Cursor vs GitHub Copilot: which signs a HIPAA BAA?
Only Cursor offers a BAA. Anysphere (Cursor) signs one for Cursor only on Enterprise. GitHub doesn't offer a BAA for GitHub Copilot.
- Business associate
- Anysphere (Cursor)
- Tool
- Cursor
- Plans with a BAA
- Enterprise
- Checked
Some plans only
- Business associate
- GitHub
- Tool
- GitHub Copilot
- Plans with a BAA
- None
- Checked
No BAA
Side by side
| CursorAnysphere (Cursor) | GitHub CopilotGitHub | |
|---|---|---|
| BAA | Some plans only | No BAA |
| Plans with a BAA | Enterprise | None |
| How to get it | Through sales | — |
| AI features outside the BAA partly covered excluded |
| None listed |
| Sources | 2 sources | 5 sources |
| Last checked | Oct 11, 2026 | Oct 11, 2026 |
Every plan
Cursor
- EnterpriseRequires a signed Enterprise agreement and BAA before any PHI is submitted. Privacy Mode must be enabled and locked organization-wide, and users may send PHI only through Eligible Services. The HIPAA Implementation and Configuration Guide forms part of the BAA and is available on request from the Trust Center.Signs a BAA
- TeamsTeams customers are told to contact sales about moving to Enterprise before they request a BAA.No BAA
- Hobby / Pro / individual plansThe BAA page names only Enterprise and does not mention individual plans.Not confirmed
GitHub Copilot
- Copilot Business / Copilot Enterprise (governed by the GitHub DPA)Section 12 of the GitHub DPA (October 2025) bars customers from giving GitHub HIPAA protected health information unless GitHub gives prior, written, specific consent. GitHub publishes no BAA or way to request one. Microsoft's HIPAA BAA in-scope service list does not include GitHub, so Microsoft's BAA does not cover Copilot.No BAA
- Copilot Free / Pro / Pro+ (individual accounts)The GitHub Terms of Service do not mention HIPAA, PHI or BAAs, and no BAA offering for individual plans was found. GitHub does not say whether the DPA's PHI restriction applies to these plans.Not confirmed
If you handle patient data
Use Cursor on a plan listed above, and sign the BAA before anyone enters protected health information. Don't put PHI into GitHub Copilot. Other GitHub Copilot alternatives that sign a BAA
More comparisons
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.