Does ChatGPT sign a BAA?
Only on some plans or setups
Only certain ChatGPT offerings come with a BAA: ChatGPT for Healthcare, Enterprise with a Regulated Workspace (sales-managed), and the free ChatGPT for Clinicians for verified US clinicians. OpenAI states that Free, Plus, Pro and Business do not.
Not fully covered by the BAA: Custom GPTs, workspace agents, Team Automations; Codex (local: desktop app, IDE, CLI); Codex in the cloud, Computer History, Codex Security administration; Cloud browser use, cloud network access, Sites, improved memory; Third-party GPTs and connected apps (Clinicians).
- Business associate
- OpenAI
- Tool
- ChatGPT
- Plans with a BAA
- Enterprise; Edu; ChatGPT for Healthcare; ChatGPT for Clinicians; ChatGPT FedRAMP
- Checked
Some plans only
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Free / Plus / Pro | No BAA | Not offered | OpenAI's HIPAA guide says the consumer ChatGPT services are not Eligible Services and may not be used with PHI.[2] |
| Business (formerly Team) | No BAA | Not offered | OpenAI states that it does not offer a BAA for ChatGPT Business.[3],[2] |
| Enterprise | Conditions apply | Through sales | Only sales-managed Enterprise accounts are eligible. The HIPAA-eligible product list names 'ChatGPT for Enterprise with Regulated Workspace', and Enterprise is eligible only if the BAA lists it as an Eligible Service.[3],[1],[2] |
| Edu | Conditions apply | Through sales | Sales-managed Edu accounts may get a BAA, and Edu is eligible only if the BAA lists it. The HIPAA-eligible products page does not list Edu as a product, though it lists Study Mode as covered functionality for Edu.[3],[1],[2] |
| ChatGPT for Healthcare | Signs a BAA | Through sales | Listed as a HIPAA-eligible product with a BAA. It is a workspace for healthcare organizations, obtained by contacting OpenAI's team. This is also the route for multi-user clinician BAAs with central controls.[1],[4],[5] |
| ChatGPT for Clinicians | Signs a BAA | Accept or sign online | Free at launch for verified US clinicians (MD/DO, NP, PA, pharmacists) with a valid NPI and a verifiable license. Each clinician reviews and signs the BAA in the product under Settings > Agreements. Individual accounts only.[1],[5] |
| ChatGPT FedRAMP | Signs a BAA | Not stated | Listed as a HIPAA-eligible product available with a BAA. How to obtain it is not described.[1] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what OpenAI says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Chat, Projects, Canvas and code-block execution, Voice (incl. screen/video sharing), RecordEnterprise, ChatGPT for Healthcare, ChatGPT for Clinicians, ChatGPT FedRAMP | Covered | Covered when used from an eligible workspace and enabled for the member's role. Internet access inside Canvas or code blocks is excluded.[1] |
| Web search and deep researchEnterprise, ChatGPT for Healthcare, ChatGPT FedRAMP | Covered | Covered because it uses OpenAI's own index rather than third-party providers.[1] |
| Custom GPTs, workspace agents, Team AutomationsEnterprise, ChatGPT for Healthcare, ChatGPT FedRAMP | Partly covered | Building, sharing and publishing workspace agents and GPTs is covered. Sharing workspace agents that use agent-owned connections is excluded, and so are event-triggered scheduled tasks.[1] |
| Apps, connectors, plugins and Office/Sheets add-insEnterprise, ChatGPT for Healthcare, ChatGPT FedRAMP | Covered | ChatGPT for Excel, PowerPoint, Word and Sheets, and the plugins, apps and connectors available to the workspace, are listed as covered. Third-party services keep their own terms.[1] |
| Codex (local: desktop app, IDE, CLI)Enterprise, ChatGPT for Healthcare, ChatGPT FedRAMP | Partly covered | Data sent to OpenAI is covered. Execution on customer machines and third-party services the client reaches are not.[1] |
| Codex in the cloud, Computer History, Codex Security administrationEnterprise, ChatGPT for Healthcare, ChatGPT FedRAMP | Excluded | Listed as not covered; do not enter PHI.[1] |
| Cloud browser use, cloud network access, Sites, improved memoryEnterprise, ChatGPT for Healthcare, ChatGPT FedRAMP | Excluded | Listed as not covered. Improved memory is off by default in Healthcare and Regulated Enterprise workspaces.[1] |
| Trusted clinical searchChatGPT for Healthcare | Covered | Listed as covered functionality that is specific to Healthcare workspaces.[1] |
| Image generation in ChatGPTEnterprise, ChatGPT for Healthcare | Not stated | The covered-functionality list does not mention it, and OpenAI says unlisted features are not automatically covered. ChatGPT for Clinicians does not support image generation.[1],[5] |
| Third-party GPTs and connected apps (Clinicians)ChatGPT for Clinicians | Excluded | Clinicians are told not to share PHI with third-party GPTs or connected apps without their own permissions and agreements, or with the Healthcare Public Data apps.[5] |
AI chat assistants that offer a BAA
- Claude apps (Claude.ai)BAA on: Enterprise (self-serve or sales-assisted)Some plans only
- GrokBAA on: API (ZDR-enabled)Some plans only
- PerplexityBAA on: API (Sonar), Enterprise Pro / Enterprise MaxSome plans only
- BastionGPTBAA on: API, Professional, Professional Plus, Ultra (Enterprise)Signs a BAA
- CompliantChatGPTBAA on: Enterprise, Starter / Pro / FullSigns a BAA
- Hathr AIBAA on: API (Base / Starter / Scale), Enterprise, Single Subscription WebappSigns a BAA
All BAA-ready alternatives to ChatGPT
Sources
- HIPAA eligible products and functionality
- OpenAI HIPAA Guide
- How can I get a Business Associate Agreement (BAA) with OpenAI?
- OpenAI for Healthcare
- ChatGPT for Clinicians
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.