ChatGPT vs Grok: which signs a HIPAA BAA?
Both can be covered by a BAA, on different terms. OpenAI signs one for ChatGPT only on Enterprise; Edu; ChatGPT for Healthcare; ChatGPT for Clinicians; ChatGPT FedRAMP. XAI (SpaceXAI LLC) signs one for Grok only on API (ZDR-enabled).
- Business associate
- OpenAI
- Tool
- ChatGPT
- Plans with a BAA
- Enterprise; Edu; ChatGPT for Healthcare; ChatGPT for Clinicians; ChatGPT FedRAMP
- Checked
Some plans only
- Business associate
- xAI (SpaceXAI LLC)
- Tool
- Grok
- Plans with a BAA
- API (ZDR-enabled)
- Checked
Some plans only
Side by side
| ChatGPTOpenAI | GrokxAI (SpaceXAI LLC) | |
|---|---|---|
| BAA | Some plans only | Some plans only |
| Plans with a BAA | Enterprise; Edu; ChatGPT for Healthcare; ChatGPT for Clinicians; ChatGPT FedRAMP | API (ZDR-enabled) |
| How to get it | Through sales; Accept or sign online | Request by email |
| AI features outside the BAA partly covered excluded |
|
|
| Sources | 5 sources | 6 sources |
| Last checked | Oct 11, 2026 | Oct 11, 2026 |
Every plan
ChatGPT
- Free / Plus / ProOpenAI's HIPAA guide says the consumer ChatGPT services are not Eligible Services and may not be used with PHI.No BAA
- Business (formerly Team)OpenAI states that it does not offer a BAA for ChatGPT Business.No BAA
- EnterpriseOnly sales-managed Enterprise accounts are eligible. The HIPAA-eligible product list names 'ChatGPT for Enterprise with Regulated Workspace', and Enterprise is eligible only if the BAA lists it as an Eligible Service.Conditions apply
- EduSales-managed Edu accounts may get a BAA, and Edu is eligible only if the BAA lists it. The HIPAA-eligible products page does not list Edu as a product, though it lists Study Mode as covered functionality for Edu.Conditions apply
- ChatGPT for HealthcareListed as a HIPAA-eligible product with a BAA. It is a workspace for healthcare organizations, obtained by contacting OpenAI's team. This is also the route for multi-user clinician BAAs with central controls.Signs a BAA
- ChatGPT for CliniciansFree at launch for verified US clinicians (MD/DO, NP, PA, pharmacists) with a valid NPI and a verifiable license. Each clinician reviews and signs the BAA in the product under Settings > Agreements. Individual accounts only.Signs a BAA
- ChatGPT FedRAMPListed as a HIPAA-eligible product available with a BAA. How to obtain it is not described.Signs a BAA
Grok
- Consumer Grok (grok.com, apps, Grok in X, SuperGrok)The consumer Terms do not mention HIPAA, PHI, or a BAA. They point business and developer use to the Enterprise Terms.Not confirmed
- API (ZDR-enabled)An authorized representative fills out the BAA questionnaire, and xAI reviews it and follows up. Enterprise Terms section 11.1 requires a signed BAA and routing of PHI through the ZDR-enabled API. ZDR is enabled per team in the xAI Console.Conditions apply
- Grok Business / Grok Enterprise (team chat app)The Business page shows a HIPAA badge and a BAA footer link but no details. The Enterprise Terms cover 'related services (including Grok)' yet require PHI to go only through the ZDR-enabled API. The pages checked never say whether the chat app itself can receive PHI under a BAA.Not confirmed
If you handle patient data
Either can work. Choose on features and price, then make sure you’re on a plan listed above and the BAA is signed before anyone enters protected health information. Keep PHI out of the AI features listed as outside the BAA.
More comparisons
- ChatGPT vs Claude
- ChatGPT vs Gemini app
- ChatGPT vs Perplexity
- ChatGPT vs Microsoft Copilot
- ChatGPT vs CompliantChatGPT
- ChatGPT vs BastionGPT
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.