OpenAI API platform vs Claude API: which signs a HIPAA BAA?
Both can be covered by a BAA, on different terms. OpenAI signs a BAA for OpenAI API platform on every plan we list. Anthropic signs one for Claude API only on First-party API (self-serve Console enablement); First-party API (custom / negotiated BAA).
- Business associate
- OpenAI
- Tool
- OpenAI API platform
- Plans with a BAA
- API (pay-as-you-go / self-serve organizations); API (enterprise / sales-managed accounts); API FedRAMP (with Modified Retention)
- Checked
Signs a BAA
- Business associate
- Anthropic
- Tool
- Claude API (Claude Platform)
- Plans with a BAA
- First-party API (self-serve Console enablement); First-party API (custom / negotiated BAA)
- Checked
Some plans only
Side by side
| OpenAI API platformOpenAI | Claude APIAnthropic | |
|---|---|---|
| BAA | Signs a BAA | Some plans only |
| Plans with a BAA | API (pay-as-you-go / self-serve organizations); API (enterprise / sales-managed accounts); API FedRAMP (with Modified Retention) | First-party API (self-serve Console enablement); First-party API (custom / negotiated BAA) |
| How to get it | Request by email; Through sales | Accept or sign online; Through sales |
| AI features outside the BAA partly covered excluded |
|
|
| Sources | 5 sources | 4 sources |
| Last checked | Oct 11, 2026 | Oct 11, 2026 |
Every plan
OpenAI API platform
- API (pay-as-you-go / self-serve organizations)Email OpenAI with company and use-case details; OpenAI says it replies in 1-2 business days and reviews each request case by case, and some use cases may be declined. An enterprise agreement is not required. HIPAA eligibility also requires the organization to be provisioned with Modified Retention.Signs a BAA
- API (enterprise / sales-managed accounts)OpenAI says enterprise API customers can ask their account team for access. Reconsideration of a denied request is available only to customers working with OpenAI sales.Signs a BAA
- API FedRAMP (with Modified Retention)Listed by OpenAI as a HIPAA-eligible product available with a BAA. How to obtain it is not described.Signs a BAA
Claude API
- First-party API (self-serve Console enablement)An admin with HIPAA-management permission downloads the BAA and Implementation Guide under Console > Settings > Data retention, then accepts. HIPAA readiness is permanent once enabled and applies to the whole organization, so use a separate org for non-PHI work. Covered Models require 30-day retention.Signs a BAA
- First-party API (custom / negotiated BAA)For a negotiated BAA, or where self-serve isn't available, Anthropic sales executes the BAA and enables HIPAA readiness.Signs a BAA
- Anthropic BAA for Claude via Amazon Bedrock / Google Cloud Agent PlatformAnthropic's own BAA and HIPAA readiness do not apply on these platforms. Coverage there comes from the cloud provider's BAA instead: AWS lists Amazon Bedrock as HIPAA eligible, and Google lists its agent platform. See those listings on this site.No BAA
- Claude Platform on AWSAnthropic's API docs say HIPAA readiness is not available on Claude Platform on AWS.No BAA
- Claude in Microsoft FoundryAnthropic's own pages conflict. The BAA help article lists Claude API through Microsoft Foundry as eligible under the BAA, while the API data-retention docs say HIPAA readiness is not available on Microsoft Foundry.Not confirmed
If you handle patient data
Either can work. Choose on features and price, then make sure you’re on a plan listed above and the BAA is signed before anyone enters protected health information. Keep PHI out of the AI features listed as outside the BAA.
More comparisons
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.