-compliant use through: Enterprise security controls. No trai... Key Takeaways * OpenAI's ChatGPT Enterprise, the API Platform, and ChatGPT for Healthcare support BAAs. Consumer tiers such as Fre... Which version of ChatGPT meets HIPAA requirements? ChatGPT Enterprise and ChatGPT for Healthcare (launched January 2026) can be HI... The Compliance Breakdown | ChatGPT Version | HIPAA Eligible? | BAA Available? | Data Used for Training? | |---|---|---|---| | **Free / Plus / Pro** | **No** | No | Yes (unless opted out) | | **Team / Business** | **No** | No | No | | **Enterprise / Edu** | **Yes** | Yes | No | | **ChatGPT for Healthcare** | **Yes** | Yes | No | | **OpenAI API Platform** | **Yes** | Yes | No | No Business Associate Agreement: OpenAI will not sign a BAA for Free, Plus, or Team accounts. Sharing Protected Health Information (PHI) without a BAA is an automatic HIPAA violation. Data Training Risks: Standard tiers use your prompts to train future AI models. This means entered patient data could theoretically resurface in responses to other users. Lack of Access Control: Consumer accounts lack the audit trails, access management, and strict encryption controls required by the HIPAA Security Rule. - **No Business Associate Agreement:** OpenAI will not sign a BAA for Free, Plus, or Team accounts. Sharing Protected Health Information (PHI) without a BAA is an automatic HIPAA violation.[](https://www.hipaavault.com/resources/hipaa-compliant-chatgpt/) [[1]](https://www.hipaavault.com/resources/hipaa-compliant-chatgpt/)[[2]](https://www.hipaajournal.com/is-chatgpt-hipaa-compliant/)[[3]](https://compyl.com/blog/is-chatgpt-hipaa-compliant/) - **Data Training Risks:** Standard tiers use your prompts to train future AI models. This means entered patient data could theoretically resurface in responses to other users.[](https://www.hipaavault.com/resources/hipaa-compliant-chatgpt/) [[1]](https://www.hipaavault.com/resources/hipaa-compliant-chatgpt/)[[2]](https://www.hipaajournal.com/is-chatgpt-hipaa-compliant/)[[3]](https://www.strac.io/blog/is-chatgpt-hipaa-compliant)[[4]](https://www.medesk.net/en/blog/hipaa-compliant-medical-dictation/)[[5]](https://witness.ai/blog/chatgpt-enterprise-hipaa-compliance/) - **Lack of Access Control:** Consumer accounts lack the audit trails, access management, and strict encryption controls required by the HIPAA Security Rule.[](https://www.strac.io/blog/is-chatgpt-hipaa-compliant) [[1]](https://www.strac.io/blog/is-chatgpt-hipaa-compliant)[[2]](https://www.hipaajournal.com/is-chatgpt-hipaa-compliant/) Why Free ChatGPT Is Not HIPAA Compliant. The HIPAA Insider Show team tested this directly — asking ChatGPT, Claude, and Gemini the... Up until recently, the answer to this question was a definite “no.” OpenAI was unwilling to sign a Business Associate Agreement. A... TL;DR * ChatGPT's Compatibility with HIPAA: ChatGPT doesn't inherently meet HIPAA compliance for handling Protected Health Informa... ChatGPT (standard subscription) explicitly states that OpenAI may use your inputs to train future models. Entering patient informa... To legally process PHI using OpenAI, you must execute a specific setup: To legally process PHI using OpenAI, you must execute a specific setup:[](https://www.paubox.com/blog/how-chatgpt-can-support-hipaa-compliant-healthcare-communication) [[1]](https://www.paubox.com/blog/how-chatgpt-can-support-hipaa-compliant-healthcare-communication)[[2]](https://www.plaud.ai/blogs/articles/is-chatgpt-hipaa-compliant)[[3]](https://www.brellium.com/newsroom/is-chatgpt-hipaa-compliant-the-truth-about-patient-data-security) ChatGPT is not HIPAA compliant in its standard consumer version. The Health Insurance Portability and Accountability Act (HIPAA) r... No, ChatGPT is not inherently HIPAA compliant. It requires significant customizations and a Business Associate Agreement (BAA) wit... If you are looking to deploy AI in a medical setting, what is your specific use case (e.g., patient communication, medical scribing, or clinical research)? I can help you evaluate pre-built HIPAA-compliant alternatives or map out the necessary security configurations for your workflow. If you are looking to deploy AI in a medical setting, what is your **specific use case** (e.g., patient communication, medical scribing, or clinical research)? I can help you evaluate **pre-built HIPAA-compliant alternatives** or map out the necessary **security configurations** for your workflow. Reusable templates to automate workflows: Shared templates for common tasks like drafting discharge summaries, patient instruction... Is ChatGPT HIPAA Compliant? Standard ChatGPT versions (Free, Plus, Pro, Team) are not HIPAA compliant and should not be used with ... FAQ: HIPAA-Compliant AI Chatbots * Is ChatGPT HIPAA compliant? Only ChatGPT Enterprise or Teams under a signed BAA. * Can I use fr...

