Are Claude apps (Claude.ai)'s AI features covered by the BAA?

Chat, Projects, Artifacts, voice, web search, Research: covered by the baa. File creation and code execution: partly covered. Claude Code (terminal via Enterprise sign-in, Desktop tab) and Cowork in Claude Desktop, local mode: partly covered. Claude Code on web/cloud/mobile, Remote Control, Cowork in the cloud, Code Review, Security, computer use: excluded from the baa. Claude Code VS Code / JetBrains extensions, gateway or custom base URL setups, and Claude Code via Bedrock / Agent Platform / Foundry: excluded from the baa. MCP servers and connectors, Enterprise Search, Claude in Chrome, Skills: excluded from the baa. Beta features (Claude in Office, Claude Design, Claude Slides, Claude Docs): excluded from the baa. Covered Models (e.g., Claude Fable 5 / 5.1) in chat: covered by the baa.

Does Claude apps (Claude.ai) sign a BAA?

Q: Does Claude apps (Claude.ai) sign a HIPAA BAA?

Only on some plans or setups. Only Claude Enterprise can get a BAA: its Primary Owner accepts it in organization settings to make the org HIPAA-ready. Anthropic says Free, Pro, Max and Team plans cannot enable HIPAA.

Only on some plans or setups

Only Claude Enterprise can get a BAA: its Primary Owner accepts it in organization settings to make the org HIPAA-ready. Anthropic says Free, Pro, Max and Team plans cannot enable HIPAA.

Based on 4 sources, all from Anthropic unless marked.

Not fully covered by the BAA: File creation and code execution; Claude Code (terminal via Enterprise sign-in, Desktop tab) and Cowork in Claude Desktop, local mode; Claude Code on web/cloud/mobile, Remote Control, Cowork in the cloud, Code Review, Security, computer use; Claude Code VS Code / JetBrains extensions, gateway or custom base URL setups, and Claude Code via Bedrock / Agent Platform / Foundry; MCP servers and connectors, Enterprise Search, Claude in Chrome, Skills; Beta features (Claude in Office, Claude Design, Claude Slides, Claude Docs).

Business associate: Anthropic
Tool: Claude apps (Claude.ai)
Plans with a BAA: Enterprise (self-serve or sales-assisted)
Checked: Oct 11, 2026

Some plans only

Anthropic signs only for the plans listed.

By plan

Plan	BAA	How to get it	Conditions
Free / Pro / Max	No BAA	Not offered	Anthropic says individual plans can't enable HIPAA, and its API docs list consumer products as outside HIPAA coverage.[1],[2]
Team	No BAA	Not offered	Anthropic says Team plans can't enable HIPAA.[1]
Enterprise (self-serve or sales-assisted)	Signs a BAA	Accept or sign online	Only the Primary Owner can accept the BAA, under Organization settings > Data and privacy > HIPAA Compliance, with no sales or legal cycle needed. Standard Enterprise has no BAA coverage until this is done. To cover Claude Code and Cowork (local mode), the separate HIPAA configuration must be applied, and it cannot be removed afterward.[1],[3]

Are the AI features covered?

Vendors often sign a BAA for the core product but leave some AI features out. Here is what Anthropic says about each one.

AI feature	Under the BAA	Details
Chat, Projects, Artifacts, voice, web search, ResearchEnterprise (self-serve or sales-assisted)	Covered	Listed as covered on a HIPAA-ready Enterprise org.[3]
File creation and code executionEnterprise (self-serve or sales-assisted)	Partly covered	Covered, except network access and external sites.[3]
Claude Code (terminal via Enterprise sign-in, Desktop tab) and Cowork in Claude Desktop, local modeEnterprise (self-serve or sales-assisted)	Partly covered	Covered only after the Primary Owner applies the HIPAA configuration and only when connecting directly to Anthropic. Before that, Cowork is available but not covered.[1],[3]
Claude Code on web/cloud/mobile, Remote Control, Cowork in the cloud, Code Review, Security, computer useEnterprise (self-serve or sales-assisted)	Excluded	Not covered. Cloud features become unavailable once the HIPAA configuration is applied.[1],[3]
Claude Code VS Code / JetBrains extensions, gateway or custom base URL setups, and Claude Code via Bedrock / Agent Platform / FoundryEnterprise (self-serve or sales-assisted)	Excluded	Listed as not covered under the BAA.[3]
MCP servers and connectors, Enterprise Search, Claude in Chrome, SkillsEnterprise (self-serve or sales-assisted)	Excluded	Enterprise integrations are not covered, and third-party data flows are excluded.[3]
Beta features (Claude in Office, Claude Design, Claude Slides, Claude Docs)Enterprise (self-serve or sales-assisted)	Excluded	Listed as not covered.[3]
Covered Models (e.g., Claude Fable 5 / 5.1) in chatEnterprise (self-serve or sales-assisted)	Covered	Available in chat on a HIPAA-ready Enterprise plan with standard retention and no configuration change. Rollout is staged, and ZDR is not compatible.[4]

AI chat assistants that offer a BAA

ChatGPTBAA on: ChatGPT FedRAMP, ChatGPT for Clinicians, ChatGPT for Healthcare, Edu, EnterpriseSome plans only
GrokBAA on: API (ZDR-enabled)Some plans only
PerplexityBAA on: API (Sonar), Enterprise Pro / Enterprise MaxSome plans only
BastionGPTBAA on: API, Professional, Professional Plus, Ultra (Enterprise)Signs a BAA
CompliantChatGPTBAA on: Enterprise, Starter / Pro / FullSigns a BAA
Hathr AIBAA on: API (Base / Starter / Scale), Enterprise, Single Subscription WebappSigns a BAA

All BAA-ready alternatives to Claude apps (Claude.ai)

Sources

HIPAA-ready Enterprise plansAnthropic, Help center. Checked Oct 11, 2026.
API and data retentionAnthropic, Documentation. Checked Oct 11, 2026.
Business Associate Agreements (BAA) for commercial customersAnthropic, Help center. Checked Oct 11, 2026.
Covered Models under a Business Associate Agreement (BAA)Anthropic, Help center. Checked Oct 11, 2026.

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.