Is Augment Code HIPAA compliant?
Only on the right plan. Augment Code signs a Business Associate Agreement with its customers on Enterprise. Other plans aren't covered, so keep patient data out of them. Augment Code doesn't say whether the BAA covers its AI features.
Does Augment Code sign a BAA?
Only on some plans or setups
Augment Code's security page lists a BAA as available and HIPAA as compliant, and directs buyers to sales. It doesn't say which plans can get the BAA, and none of its terms or its pricing page mention HIPAA.
Not confirmed for the AI features: Augment Code doesn’t say whether its BAA covers Augment agent, chat and code completions. Get that in writing before using it with patient data.
- Business associate
- Augment Code
- Tool
- Augment Code
- Plans with a BAA
- Enterprise
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Enterprise | Conditions apply | Through salesRequest page | The security page lists a BAA as available and points to sales. It doesn't name eligible plans. Enterprise is the sales-negotiated plan, but confirm the BAA is offered on it before sending PHI.[1],[2] |
| Standard / Business | Not confirmed | Not stated | The pricing page lists SOC 2 and no AI training on paid plans, but no HIPAA or BAA for any tier. The Professional terms (v1.9) do not mention HIPAA or PHI.[2],[3] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Augment Code says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Augment agent, chat and code completions | Not stated | No page describes the BAA's scope or the model providers it reaches. The Community terms let Augment train on customer code, so PHI should not go through Community accounts.[1],[4] |
AI coding tools that offer a BAA
- Claude CodeBAA on: Claude Console API key (Commercial org) with zero data retention, Claude Enterprise (HIPAA-ready)Some plans only
- CursorBAA on: EnterpriseSome plans only
- Gemini Code AssistBAA on: Standard / Enterprise (Google Cloud)Some plans only
- OpenAI CodexBAA on: ChatGPT for Healthcare / ChatGPT for Clinicians / Enterprise or Edu with Regulated Workspace, OpenAI API (API key sign-in) with Modified RetentionSome plans only
All BAA-ready alternatives to Augment Code
Sources
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.