**Standard consumer versions of ChatGPT are not HIPAA compliant.** [[1]](https://www.hipaajournal.com/is-chatgpt-hipaa-compliant/) However, OpenAI offers specialized tiers—specifically **ChatGPT Enterprise** and **ChatGPT for Healthcare** —that can support HIPAA-compliant use. These tiers only become compliant once your organization signs a formal **Business Associate Agreement (BAA)** with OpenAI.[](https://help.openai.com/en/articles/20001046-chatgpt-for-healthcare) [[1]](https://help.openai.com/en/articles/20001046-chatgpt-for-healthcare)[[2]](https://witness.ai/blog/chatgpt-enterprise-hipaa-compliance/)[[3]](https://www.plaud.ai/blogs/articles/is-chatgpt-hipaa-compliant) The Compliance Breakdown | ChatGPT Version | HIPAA Eligible? | BAA Available? | Data Used for Training? | |---|---|---|---| | **Free / Plus / Pro** | **No** | No | Yes (unless opted out) | | **Team / Business** | **No** | No | No | | **Enterprise / Edu** | **Yes** | Yes | No | | **ChatGPT for Healthcare** | **Yes** | Yes | No | | **OpenAI API Platform** | **Yes** | Yes | No | Why Consumer ChatGPT Fails HIPAA Standards - **No Business Associate Agreement:** OpenAI will not sign a BAA for Free, Plus, or Team accounts. Sharing Protected Health Information (PHI) without a BAA is an automatic HIPAA violation.[](https://www.hipaavault.com/resources/hipaa-compliant-chatgpt/) [[1]](https://www.hipaavault.com/resources/hipaa-compliant-chatgpt/)[[2]](https://www.hipaajournal.com/is-chatgpt-hipaa-compliant/)[[3]](https://compyl.com/blog/is-chatgpt-hipaa-compliant/) - **Data Training Risks:** Standard tiers use your prompts to train future AI models. This means entered patient data could theoretically resurface in responses to other users.[](https://www.hipaavault.com/resources/hipaa-compliant-chatgpt/) [[1]](https://www.strac.io/blog/is-chatgpt-hipaa-compliant)[[2]](https://www.medesk.net/en/blog/hipaa-compliant-medical-dictation/) - **Lack of Access Control:** Consumer accounts lack the audit trails, access management, and strict encryption controls required by the HIPAA Security Rule.[](https://www.strac.io/blog/is-chatgpt-hipaa-compliant) How to Use OpenAI Technologies Compliantly To legally process PHI using OpenAI, you must execute a specific setup:[](https://www.paubox.com/blog/how-chatgpt-can-support-hipaa-compliant-healthcare-communication) [[1]](https://www.paubox.com/blog/how-chatgpt-can-support-hipaa-compliant-healthcare-communication)[[2]](https://www.brellium.com/newsroom/is-chatgpt-hipaa-compliant-the-truth-about-patient-data-security) 1. **Upgrade to Eligible Tiers:** Procure ChatGPT Enterprise or use the OpenAI API platform. 2. **Execute a BAA:** Contact OpenAI directly to sign a BAA before inputting any sensitive data. 3. **Configure Internal Safeguards:** A BAA only covers OpenAI's backend. Your organization remains fully responsible for user access controls, multi-factor authentication, employee training, and audit logging.[](https://www.hipaavault.com/resources/hipaa-compliant-hosting-insights/hipaa-compliant-ai-chatbot/) [[1]](https://www.hipaavault.com/resources/hipaa-compliant-hosting-insights/hipaa-compliant-ai-chatbot/) If you are looking to deploy AI in a medical setting, what is your **specific use case** (e.g., patient communication, medical scribing, or clinical research)? I can help you evaluate **pre-built HIPAA-compliant alternatives** or map out the necessary **security configurations** for your workflow. Standard consumer versions of ChatGPT are not HIPAA compliant. **Standard consumer versions of ChatGPT are not HIPAA compliant.** [[1]](https://www.hipaajournal.com/is-chatgpt-hipaa-compliant/) In most cases the answer is no. Most ChatGPT-based services cannot be configured to prevent unauthorized access, use, or disclosur... However, OpenAI offers specialized tiers—specifically ChatGPT Enterprise and ChatGPT for Healthcare —that can support HIPAA-compliant use. These tiers only become compliant once your organization signs a formal Business Associate Agreement (BAA) with OpenAI. However, OpenAI offers specialized tiers—specifically **ChatGPT Enterprise** and **ChatGPT for Healthcare** —that can support HIPAA-compliant use. These tiers only become compliant once your organization signs a formal **Business Associate Agreement (BAA)** with OpenAI.[](https://help.openai.com/en/articles/20001046-chatgpt-for-healthcare) [[1]](https://help.openai.com/en/articles/20001046-chatgpt-for-healthcare)[[2]](https://witness.ai/blog/chatgpt-enterprise-hipaa-compliance/)[[3]](https://www.plaud.ai/blogs/articles/is-chatgpt-hipaa-compliant) Support for HIPAA-compliant use ChatGPT for Healthcare supports HIPAA-compliant use through: Enterprise security controls. No trai... Key Takeaways * OpenAI's ChatGPT Enterprise, the API Platform, and ChatGPT for Healthcare support BAAs. Consumer tiers such as Fre... Which version of ChatGPT meets HIPAA requirements? ChatGPT Enterprise and ChatGPT for Healthcare (launched January 2026) can be HI... The Compliance Breakdown | ChatGPT Version | HIPAA Eligible? | BAA Available? | Data Used for Training? | |---|---|---|---| | **Free / Plus / Pro** | **No** | No | Yes (unless opted out) | | **Team / Business** | **No** | No | No | | **Enterprise / Edu** | **Yes** | Yes | No | | **ChatGPT for Healthcare** | **Yes** | Yes | No | | **OpenAI API Platform** | **Yes** | Yes | No | No Business Associate Agreement: OpenAI will not sign a BAA for Free, Plus, or Team accounts. Sharing Protected Health Information (PHI) without a BAA is an automatic HIPAA violation. Data Training Risks: Standard tiers use your prompts to train future AI models. This means entered patient data could theoretically resurface in responses to other users. Lack of Access Control: Consumer accounts lack the audit trails, access management, and strict encryption controls required by the HIPAA Security Rule. - **No Business Associate Agreement:** OpenAI will not sign a BAA for Free, Plus, or Team accounts. Sharing Protected Health Information (PHI) without a BAA is an automatic HIPAA violation.