ChatGPT vs BastionGPT: which signs a HIPAA BAA?
Both can be covered by a BAA, on different terms. OpenAI signs one for ChatGPT only on Enterprise; Edu; ChatGPT for Healthcare; ChatGPT for Clinicians; ChatGPT FedRAMP. Bastion Intelligence signs a BAA for BastionGPT on every plan we list.
- Business associate
- OpenAI
- Tool
- ChatGPT
- Plans with a BAA
- Enterprise; Edu; ChatGPT for Healthcare; ChatGPT for Clinicians; ChatGPT FedRAMP
- Checked
Some plans only
- Business associate
- Bastion Intelligence
- Tool
- BastionGPT
- Plans with a BAA
- Professional; Professional Plus; Ultra (Enterprise); API
- Checked
Signs a BAA
Side by side
| ChatGPTOpenAI | BastionGPTBastion Intelligence | |
|---|---|---|
| BAA | Some plans only | Signs a BAA |
| Plans with a BAA | Enterprise; Edu; ChatGPT for Healthcare; ChatGPT for Clinicians; ChatGPT FedRAMP | Professional; Professional Plus; Ultra (Enterprise); API |
| How to get it | Through sales; Accept or sign online | Included in the terms |
| Minimum seats | None stated | 100 seats on Ultra (Enterprise) |
| AI features outside the BAA partly covered excluded |
| None listed |
| Sources | 5 sources | 2 sources |
| Last checked | Oct 11, 2026 | Oct 12, 2026 |
Every plan
ChatGPT
- Free / Plus / ProOpenAI's HIPAA guide says the consumer ChatGPT services are not Eligible Services and may not be used with PHI.No BAA
- Business (formerly Team)OpenAI states that it does not offer a BAA for ChatGPT Business.No BAA
- EnterpriseOnly sales-managed Enterprise accounts are eligible. The HIPAA-eligible product list names 'ChatGPT for Enterprise with Regulated Workspace', and Enterprise is eligible only if the BAA lists it as an Eligible Service.Conditions apply
- EduSales-managed Edu accounts may get a BAA, and Edu is eligible only if the BAA lists it. The HIPAA-eligible products page does not list Edu as a product, though it lists Study Mode as covered functionality for Edu.Conditions apply
- ChatGPT for HealthcareListed as a HIPAA-eligible product with a BAA. It is a workspace for healthcare organizations, obtained by contacting OpenAI's team. This is also the route for multi-user clinician BAAs with central controls.Signs a BAA
- ChatGPT for CliniciansFree at launch for verified US clinicians (MD/DO, NP, PA, pharmacists) with a valid NPI and a verifiable license. Each clinician reviews and signs the BAA in the product under Settings > Agreements. Individual accounts only.Signs a BAA
- ChatGPT FedRAMPListed as a HIPAA-eligible product available with a BAA. How to obtain it is not described.Signs a BAA
BastionGPT
- Professional$20 per user per month. The BAA is accepted electronically with the terms of use at account creation. For a countersigned DocuSign copy, email the team or ask in chat. Bastion says most copies go out within 30 minutes and all within one business day. Redline BAAs are not available on this plan.Signs a BAA
- Professional Plus$45 per user per month. The standard BAA is included. A customizable (redline) BAA and SSO are add-ons that need 50 or more users.Signs a BAA
- Ultra (Enterprise)$75 per user per month for 100 or more users. A redline BAA is included. The FAQ calls the top tier 'Enterprise' while the pricing table calls it 'Ultra'.Signs a BAA
- APIThe help article says API access is covered by the BAA once the terms of use are accepted.Signs a BAA
If you handle patient data
Either can work. Choose on features and price, then make sure you’re on a plan listed above and the BAA is signed before anyone enters protected health information. Keep PHI out of the AI features listed as outside the BAA.
More comparisons
- ChatGPT vs Claude
- ChatGPT vs Gemini app
- ChatGPT vs Perplexity
- ChatGPT vs Microsoft Copilot
- ChatGPT vs Grok
- ChatGPT vs CompliantChatGPT
- BastionGPT vs CompliantChatGPT
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.