Does OpenAI API platform or Gemini API sign a HIPAA BAA?

Q: Does OpenAI API platform or Gemini API sign a HIPAA BAA?

Only OpenAI API platform offers a BAA. OpenAI signs a BAA for OpenAI API platform on every plan we list. Google doesn't offer a BAA for Gemini API.

OpenAI API platform vs Gemini API: which signs a HIPAA BAA?

Only OpenAI API platform offers a BAA. OpenAI signs a BAA for OpenAI API platform on every plan we list. Google doesn't offer a BAA for Gemini API.

Business associate: OpenAI
Tool: OpenAI API platform
Plans with a BAA: API (pay-as-you-go / self-serve organizations); API (enterprise / sales-managed accounts); API FedRAMP (with Modified Retention)
Checked: Oct 11, 2026

Signs a BAA

OpenAI signs a BAA for OpenAI API platform.

OpenAI API platform: plan-by-plan breakdown and sources

Business associate: Google
Tool: Gemini API (Google AI Studio)
Plans with a BAA: None
Checked: Oct 11, 2026

No BAA

Google won't sign a BAA for Gemini API (Google AI Studio).

Gemini API: plan-by-plan breakdown and sources

Side by side

	OpenAI API platformOpenAI	Gemini APIGoogle
BAA	Signs a BAA	No BAA
Plans with a BAA	API (pay-as-you-go / self-serve organizations); API (enterprise / sales-managed accounts); API FedRAMP (with Modified Retention)	None
How to get it	Request by email; Through sales	—
AI features outside the BAA partly covered excluded	Web search tool (Responses API), live internet access (Excluded from the BAA) Web search tool (Responses API), offline mode (Partly covered) Remote MCP servers (Excluded from the BAA) Codex local, signed in with an API key (Partly covered)	None listed
Sources	5 sources	3 sources
Last checked	Oct 11, 2026	Oct 11, 2026

Every plan

OpenAI API platform

API (pay-as-you-go / self-serve organizations)Email OpenAI with company and use-case details; OpenAI says it replies in 1-2 business days and reviews each request case by case, and some use cases may be declined. An enterprise agreement is not required. HIPAA eligibility also requires the organization to be provisioned with Modified Retention.Signs a BAA
API (enterprise / sales-managed accounts)OpenAI says enterprise API customers can ask their account team for access. Reconsideration of a denied request is available only to customers working with OpenAI sales.Signs a BAA
API FedRAMP (with Modified Retention)Listed by OpenAI as a HIPAA-eligible product available with a BAA. How to obtain it is not described.Signs a BAA

Gemini API

Unpaid / free tier (incl. free AI Studio use)The terms tell users not to submit sensitive, confidential or personal information to Unpaid Services. Google may use the content for product improvement, and human reviewers may read it.No BAA
Paid tier (Cloud project with active billing)No BAA path is published. Under the Google APIs Terms, covered entities and business associates must not send PHI without Google's prior written consent. The Gemini API does not appear on the Google Cloud HIPAA covered-products list.No BAA

If you handle patient data

Use OpenAI API platform on a plan listed above, and sign the BAA before anyone enters protected health information. Don't put PHI into Gemini API. Other Gemini API alternatives that sign a BAA

More comparisons

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.