Does Claude API (Claude Platform) sign a BAA?
Only on some plans or setups
Anthropic signs BAAs for its first-party Claude API. Eligible organizations can accept the standard BAA themselves in the Claude Console, or go through sales for a custom one. Coverage is limited to an eligibility table of features, and many beta and agentic features are blocked.
Not fully covered by the BAA: Web search tool; Batch processing, Files API, code execution, agent skills, web fetch, MCP connector, programmatic tool calling, Claude Managed Agents, context management; Claude Console (workbench / playground); Claude Code using an API organization; Covered Models (Claude Fable 5 / 5.1, Mythos 5 / 5.1).
- Business associate
- Anthropic
- Tool
- Claude API (Claude Platform)
- Plans with a BAA
- First-party API (self-serve Console enablement); First-party API (custom / negotiated BAA)
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| First-party API (self-serve Console enablement) | Signs a BAA | Accept or sign online | An admin with HIPAA-management permission downloads the BAA and Implementation Guide under Console > Settings > Data retention, then accepts. HIPAA readiness is permanent once enabled and applies to the whole organization, so use a separate org for non-PHI work. Covered Models require 30-day retention.[1],[2],[3] |
| First-party API (custom / negotiated BAA) | Signs a BAA | Through sales | For a negotiated BAA, or where self-serve isn't available, Anthropic sales executes the BAA and enables HIPAA readiness.[1],[2] |
| Anthropic BAA for Claude via Amazon Bedrock / Google Cloud Agent Platform | No BAA | Not offered | Anthropic's own BAA and HIPAA readiness do not apply on these platforms. Coverage there comes from the cloud provider's BAA instead: AWS lists Amazon Bedrock as HIPAA eligible, and Google lists its agent platform. See those listings on this site.[2],[1] |
| Claude Platform on AWS | No BAA | Not offered | Anthropic's API docs say HIPAA readiness is not available on Claude Platform on AWS.[2],[1] |
| Claude in Microsoft Foundry | Not confirmed | Not stated | Anthropic's own pages conflict. The BAA help article lists Claude API through Microsoft Foundry as eligible under the BAA, while the API data-retention docs say HIPAA readiness is not available on Microsoft Foundry.[1],[2] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Anthropic says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Messages API with prompt caching, structured outputs, citations, extended/adaptive thinking, PDF (inline), token countingFirst-party API (self-serve Console enablement), First-party API (custom / negotiated BAA) | Covered | Listed as HIPAA-eligible. Do not put PHI in JSON schema definitions, because cached schemas don't get PHI protections.[1],[2] |
| Web search toolFirst-party API (self-serve Console enablement), First-party API (custom / negotiated BAA) | Partly covered | Web search is eligible, but its dynamic filtering is not.[1],[2] |
| Client-side tools: bash, text editor, memoryFirst-party API (self-serve Console enablement), First-party API (custom / negotiated BAA) | Covered | Listed as HIPAA-eligible.[1],[2] |
| Computer useFirst-party API (self-serve Console enablement), First-party API (custom / negotiated BAA) | Not stated | Anthropic's pages conflict: the API eligibility table marks client-side computer use as eligible, while the BAA help article lists Computer Use among API features that are not covered.[1],[2] |
| Batch processing, Files API, code execution, agent skills, web fetch, MCP connector, programmatic tool calling, Claude Managed Agents, context managementFirst-party API (self-serve Console enablement), First-party API (custom / negotiated BAA) | Excluded | Not eligible. A HIPAA-enabled org that sends these gets a 400 error.[1],[2] |
| Claude Console (workbench / playground)First-party API (self-serve Console enablement), First-party API (custom / negotiated BAA) | Excluded | HIPAA can be enabled from the Console, but processing PHI through the Console is not covered.[1],[2] |
| Claude Code using an API organizationFirst-party API (self-serve Console enablement), First-party API (custom / negotiated BAA) | Partly covered | Anthropic’s BAA article lists Claude Code with a Console API key as eligible only when zero data retention is enabled (covered through ZDR, not HIPAA readiness), while its API docs say Claude Code is not covered. Confirm with Anthropic before using it with PHI.[1],[2],[3] |
| Covered Models (Claude Fable 5 / 5.1, Mythos 5 / 5.1)First-party API (self-serve Console enablement), First-party API (custom / negotiated BAA) | Partly covered | Usable on a HIPAA-ready API org with standard 30-day retention. Mythos models are limited to approved partners.[3],[4] |
LLM APIs that offer a BAA
- CohereBAA on: Custom model development engagementSome plans only
- GroqCloudBAA on: GroqCloud paid, generally available services (customers with an existing Groq agreement)Some plans only
- OpenAI API platformBAA on: API (enterprise / sales-managed accounts), API (pay-as-you-go / self-serve organizations), API FedRAMP (with Modified Retention)Signs a BAA
All BAA-ready alternatives to Claude API (Claude Platform)
Sources
- Business Associate Agreements (BAA) for commercial customers
- API and data retention
- Covered Models under a Business Associate Agreement (BAA)
- Covered Models
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.