[](https://www.hipaavault.com/resources/hipaa-compliant-chatgpt/) [[1]](https://www.hipaavault.com/resources/hipaa-compliant-chatgpt/)[[2]](https://www.hipaajournal.com/is-chatgpt-hipaa-compliant/)[[3]](https://compyl.com/blog/is-chatgpt-hipaa-compliant/) - **Data Training Risks:** Standard tiers use your prompts to train future AI models. This means entered patient data could theoretically resurface in responses to other users.[](https://www.hipaavault.com/resources/hipaa-compliant-chatgpt/) [[1]](https://www.strac.io/blog/is-chatgpt-hipaa-compliant)[[2]](https://www.medesk.net/en/blog/hipaa-compliant-medical-dictation/) - **Lack of Access Control:** Consumer accounts lack the audit trails, access management, and strict encryption controls required by the HIPAA Security Rule.[](https://www.strac.io/blog/is-chatgpt-hipaa-compliant) Why Free ChatGPT Is Not HIPAA Compliant. The HIPAA Insider Show team tested this directly — asking ChatGPT, Claude, and Gemini the... Up until recently, the answer to this question was a definite “no.” OpenAI was unwilling to sign a Business Associate Agreement. A... TL;DR * ChatGPT's Compatibility with HIPAA: ChatGPT doesn't inherently meet HIPAA compliance for handling Protected Health Informa... ChatGPT (standard subscription) explicitly states that OpenAI may use your inputs to train future models. Entering patient informa... To legally process PHI using OpenAI, you must execute a specific setup: To legally process PHI using OpenAI, you must execute a specific setup:[](https://www.paubox.com/blog/how-chatgpt-can-support-hipaa-compliant-healthcare-communication) [[1]](https://www.paubox.com/blog/how-chatgpt-can-support-hipaa-compliant-healthcare-communication)[[2]](https://www.brellium.com/newsroom/is-chatgpt-hipaa-compliant-the-truth-about-patient-data-security) ChatGPT is not HIPAA compliant in its standard consumer version. The Health Insurance Portability and Accountability Act (HIPAA) r... No, ChatGPT is not inherently HIPAA compliant. It requires significant customizations and a Business Associate Agreement (BAA) wit... If you are looking to deploy AI in a medical setting, what is your specific use case (e.g., patient communication, medical scribing, or clinical research)? I can help you evaluate pre-built HIPAA-compliant alternatives or map out the necessary security configurations for your workflow. If you are looking to deploy AI in a medical setting, what is your **specific use case** (e.g., patient communication, medical scribing, or clinical research)? I can help you evaluate **pre-built HIPAA-compliant alternatives** or map out the necessary **security configurations** for your workflow. Reusable templates to automate workflows: Shared templates for common tasks like drafting discharge summaries, patient instruction... Is ChatGPT HIPAA Compliant? Standard ChatGPT versions (Free, Plus, Pro, Team) are not HIPAA compliant and should not be used with ... FAQ: HIPAA-Compliant AI Chatbots * Is ChatGPT HIPAA compliant? Only ChatGPT Enterprise or Teams under a signed BAA. * Can I use fr...

Standard consumer versions of ChatGPT (Free, Plus, and Team) are **not** HIPAA compliant . However, OpenAI offers high-tier business and healthcare plans—such as ChatGPT Enterprise and **ChatGPT for Healthcare** —that can support HIPAA compliance if your organization signs a Business Associate Agreement (BAA).[](https://help.openai.com/en/articles/20001046-chatgpt-for-healthcare) [[1]](https://help.openai.com/en/articles/20001046-chatgpt-for-healthcare)[[2]](https://bastiongpt.com/post/is-chatgpt-hipaa-compliant-what-healthcare-professionals-must-know)[[3]](https://www.plaud.ai/blogs/articles/is-chatgpt-hipaa-compliant) Most users on [Reddit](https://www.reddit.com/r/hipaa/comments/1rrh7b0/chatgpt_hipaa_violation/) agree that using standard free or consumer AI tools to process patient notes or identifiable information is a direct HIPAA violation.[](https://www.reddit.com/r/hipaa/comments/1rrh7b0/chatgpt_hipaa_violation/) [[1]](https://www.reddit.com/r/hipaa/comments/1rrh7b0/chatgpt_hipaa_violation/) Compliance Status by Tier - **Free, Plus, and Team Plans:** - Not HIPAA compliant. - OpenAI does not sign a BAA for these tiers. - Prompts may be used to train models unless you explicitly opt out (where available).[](https://bastiongpt.com/post/is-chatgpt-hipaa-compliant-what-healthcare-professionals-must-know) [[1]](https://www.hipaatizer.com/blog/is-chatpgt-hipaa-compliant/)[[2]](https://www.hipaajournal.com/is-chatgpt-hipaa-compliant/) - **Enterprise and Healthcare Plans / API:** - Can support HIPAA compliance. - Requires a signed BAA with OpenAI. - Data is encrypted and inputs are excluded from model training.