Windsurf (formerly Codeium) alternatives that sign a HIPAA BAA
Windsurf (formerly Codeium): not confirmed. See the plan-by-plan breakdown.
Before you switch from Windsurf (formerly Codeium)
We couldn’t confirm from Cognition (Windsurf, formerly Codeium)’s own pages that it signs a BAA for Windsurf (formerly Codeium). Ask Cognition (Windsurf, formerly Codeium) for one in writing, or use a tool below that publishes its BAA terms.
| Tool | BAA | Plans with a BAA |
|---|---|---|
| Claude CodeAnthropic | Some plans only | Claude Console API key (Commercial org) with zero data retention; Claude Enterprise (HIPAA-ready) |
| CursorAnysphere (Cursor) | Some plans only | Enterprise |
| OpenAI CodexOpenAI | Some plans only | ChatGPT for Healthcare / ChatGPT for Clinicians / Enterprise or Edu with Regulated Workspace; OpenAI API (API key sign-in) with Modified Retention |
Listed tools offer a BAA on at least one plan according to their own published terms. A BAA alone doesn’t make your use HIPAA compliant: you still need the right plan, configuration and policies. Not legal advice.