AI Vendor BAA Check

Claude API vs Gemini API: which signs a HIPAA BAA?

Only Claude API offers a BAA. Anthropic signs one for Claude API only on First-party API (self-serve Console enablement); First-party API (custom / negotiated BAA). Google doesn't offer a BAA for Gemini API.

Business associate
Anthropic
Tool
Claude API (Claude Platform)
Plans with a BAA
First-party API (self-serve Console enablement); First-party API (custom / negotiated BAA)
Checked
Some plans only
Anthropic signs only for the plans listed.

Claude API: plan-by-plan breakdown and sources

Business associate
Google
Tool
Gemini API (Google AI Studio)
Plans with a BAA
None
Checked
No BAA
Google won't sign a BAA for Gemini API (Google AI Studio).

Gemini API: plan-by-plan breakdown and sources

Side by side

Claude APIAnthropicGemini APIGoogle
BAASome plans onlyNo BAA
Plans with a BAAFirst-party API (self-serve Console enablement); First-party API (custom / negotiated BAA)None
How to get itAccept or sign online; Through sales—
AI features outside the BAA partly covered excluded
  • Web search tool
  • Batch processing, Files API, code execution, agent skills, web fetch, MCP connector, programmatic tool calling, Claude Managed Agents, context management
  • Claude Console (workbench / playground)
  • Claude Code using an API organization
  • Covered Models (Claude Fable 5 / 5.1, Mythos 5 / 5.1)
None listed
Sources4 sources3 sources
Last checkedOct 11, 2026Oct 11, 2026

Every plan

Claude API

  • First-party API (self-serve Console enablement)An admin with HIPAA-management permission downloads the BAA and Implementation Guide under Console > Settings > Data retention, then accepts. HIPAA readiness is permanent once enabled and applies to the whole organization, so use a separate org for non-PHI work. Covered Models require 30-day retention.Signs a BAA
  • First-party API (custom / negotiated BAA)For a negotiated BAA, or where self-serve isn't available, Anthropic sales executes the BAA and enables HIPAA readiness.Signs a BAA
  • Anthropic BAA for Claude via Amazon Bedrock / Google Cloud Agent PlatformAnthropic's own BAA and HIPAA readiness do not apply on these platforms. Coverage there comes from the cloud provider's BAA instead: AWS lists Amazon Bedrock as HIPAA eligible, and Google lists its agent platform. See those listings on this site.No BAA
  • Claude Platform on AWSAnthropic's API docs say HIPAA readiness is not available on Claude Platform on AWS.No BAA
  • Claude in Microsoft FoundryAnthropic's own pages conflict. The BAA help article lists Claude API through Microsoft Foundry as eligible under the BAA, while the API data-retention docs say HIPAA readiness is not available on Microsoft Foundry.Not confirmed

Gemini API

  • Unpaid / free tier (incl. free AI Studio use)The terms tell users not to submit sensitive, confidential or personal information to Unpaid Services. Google may use the content for product improvement, and human reviewers may read it.No BAA
  • Paid tier (Cloud project with active billing)No BAA path is published. Under the Google APIs Terms, covered entities and business associates must not send PHI without Google's prior written consent. The Gemini API does not appear on the Google Cloud HIPAA covered-products list.No BAA

If you handle patient data

Use Claude API on a plan listed above, and sign the BAA before anyone enters protected health information. Don't put PHI into Gemini API. Other Gemini API alternatives that sign a BAA

More comparisons

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.