[](https://help.openai.com/en/articles/20001046-chatgpt-for-healthcare) [[1]](https://www.hipaavault.com/resources/hipaa-compliant-chatgpt/) Requirements for Compliant Use Even with a paid tier and a signed BAA, the technology is only part of the equation. Your organization must still manage:[](https://www.plaud.ai/blogs/articles/is-chatgpt-hipaa-compliant) - Role-based access controls and single sign-on (SSO) - Proper internal policies and staff training - Disabling external or unsafe features (like web browsing or unsupported plugins) when handling sensitive data[](https://openai.com/index/openai-for-healthcare/) [[1]](https://openai.com/index/openai-for-healthcare/)[[2]](https://www.hipaavault.com/resources/hipaa-compliant-hosting-insights/hipaa-compliant-ai-chatbot/)[[3]](https://www.accountablehq.com/post/is-chatgpt-hipaa-compliant-what-you-need-to-know-about-phi-and-baas) If you'd like, tell me: - **Which ChatGPT plan** your organization currently uses - **What type of data** (or workflow) you plan to run through the AI I can help you figure out if your current setup meets safety rules. Standard consumer versions of ChatGPT (Free, Plus, and Team) are not HIPAA compliant. However, OpenAI offers high-tier business and healthcare plans—such as ChatGPT Enterprise and ChatGPT for Healthcare —that can support HIPAA compliance if your organization signs a Business Associate Agreement (BAA). ChatGPT for Healthcare * Overview. ChatGPT for Healthcare is an enterprise version of ChatGPT built for clinicians, administrators... Is ChatGPT HIPAA Compliant? Standard ChatGPT versions (Free, Plus, Pro, Team) are not HIPAA compliant and should not be used with ... Which version of ChatGPT meets HIPAA requirements? ChatGPT Enterprise and ChatGPT for Healthcare (launched January 2026) can be HI... Most users on Reddit agree that using standard free or consumer AI tools to process patient notes or identifiable information is a direct HIPAA violation. Most users on [Reddit](https://www.reddit.com/r/hipaa/comments/1rrh7b0/chatgpt_hipaa_violation/) agree that using standard free or consumer AI tools to process patient notes or identifiable information is a direct HIPAA violation.[](https://www.reddit.com/r/hipaa/comments/1rrh7b0/chatgpt_hipaa_violation/) [[1]](https://www.reddit.com/r/hipaa/comments/1rrh7b0/chatgpt_hipaa_violation/) HIPAA Violation with AI: Using standard ChatGPT or similar AI tools to rewrite medical notes containing Protected Health Informati... Free, Plus, and Team Plans:Not HIPAA compliant. OpenAI does not sign a BAA for these tiers. Prompts may be used to train models unless you explicitly opt out (where available). Not HIPAA compliant. OpenAI does not sign a BAA for these tiers. Prompts may be used to train models unless you explicitly opt out (where available). Enterprise and Healthcare Plans / API:Can support HIPAA compliance. Requires a signed BAA with OpenAI. Data is encrypted and inputs are excluded from model training. Can support HIPAA compliance. Requires a signed BAA with OpenAI. Data is encrypted and inputs are excluded from model training. - **Free, Plus, and Team Plans:** - Not HIPAA compliant. - OpenAI does not sign a BAA for these tiers. - Prompts may be used to train models unless you explicitly opt out (where available).[](https://bastiongpt.com/post/is-chatgpt-hipaa-compliant-what-healthcare-professionals-must-know) [[1]](https://www.hipaatizer.com/blog/is-chatpgt-hipaa-compliant/)[[2]](https://www.hipaajournal.com/is-chatgpt-hipaa-compliant/) - **Enterprise and Healthcare Plans / API:** - Can support HIPAA compliance. - Requires a signed BAA with OpenAI. - Data is encrypted and inputs are excluded from model training.[](https://help.openai.com/en/articles/20001046-chatgpt-for-healthcare) [[1]](https://www.hipaavault.com/resources/hipaa-compliant-chatgpt/) ChatGPT is not HIPAA Compliant on the Free, Plus, or Team plans. OpenAI does not sign a BAA for those tiers, so PHI should never g... In most cases the answer is no. Most ChatGPT-based services cannot be configured to prevent unauthorized access, use, or disclosur... ChatGPT Enterprise is a HIPAA-compliant version of ChatGPT that's designed for healthcare organizations. It offers the following f... Even with a paid tier and a signed BAA, the technology is only part of the equation. Your organization must still manage: Even with a paid tier and a signed BAA, the technology is only part of the equation. Your organization must still manage:[](https://www.plaud.ai/blogs/articles/is-chatgpt-hipaa-compliant) Role-based access controls and single sign-on (SSO) Proper internal policies and staff training Disabling external or unsafe features (like web browsing or unsupported plugins) when handling sensitive data - Role-based access controls and single sign-on (SSO) - Proper internal policies and staff training - Disabling external or unsafe features (like web browsing or unsupported plugins) when handling sensitive data[](https://openai.com/index/openai-for-healthcare/) [[1]](https://openai.com/index/openai-for-healthcare/)[[2]](https://www.hipaavault.com/resources/hipaa-compliant-hosting-insights/hipaa-compliant-ai-chatbot/)[[3]](https://www.accountablehq.com/post/is-chatgpt-hipaa-compliant-what-you-need-to-know-about-phi-and-baas) Reusable templates to automate workflows: Shared templates for common tasks like drafting discharge summaries, patient instruction... FAQ: HIPAA-Compliant AI Chatbots * Is ChatGPT HIPAA compliant? Only ChatGPT Enterprise or Teams under a signed BAA. * Can I use fr... Regulatory and Legal Considerations ... Consumer ChatGPT and ChatGPT Health aren't for PHI; HIPAA doesn't apply to them. HIPAA‑eli... If you'd like, tell me:Which ChatGPT plan your organization currently uses What type of data (or workflow) you plan to run through the AI I can help you figure out if your current setup meets safety rules. If you'd like, tell me: - **Which ChatGPT plan** your organization currently uses - **What type of data** (or workflow) you plan to run through the AI I can help you figure out if your current setup meets safety rules.

