Are Cohere's AI features covered by the BAA?

Cohere hosted models (Command, Embed, Rerank) via API / SaaS: excluded from the baa. Custom model built by Cohere: covered by the baa.

Does Cohere sign a BAA?

Q: Does Cohere sign a HIPAA BAA?

Only on some plans or setups. Cohere's hosted API and SaaS products are not covered by a BAA; Cohere tells customers not to send health information through them, and its Terms of Use prohibit HIPAA-regulated data. Cohere signs BAAs only for custom model development engagements.

Only on some plans or setups

Cohere's hosted API and SaaS products are not covered by a BAA; Cohere tells customers not to send health information through them, and its Terms of Use prohibit HIPAA-regulated data. Cohere signs BAAs only for custom model development engagements.

Based on 3 sources, all from Cohere unless marked.

Not fully covered by the BAA: Cohere hosted models (Command, Embed, Rerank) via API / SaaS.

Business associate: Cohere
Tool: Cohere
Plans with a BAA: Custom model development engagement
Checked: Oct 11, 2026

Some plans only

Cohere signs only for the plans listed.

By plan

Plan	BAA	How to get it	Conditions
Hosted API / SaaS (incl. enterprise SaaS)	No BAA	Not offered	The Trust Center FAQ says the BAA does not cover hosted products or SaaS, and that enterprise customers should not submit health information there. The Terms of Use bar HIPAA-regulated health information.[1],[2]
Custom model development engagement	Signs a BAA	Through sales	Cohere may sign a BAA when it develops a custom model for a customer. Contact sales.[1],[3]
Private deployments (customer VPC / on-premises)	Not confirmed	Not stated	No official statement found on BAAs for private deployments outside custom-model engagements.[1]

Are the AI features covered?

Vendors often sign a BAA for the core product but leave some AI features out. Here is what Cohere says about each one.

AI feature	Under the BAA	Details
Cohere hosted models (Command, Embed, Rerank) via API / SaaSHosted API / SaaS (incl. enterprise SaaS)	Excluded	Excluded from the BAA, and health information is not to be submitted.[1],[2]
Custom model built by CohereCustom model development engagement	Covered	The custom-model engagement is the only BAA scope Cohere describes.[1]

LLM APIs that offer a BAA

Claude API (Claude Platform)BAA on: First-party API (custom / negotiated BAA), First-party API (self-serve Console enablement)Some plans only
GroqCloudBAA on: GroqCloud paid, generally available services (customers with an existing Groq agreement)Some plans only
OpenAI API platformBAA on: API (enterprise / sales-managed accounts), API (pay-as-you-go / self-serve organizations), API FedRAMP (with Modified Retention)Signs a BAA

All BAA-ready alternatives to Cohere

Sources

Cohere Inc | Trust CenterCohere, Trust center. Checked Oct 11, 2026.
Terms of UseCohere, Legal terms. Checked Oct 11, 2026.
HIPAA Business Associate Agreements for custom model developmentCohere, Announcement. Checked Oct 11, 2026.

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.