Does Claude Code or Cursor sign a HIPAA BAA?

Q: Does Claude Code or Cursor sign a HIPAA BAA?

Both can be covered by a BAA, on different terms. Anthropic signs one for Claude Code only on Claude Enterprise (HIPAA-ready); Claude Console API key (Commercial org) with zero data retention. Anysphere (Cursor) signs one for Cursor only on Enterprise.

Claude Code vs Cursor: which signs a HIPAA BAA?

Both can be covered by a BAA, on different terms. Anthropic signs one for Claude Code only on Claude Enterprise (HIPAA-ready); Claude Console API key (Commercial org) with zero data retention. Anysphere (Cursor) signs one for Cursor only on Enterprise.

Business associate: Anthropic
Tool: Claude Code
Plans with a BAA: Claude Enterprise (HIPAA-ready); Claude Console API key (Commercial org) with zero data retention
Checked: Oct 11, 2026

Some plans only

Anthropic signs only for the plans listed.

Claude Code: plan-by-plan breakdown and sources

Business associate: Anysphere (Cursor)
Tool: Cursor
Plans with a BAA: Enterprise
Checked: Oct 11, 2026

Some plans only

Anysphere (Cursor) signs only for the plans listed.

Cursor: plan-by-plan breakdown and sources

Side by side

	Claude CodeAnthropic	CursorAnysphere (Cursor)
BAA	Some plans only	Some plans only
Plans with a BAA	Claude Enterprise (HIPAA-ready); Claude Console API key (Commercial org) with zero data retention	Enterprise
How to get it	Accept or sign online; Through sales	Through sales
AI features outside the BAA partly covered excluded	Claude Code with a Console API key (Partly covered) Claude Code on the web, cloud sessions, Remote Control and mobile (Excluded from the BAA) VS Code / JetBrains extensions, LLM gateways, custom base URLs, and Claude Code via Bedrock, Google Cloud or Microsoft Foundry (Excluded from the BAA)	AI models / third-party model providers (Partly covered) Third-party services and integrations (Excluded from the BAA)
Sources	3 sources	2 sources
Last checked	Oct 11, 2026	Oct 11, 2026

Every plan

Claude Code

Claude Enterprise (HIPAA-ready)Only the org's Primary Owner can accept the BAA in Organization settings > Data and privacy. The Primary Owner must also apply the HIPAA configuration to Claude Code (local mode), which cannot be removed afterwards. Before that, local Claude Code is covered only if ZDR is enabled for a qualified account.Conditions apply
Claude Console API key (Commercial org) with zero data retentionEligible only with ZDR enabled, for qualified accounts. Covered Models cannot be used while ZDR for Claude Code is on unless Anthropic authorizes it. Without ZDR, Console API key use is not covered. The BAA article says to sign the BAA and then contact Anthropic or sales.Conditions apply
Claude API HIPAA readiness (without ZDR)The API docs say HIPAA readiness does not cover Claude Code.No BAA
Free / Pro / Max / TeamTeam and individual plans cannot enable HIPAA.No BAA

Cursor

EnterpriseRequires a signed Enterprise agreement and BAA before any PHI is submitted. Privacy Mode must be enabled and locked organization-wide, and users may send PHI only through Eligible Services. The HIPAA Implementation and Configuration Guide forms part of the BAA and is available on request from the Trust Center.Signs a BAA
TeamsTeams customers are told to contact sales about moving to Enterprise before they request a BAA.No BAA
Hobby / Pro / individual plansThe BAA page names only Enterprise and does not mention individual plans.Not confirmed

If you handle patient data

Either can work. Choose on features and price, then make sure you’re on a plan listed above and the BAA is signed before anyone enters protected health information. Keep PHI out of the AI features listed as outside the BAA.

More comparisons

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.