**No, standard versions of ChatGPT (Free, Plus, and Team) are not HIPAA compliant** . You cannot input Protected Health Information (PHI) into these tiers without violating federal law. However, OpenAI offers specialized plans that support HIPAA compliance if configured correctly.[](https://www.hipaavault.com/resources/is-chatgpt-hipaa-compliant/) [[1]](https://www.hipaavault.com/resources/is-chatgpt-hipaa-compliant/)[[2]](https://bastiongpt.com/post/is-chatgpt-hipaa-compliant-what-healthcare-professionals-must-know)[[3]](https://www.plaud.ai/blogs/articles/is-chatgpt-hipaa-compliant)[[4]](https://witness.ai/blog/chatgpt-enterprise-hipaa-compliance/) The Core Problem: The BAA Requirement Under the Health Insurance Portability and Accountability Act (HIPAA), covered entities must sign a **Business Associate Agreement (BAA)** with third-party vendors before sharing PHI.[](https://www.reddit.com/r/hipaa/comments/1rrh7b0/chatgpt_hipaa_violation/) [[1]](https://www.reddit.com/r/hipaa/comments/1rrh7b0/chatgpt_hipaa_violation/) - **Standard ChatGPT:** OpenAI **will not** sign a BAA for the Free, Plus, Team, or Pro tiers. Furthermore, consumer tiers may use your inputs to train their models unless you manually opt out.[](https://bastiongpt.com/post/is-chatgpt-hipaa-compliant-what-healthcare-professionals-must-know) [[1]](https://www.hipaajournal.com/is-chatgpt-hipaa-compliant/) - **Enterprise & Healthcare Tiers:** OpenAI **does** offer a BAA for **ChatGPT Enterprise**, **ChatGPT for Healthcare** , and their developer **API platform**.[](https://help.openai.com/en/articles/20001046-chatgpt-for-healthcare) [[1]](https://help.openai.com/en/articles/20001046-chatgpt-for-healthcare) HIPAA-Eligible Tiers vs. Consumer Tiers | Feature | Consumer Tiers (Free, Plus, Team) | Enterprise, Healthcare & API Tiers | |---|---|---| | **OpenAI Signs a BAA?** | ❌ No | Yes | | **Model Training** | ⚠️ Uses data by default (unless opted out) | ❌ Never trained on user data | | **Data Retention** | Standard retention terms apply | Enhanced admin & data deletion controls | | **Encryption** | Standard transit/rest encryption | Customer-managed keys & advanced logging | How to Use ChatGPT Compliantly in Healthcare Simply purchasing a high-level tier does not make you instantly compliant; compliance relies on how your organization manages the tool. If you intend to use OpenAI products in a clinical setting, you must take the following steps:[](https://www.hipaavault.com/resources/is-chatgpt-hipaa-compliant/) - **Execute a BAA** : You must officially sign a contract with OpenAI through an Enterprise account or their API platform before any data is entered.[](https://www.hipaavault.com/resources/is-chatgpt-hipaa-compliant/) - **De-identify the Data** : If you are using a standard, non-compliant version of ChatGPT, you must strip away all **18 HIPAA identifiers** (names, dates, geographic data, MRNs, etc.) *before* entering text. De-identified data is no longer considered PHI.[](https://www.reddit.com/r/hipaa/comments/1rrh7b0/chatgpt_hipaa_violation/) - **Enforce Strict Access Controls** : Implement Multi-Factor Authentication (MFA), role-based access limits, and single sign-on (SSO) so only authorized staff can access the workspace.[](https://openai.com/index/openai-for-healthcare/) [[1]](https://openai.com/index/openai-for-healthcare/)[[2]](https://www.hipaavault.com/resources/hipaa-compliant-hosting-insights/hipaa-compliant-ai-chatbot/) - **Maintain Audit Logs** : Keep thorough records of user activity and data tracking to satisfy HIPAA Security Rule auditing requirements.[](https://openai.com/index/openai-for-healthcare/) [[1]](https://www.youtube.com/watch?v=zEn5VB5z2RE) - **Train Your Workforce** : Provide clear, mandatory training so employees know exactly what types of information can and cannot be entered into conversational workflows.[](https://witness.ai/blog/chatgpt-enterprise-hipaa-compliance/) Are you looking to use ChatGPT for **clinical documentation**, **administrative work** , or **building a healthcare application** ? Tell me your exact use case, and I can provide tailored steps to keep your workflow secure. No, standard versions of ChatGPT (Free, Plus, and Team) are not HIPAA compliant. You cannot input Protected Health Information (PHI) into these tiers without violating federal law. However, OpenAI offers specialized plans that support HIPAA compliance if configured correctly. Quick Answer: Is ChatGPT HIPAA Compliant? Not by default. Public ChatGPT should not be treated as HIPAA compliant for routine PHI ... Is ChatGPT HIPAA Compliant? Standard ChatGPT versions (Free, Plus, Pro, Team) are not HIPAA compliant and should not be used with ... The direct answer: is standard ChatGPT HIPAA compliant? No. Free, Plus, and Team plans of ChatGPT are not HIPAA compliant, and usi... Key Takeaways * OpenAI's ChatGPT Enterprise, the API Platform, and ChatGPT for Healthcare support BAAs. Consumer tiers such as Fre... Under the Health Insurance Portability and Accountability Act (HIPAA), covered entities must sign a Business Associate Agreement (BAA) with third-party vendors before sharing PHI. Under the Health Insurance Portability and Accountability Act (HIPAA), covered entities must sign a **Business Associate Agreement (BAA)** with third-party vendors before sharing PHI.