Does Claude Code sign a BAA?
Only on some plans or setups
Anthropic's BAA can cover Claude Code in two set-ups: a HIPAA-ready Claude Enterprise org with the HIPAA configuration applied (terminal and Desktop Code tab, local mode), or a Claude Console API key with zero data retention enabled. Cloud, web, mobile, IDE extensions and third-party cloud routes are not covered.
Not fully covered by the BAA: Claude Code with a Console API key; Claude Code on the web, cloud sessions, Remote Control and mobile; VS Code / JetBrains extensions, LLM gateways, custom base URLs, and Claude Code via Bedrock, Google Cloud or Microsoft Foundry.
- Business associate
- Anthropic
- Tool
- Claude Code
- Plans with a BAA
- Claude Enterprise (HIPAA-ready); Claude Console API key (Commercial org) with zero data retention
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Claude Enterprise (HIPAA-ready) | Conditions apply | Accept or sign online | Only the org's Primary Owner can accept the BAA in Organization settings > Data and privacy. The Primary Owner must also apply the HIPAA configuration to Claude Code (local mode), which cannot be removed afterwards. Before that, local Claude Code is covered only if ZDR is enabled for a qualified account.[1],[2] |
| Claude Console API key (Commercial org) with zero data retention | Conditions apply | Through sales | Eligible only with ZDR enabled, for qualified accounts. Covered Models cannot be used while ZDR for Claude Code is on unless Anthropic authorizes it. Without ZDR, Console API key use is not covered. The BAA article says to sign the BAA and then contact Anthropic or sales.[2],[3] |
| Claude API HIPAA readiness (without ZDR) | No BAA | Not offered | The API docs say HIPAA readiness does not cover Claude Code.[3] |
| Free / Pro / Max / Team | No BAA | Not offered | Team and individual plans cannot enable HIPAA.[1] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Anthropic says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Claude Code terminal CLI (Enterprise sign-in, direct to Anthropic) and Claude Desktop Code tab, local modeClaude Enterprise (HIPAA-ready) | Covered | Covered once the HIPAA configuration is applied.[1],[2] |
| Claude Code with a Console API keyClaude Console API key (Commercial org) with zero data retention | Partly covered | Covered through ZDR rather than the HIPAA configuration, and not covered without ZDR. Metrics logging data is exempt from ZDR.[2],[3] |
| Claude Code on the web, cloud sessions, Remote Control and mobileClaude Enterprise (HIPAA-ready) | Excluded | Not available once the HIPAA configuration is applied.[1],[2] |
| VS Code / JetBrains extensions, LLM gateways, custom base URLs, and Claude Code via Bedrock, Google Cloud or Microsoft FoundryClaude Enterprise (HIPAA-ready) | Excluded | Listed as not covered under Anthropic's BAA.[2] |
AI coding tools that offer a BAA
- CursorBAA on: EnterpriseSome plans only
- OpenAI CodexBAA on: ChatGPT for Healthcare / ChatGPT for Clinicians / Enterprise or Edu with Regulated Workspace, OpenAI API (API key sign-in) with Modified RetentionSome plans only
All BAA-ready alternatives to Claude Code
Sources
- HIPAA-ready Enterprise plans
- Business Associate Agreements (BAA) for commercial customers
- API and data retention
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.