Claude Code vs OpenAI Codex: which signs a HIPAA BAA?
Both can be covered by a BAA, on different terms. Anthropic signs one for Claude Code only on Claude Enterprise (HIPAA-ready); Claude Console API key (Commercial org) with zero data retention. OpenAI signs one for OpenAI Codex only on ChatGPT for Healthcare / ChatGPT for Clinicians / Enterprise or Edu with Regulated Workspace; OpenAI API (API key sign-in) with Modified Retention.
- Business associate
- Anthropic
- Tool
- Claude Code
- Plans with a BAA
- Claude Enterprise (HIPAA-ready); Claude Console API key (Commercial org) with zero data retention
- Checked
- Business associate
- OpenAI
- Tool
- OpenAI Codex
- Plans with a BAA
- ChatGPT for Healthcare / ChatGPT for Clinicians / Enterprise or Edu with Regulated Workspace; OpenAI API (API key sign-in) with Modified Retention
- Checked
Side by side
| Claude CodeAnthropic | OpenAI CodexOpenAI | |
|---|---|---|
| BAA | Some plans only | Some plans only |
| Plans with a BAA | Claude Enterprise (HIPAA-ready); Claude Console API key (Commercial org) with zero data retention | ChatGPT for Healthcare / ChatGPT for Clinicians / Enterprise or Edu with Regulated Workspace; OpenAI API (API key sign-in) with Modified Retention |
| How to get it | Accept or sign online; Through sales | Through sales; Accept or sign online |
| AI features outside the BAA partly covered excluded |
|
|
| Sources | 3 sources | 3 sources |
| Last checked | Oct 11, 2026 | Oct 11, 2026 |
Every plan
Claude Code
- Claude Enterprise (HIPAA-ready)Only the org's Primary Owner can accept the BAA in Organization settings > Data and privacy. The Primary Owner must also apply the HIPAA configuration to Claude Code (local mode), which cannot be removed afterwards. Before that, local Claude Code is covered only if ZDR is enabled for a qualified account.Conditions apply
- Claude Console API key (Commercial org) with zero data retentionEligible only with ZDR enabled, for qualified accounts. Covered Models cannot be used while ZDR for Claude Code is on unless Anthropic authorizes it. Without ZDR, Console API key use is not covered. The BAA article says to sign the BAA and then contact Anthropic or sales.Conditions apply
- Claude API HIPAA readiness (without ZDR)The API docs say HIPAA readiness does not cover Claude Code.No BAA
- Free / Pro / Max / TeamTeam and individual plans cannot enable HIPAA.No BAA
OpenAI Codex
- ChatGPT for Healthcare / ChatGPT for Clinicians / Enterprise or Edu with Regulated WorkspaceRequires an applicable BAA, and the Account Director must enable Codex HIPAA support for the workspace. Admins enable Codex Local and should pin approved sign-in methods and workspaces through managed requirements.Conditions apply
- OpenAI API (API key sign-in) with Modified RetentionAPI organizations can accept OpenAI's BAA themselves under Settings > Organization > General > HIPAA compliance support, if they have an established history of API usage; otherwise contact baa@openai.com. Codex is covered only if OpenAI has also provisioned Modified Retention for the org and project. It is unclear whether the self-serve BAA lists API Services with Modified Retention as an Eligible Service, so confirm with OpenAI.Conditions apply
- ChatGPT Free / Plus / Pro / BusinessOpenAI's HIPAA guide says consumer ChatGPT plans and ChatGPT Business are not Eligible Services.No BAA
If you handle patient data
Either can work. Choose on features and price, then make sure you’re on a plan listed above and the BAA is signed before anyone enters protected health information. Keep PHI out of the AI features listed as outside the BAA.
More comparisons
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.