[](https://www.reddit.com/r/hipaa/comments/1rrh7b0/chatgpt_hipaa_violation/) [[1]](https://www.reddit.com/r/hipaa/comments/1rrh7b0/chatgpt_hipaa_violation/) What you're describing could trigger the Business Associate Agreement requirement under HIPAA, depending on what's actually in tho... Standard ChatGPT: OpenAI will not sign a BAA for the Free, Plus, Team, or Pro tiers. Furthermore, consumer tiers may use your inputs to train their models unless you manually opt out. Enterprise & Healthcare Tiers: OpenAI does offer a BAA for ChatGPT Enterprise, ChatGPT for Healthcare, and their developer API platform. - **Standard ChatGPT:** OpenAI **will not** sign a BAA for the Free, Plus, Team, or Pro tiers. Furthermore, consumer tiers may use your inputs to train their models unless you manually opt out.[](https://bastiongpt.com/post/is-chatgpt-hipaa-compliant-what-healthcare-professionals-must-know) [[1]](https://www.hipaajournal.com/is-chatgpt-hipaa-compliant/) - **Enterprise & Healthcare Tiers:** OpenAI **does** offer a BAA for **ChatGPT Enterprise**, **ChatGPT for Healthcare** , and their developer **API platform**.[](https://help.openai.com/en/articles/20001046-chatgpt-for-healthcare) [[1]](https://help.openai.com/en/articles/20001046-chatgpt-for-healthcare) In most cases the answer is no. Most ChatGPT-based services cannot be configured to prevent unauthorized access, use, or disclosur... Support for HIPAA-compliant use ChatGPT for Healthcare supports HIPAA-compliant use through: Enterprise security controls. No trai... HIPAA-Eligible Tiers vs. Consumer Tiers | Feature | Consumer Tiers (Free, Plus, Team) | Enterprise, Healthcare & API Tiers | |---|---|---| | **OpenAI Signs a BAA?** | ❌ No | Yes | | **Model Training** | ⚠️ Uses data by default (unless opted out) | ❌ Never trained on user data | | **Data Retention** | Standard retention terms apply | Enhanced admin & data deletion controls | | **Encryption** | Standard transit/rest encryption | Customer-managed keys & advanced logging | Simply purchasing a high-level tier does not make you instantly compliant; compliance relies on how your organization manages the tool. If you intend to use OpenAI products in a clinical setting, you must take the following steps: Execute a BAA : You must officially sign a contract with OpenAI through an Enterprise account or their API platform before any data is entered. De-identify the Data : If you are using a standard, non-compliant version of ChatGPT, you must strip away all 18 HIPAA identifiers (names, dates, geographic data, MRNs, etc.) before entering text. De-identified data is no longer considered PHI. Enforce Strict Access Controls : Implement Multi-Factor Authentication (MFA), role-based access limits, and single sign-on (SSO) so only authorized staff can access the workspace. Maintain Audit Logs : Keep thorough records of user activity and data tracking to satisfy HIPAA Security Rule auditing requirements. Train Your Workforce : Provide clear, mandatory training so employees know exactly what types of information can and cannot be entered into conversational workflows. - **Execute a BAA** : You must officially sign a contract with OpenAI through an Enterprise account or their API platform before any data is entered.[](https://www.hipaavault.com/resources/is-chatgpt-hipaa-compliant/) - **De-identify the Data** : If you are using a standard, non-compliant version of ChatGPT, you must strip away all **18 HIPAA identifiers** (names, dates, geographic data, MRNs, etc.) *before* entering text. De-identified data is no longer considered PHI.[](https://www.reddit.com/r/hipaa/comments/1rrh7b0/chatgpt_hipaa_violation/) - **Enforce Strict Access Controls** : Implement Multi-Factor Authentication (MFA), role-based access limits, and single sign-on (SSO) so only authorized staff can access the workspace.[](https://openai.com/index/openai-for-healthcare/) [[1]](https://openai.com/index/openai-for-healthcare/)[[2]](https://www.hipaavault.com/resources/hipaa-compliant-hosting-insights/hipaa-compliant-ai-chatbot/) - **Maintain Audit Logs** : Keep thorough records of user activity and data tracking to satisfy HIPAA Security Rule auditing requirements.[](https://openai.com/index/openai-for-healthcare/) [[1]](https://www.youtube.com/watch?v=zEn5VB5z2RE) - **Train Your Workforce** : Provide clear, mandatory training so employees know exactly what types of information can and cannot be entered into conversational workflows.[](https://witness.ai/blog/chatgpt-enterprise-hipaa-compliance/) Reusable templates to automate workflows: Shared templates for common tasks like drafting discharge summaries, patient instruction... FAQ: HIPAA-Compliant AI Chatbots * Is ChatGPT HIPAA compliant? Only ChatGPT Enterprise or Teams under a signed BAA. * Can I use fr... and in this video I'm going to walk through what we built and how we made sure that it was fully HIPPA. compliant. a little bit of... Are you looking to use ChatGPT for clinical documentation, administrative work, or building a healthcare application ? Tell me your exact use case, and I can provide tailored steps to keep your workflow secure. Are you looking to use ChatGPT for **clinical documentation**, **administrative work** , or **building a healthcare application** ? Tell me your exact use case, and I can provide tailored steps to keep your workflow secure.

