ChatGPT vs Microsoft Copilot: which signs a HIPAA BAA?
Only ChatGPT offers a BAA. OpenAI signs one for ChatGPT only on Enterprise; Edu; ChatGPT for Healthcare; ChatGPT for Clinicians; ChatGPT FedRAMP. We couldn't confirm a BAA for Microsoft Copilot from Microsoft's own pages.
- Business associate
- OpenAI
- Tool
- ChatGPT
- Plans with a BAA
- Enterprise; Edu; ChatGPT for Healthcare; ChatGPT for Clinicians; ChatGPT FedRAMP
- Checked
- Business associate
- Microsoft
- Tool
- Microsoft Copilot (consumer app)
- Plans with a BAA
- Not stated
- Checked
Side by side
| ChatGPTOpenAI | Microsoft CopilotMicrosoft | |
|---|---|---|
| BAA | Some plans only | Not confirmed |
| Plans with a BAA | Enterprise; Edu; ChatGPT for Healthcare; ChatGPT for Clinicians; ChatGPT FedRAMP | Not stated |
| How to get it | Through sales; Accept or sign online | — |
| AI features outside the BAA partly covered excluded |
| None listed |
| Sources | 5 sources | 4 sources |
| Last checked | Oct 11, 2026 | Oct 11, 2026 |
Every plan
ChatGPT
- Free / Plus / ProOpenAI's HIPAA guide says the consumer ChatGPT services are not Eligible Services and may not be used with PHI.No BAA
- Business (formerly Team)OpenAI states that it does not offer a BAA for ChatGPT Business.No BAA
- EnterpriseOnly sales-managed Enterprise accounts are eligible. The HIPAA-eligible product list names 'ChatGPT for Enterprise with Regulated Workspace', and Enterprise is eligible only if the BAA lists it as an Eligible Service.Conditions apply
- EduSales-managed Edu accounts may get a BAA, and Edu is eligible only if the BAA lists it. The HIPAA-eligible products page does not list Edu as a product, though it lists Study Mode as covered functionality for Edu.Conditions apply
- ChatGPT for HealthcareListed as a HIPAA-eligible product with a BAA. It is a workspace for healthcare organizations, obtained by contacting OpenAI's team. This is also the route for multi-user clinician BAAs with central controls.Signs a BAA
- ChatGPT for CliniciansFree at launch for verified US clinicians (MD/DO, NP, PA, pharmacists) with a valid NPI and a verifiable license. Each clinician reviews and signs the BAA in the product under Settings > Agreements. Individual accounts only.Signs a BAA
- ChatGPT FedRAMPListed as a HIPAA-eligible product available with a BAA. How to obtain it is not described.Signs a BAA
Microsoft Copilot
- Free / Microsoft 365 Personal, Family, Premium (personal Microsoft account)The consumer Terms say they and the Microsoft Services Agreement govern Copilot, and they do not apply to Entra (work/school) sign-ins. Neither document mentions HIPAA or a BAA. Consumer Copilot does not appear in Microsoft's HIPAA in-scope list, which is delivered through the commercial DPA. Microsoft does not state outright that it refuses a BAA here.Not confirmed
If you handle patient data
Use ChatGPT on a plan listed above, and sign the BAA before anyone enters protected health information. Don't put PHI into Microsoft Copilot unless Microsoft gives you a BAA in writing. Other Microsoft Copilot alternatives that sign a BAA
More comparisons
- ChatGPT vs Claude
- ChatGPT vs Gemini app
- ChatGPT vs Perplexity
- ChatGPT vs Grok
- ChatGPT vs CompliantChatGPT
- ChatGPT vs BastionGPT
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.