**No, standard versions of ChatGPT (Free, Plus, and Team) are not HIPAA compliant** . You cannot input Protected Health Information (PHI) into these tiers without violating federal law. However, OpenAI offers specialized plans that support HIPAA compliance if configured correctly.[](https://www.hipaavault.com/resources/is-chatgpt-hipaa-compliant/) [[1]](https://www.hipaavault.com/resources/is-chatgpt-hipaa-compliant/)[[2]](https://bastiongpt.com/post/is-chatgpt-hipaa-compliant-what-healthcare-professionals-must-know)[[3]](https://www.plaud.ai/blogs/articles/is-chatgpt-hipaa-compliant)[[4]](https://witness.ai/blog/chatgpt-enterprise-hipaa-compliance/) The Core Problem: The BAA Requirement Under the Health Insurance Portability and Accountability Act (HIPAA), covered entities must sign a **Business Associate Agreement (BAA)** with third-party vendors before sharing PHI.[](https://www.reddit.com/r/hipaa/comments/1rrh7b0/chatgpt_hipaa_violation/) [[1]](https://www.reddit.com/r/hipaa/comments/1rrh7b0/chatgpt_hipaa_violation/) - **Standard ChatGPT:** OpenAI **will not** sign a BAA for the Free, Plus, Team, or Pro tiers. Furthermore, consumer tiers may use your inputs to train their models unless you manually opt out.[](https://bastiongpt.com/post/is-chatgpt-hipaa-compliant-what-healthcare-professionals-must-know) [[1]](https://www.hipaajournal.com/is-chatgpt-hipaa-compliant/) - **Enterprise & Healthcare Tiers:** OpenAI **does** offer a BAA for **ChatGPT Enterprise**, **ChatGPT for Healthcare** , and their developer **API platform**.[](https://help.openai.com/en/articles/20001046-chatgpt-for-healthcare) [[1]](https://help.openai.com/en/articles/20001046-chatgpt-for-healthcare) HIPAA-Eligible Tiers vs. Consumer Tiers | Feature | Consumer Tiers (Free, Plus, Team) | Enterprise, Healthcare & API Tiers | |---|---|---| | **OpenAI Signs a BAA?** | ❌ No | Yes | | **Model Training** | ⚠️ Uses data by default (unless opted out) | ❌ Never trained on user data | | **Data Retention** | Standard retention terms apply | Enhanced admin & data deletion controls | | **Encryption** | Standard transit/rest encryption | Customer-managed keys & advanced logging | How to Use ChatGPT Compliantly in Healthcare Simply purchasing a high-level tier does not make you instantly compliant; compliance relies on how your organization manages the tool. If you intend to use OpenAI products in a clinical setting, you must take the following steps:[](https://www.hipaavault.com/resources/is-chatgpt-hipaa-compliant/) - **Execute a BAA** : You must officially sign a contract with OpenAI through an Enterprise account or their API platform before any data is entered.[](https://www.hipaavault.com/resources/is-chatgpt-hipaa-compliant/) - **De-identify the Data** : If you are using a standard, non-compliant version of ChatGPT, you must strip away all **18 HIPAA identifiers** (names, dates, geographic data, MRNs, etc.) *before* entering text. De-identified data is no longer considered PHI.[](https://www.reddit.com/r/hipaa/comments/1rrh7b0/chatgpt_hipaa_violation/) - **Enforce Strict Access Controls** : Implement Multi-Factor Authentication (MFA), role-based access limits, and single sign-on (SSO) so only authorized staff can access the workspace.[](https://openai.com/index/openai-for-healthcare/) [[1]](https://openai.com/index/openai-for-healthcare/)[[2]](https://www.hipaavault.com/resources/hipaa-compliant-hosting-insights/hipaa-compliant-ai-chatbot/) - **Maintain Audit Logs** : Keep thorough records of user activity and data tracking to satisfy HIPAA Security Rule auditing requirements.[](https://openai.com/index/openai-for-healthcare/) [[1]](https://www.youtube.com/watch?v=zEn5VB5z2RE) - **Train Your Workforce** : Provide clear, mandatory training so employees know exactly what types of information can and cannot be entered into conversational workflows.[](https://witness.ai/blog/chatgpt-enterprise-hipaa-compliance/) Are you looking to use ChatGPT for **clinical documentation**, **administrative work** , or **building a healthcare application** ? Tell me your exact use case, and I can provide tailored steps to keep your workflow secure. No, standard versions of ChatGPT (Free, Plus, and Team) are not HIPAA compliant. You cannot input Protected Health Information (PHI) into these tiers without violating federal law. However, OpenAI offers specialized plans that support HIPAA compliance if configured correctly. Quick Answer: Is ChatGPT HIPAA Compliant? Not by default. Public ChatGPT should not be treated as HIPAA compliant for routine PHI ... Is ChatGPT HIPAA Compliant? Standard ChatGPT versions (Free, Plus, Pro, Team) are not HIPAA compliant and should not be used with ... The direct answer: is standard ChatGPT HIPAA compliant? No. Free, Plus, and Team plans of ChatGPT are not HIPAA compliant, and usi... Key Takeaways * OpenAI's ChatGPT Enterprise, the API Platform, and ChatGPT for Healthcare support BAAs. Consumer tiers such as Fre... Under the Health Insurance Portability and Accountability Act (HIPAA), covered entities must sign a Business Associate Agreement (BAA) with third-party vendors before sharing PHI. Under the Health Insurance Portability and Accountability Act (HIPAA), covered entities must sign a **Business Associate Agreement (BAA)** with third-party vendors before sharing PHI.[](https://www.reddit.com/r/hipaa/comments/1rrh7b0/chatgpt_hipaa_violation/) [[1]](https://www.reddit.com/r/hipaa/comments/1rrh7b0/chatgpt_hipaa_violation/) What you're describing could trigger the Business Associate Agreement requirement under HIPAA, depending on what's actually in tho... Standard ChatGPT: OpenAI will not sign a BAA for the Free, Plus, Team, or Pro tiers. Furthermore, consumer tiers may use your inputs to train their models unless you manually opt out. Enterprise & Healthcare Tiers: OpenAI does offer a BAA for ChatGPT Enterprise, ChatGPT for Healthcare, and their developer API platform. - **Standard ChatGPT:** OpenAI **will not** sign a BAA for the Free, Plus, Team, or Pro tiers. Furthermore, consumer tiers may use your inputs to train their models unless you manually opt out.[](https://bastiongpt.com/post/is-chatgpt-hipaa-compliant-what-healthcare-professionals-must-know) [[1]](https://www.hipaajournal.com/is-chatgpt-hipaa-compliant/) - **Enterprise & Healthcare Tiers:** OpenAI **does** offer a BAA for **ChatGPT Enterprise**, **ChatGPT for Healthcare** , and their developer **API platform**.[](https://help.openai.com/en/articles/20001046-chatgpt-for-healthcare) [[1]](https://help.openai.com/en/articles/20001046-chatgpt-for-healthcare) In most cases the answer is no. Most ChatGPT-based services cannot be configured to prevent unauthorized access, use, or disclosur... Support for HIPAA-compliant use ChatGPT for Healthcare supports HIPAA-compliant use through: Enterprise security controls. No trai... HIPAA-Eligible Tiers vs. Consumer Tiers | Feature | Consumer Tiers (Free, Plus, Team) | Enterprise, Healthcare & API Tiers | |---|---|---| | **OpenAI Signs a BAA?** | ❌ No | Yes | | **Model Training** | ⚠️ Uses data by default (unless opted out) | ❌ Never trained on user data | | **Data Retention** | Standard retention terms apply | Enhanced admin & data deletion controls | | **Encryption** | Standard transit/rest encryption | Customer-managed keys & advanced logging | Simply purchasing a high-level tier does not make you instantly compliant; compliance relies on how your organization manages the tool. If you intend to use OpenAI products in a clinical setting, you must take the following steps: Execute a BAA : You must officially sign a contract with OpenAI through an Enterprise account or their API platform before any data is entered. De-identify the Data : If you are using a standard, non-compliant version of ChatGPT, you must strip away all 18 HIPAA identifiers (names, dates, geographic data, MRNs, etc.) before entering text. De-identified data is no longer considered PHI. Enforce Strict Access Controls : Implement Multi-Factor Authentication (MFA), role-based access limits, and single sign-on (SSO) so only authorized staff can access the workspace. Maintain Audit Logs : Keep thorough records of user activity and data tracking to satisfy HIPAA Security Rule auditing requirements. Train Your Workforce : Provide clear, mandatory training so employees know exactly what types of information can and cannot be entered into conversational workflows. - **Execute a BAA** : You must officially sign a contract with OpenAI through an Enterprise account or their API platform before any data is entered.[](https://www.hipaavault.com/resources/is-chatgpt-hipaa-compliant/) - **De-identify the Data** : If you are using a standard, non-compliant version of ChatGPT, you must strip away all **18 HIPAA identifiers** (names, dates, geographic data, MRNs, etc.) *before* entering text. De-identified data is no longer considered PHI.[](https://www.reddit.com/r/hipaa/comments/1rrh7b0/chatgpt_hipaa_violation/) - **Enforce Strict Access Controls** : Implement Multi-Factor Authentication (MFA), role-based access limits, and single sign-on (SSO) so only authorized staff can access the workspace.[](https://openai.com/index/openai-for-healthcare/) [[1]](https://openai.com/index/openai-for-healthcare/)[[2]](https://www.hipaavault.com/resources/hipaa-compliant-hosting-insights/hipaa-compliant-ai-chatbot/) - **Maintain Audit Logs** : Keep thorough records of user activity and data tracking to satisfy HIPAA Security Rule auditing requirements.[](https://openai.com/index/openai-for-healthcare/) [[1]](https://www.youtube.com/watch?v=zEn5VB5z2RE) - **Train Your Workforce** : Provide clear, mandatory training so employees know exactly what types of information can and cannot be entered into conversational workflows.[](https://witness.ai/blog/chatgpt-enterprise-hipaa-compliance/) Reusable templates to automate workflows: Shared templates for common tasks like drafting discharge summaries, patient instruction... FAQ: HIPAA-Compliant AI Chatbots * Is ChatGPT HIPAA compliant? Only ChatGPT Enterprise or Teams under a signed BAA. * Can I use fr... and in this video I'm going to walk through what we built and how we made sure that it was fully HIPPA. compliant. a little bit of... Are you looking to use ChatGPT for clinical documentation, administrative work, or building a healthcare application ? Tell me your exact use case, and I can provide tailored steps to keep your workflow secure. Are you looking to use ChatGPT for **clinical documentation**, **administrative work** , or **building a healthcare application** ? Tell me your exact use case, and I can provide tailored steps to keep your workflow secure.

I'll search for current information about ChatGPT's HIPAA compliance status. The answer depends on which ChatGPT product you're using: **Standard ChatGPT is NOT HIPAA compliant.** The consumer-facing ChatGPT (Free, Plus, and Team tiers, along with self-serve ChatGPT Business) is not HIPAA compliant and cannot lawfully be used to process Protected Health Information (PHI), because OpenAI will not sign a Business Associate Agreement (BAA) for those products. **HIPAA-eligible ChatGPT products do exist.** OpenAI launched OpenAI for Healthcare on January 8, 2026, a suite anchored by ChatGPT for Healthcare, which is already rolling out at institutions including Boston Children's Hospital, Cedars-Sinai Medical Center, HCA Healthcare, and UCSF. ChatGPT Enterprise and the Healthcare tier both offer BAA eligibility, which makes them legally usable for clinical documentation once the BAA is signed and the organization has the required internal policies and training in place. **Important distinction:** ChatGPT for Healthcare, launched January 8, 2026, is HIPAA-capable with a Business Associate Agreement and is an enterprise product designed for large health systems and is not generally available to solo or small group practices. ChatGPT Health, launched around the same time, is a consumer-facing wellness product and is not HIPAA compliant. The key takeaway: Generic ChatGPT remains off limits for PHI, a properly contracted and configured HIPAA eligible OpenAI product can support compliant use.