Are Cursor's AI features covered by the BAA?

Desktop IDE AI (Agent, Tab, Edit, local agent mode, inline edit): covered by the baa. Cloud Agents, CLI, Cursor for iOS, BugBot, Automations: covered by the baa. AI models / third-party model providers: partly covered. Third-party services and integrations: excluded from the baa.

Does Cursor sign a BAA?

Q: Does Cursor sign a HIPAA BAA?

Only on some plans or setups. Cursor signs HIPAA BAAs only on its Enterprise plan, arranged through sales. Coverage applies to listed Eligible Services and only when Privacy Mode is enabled and locked for the whole organization.

Only on some plans or setups

Cursor signs HIPAA BAAs only on its Enterprise plan, arranged through sales. Coverage applies to listed Eligible Services and only when Privacy Mode is enabled and locked for the whole organization.

Based on 2 sources, all from Anysphere (Cursor) unless marked.

Not fully covered by the BAA: AI models / third-party model providers; Third-party services and integrations.

Business associate: Anysphere (Cursor)
Tool: Cursor
Plans with a BAA: Enterprise
Checked: Oct 11, 2026

Some plans only

Anysphere (Cursor) signs only for the plans listed.

By plan

Plan	BAA	How to get it	Conditions
Enterprise	Signs a BAA	Through salesRequest page	Requires a signed Enterprise agreement and BAA before any PHI is submitted. Privacy Mode must be enabled and locked organization-wide, and users may send PHI only through Eligible Services. The HIPAA Implementation and Configuration Guide forms part of the BAA and is available on request from the Trust Center.[1]
Teams	No BAA	Through salesRequest page	Teams customers are told to contact sales about moving to Enterprise before they request a BAA.[1]
Hobby / Pro / individual plans	Not confirmed	Not stated	The BAA page names only Enterprise and does not mention individual plans.[1]

Are the AI features covered?

Vendors often sign a BAA for the core product but leave some AI features out. Here is what Anysphere (Cursor) says about each one.

AI feature	Under the BAA	Details
Desktop IDE AI (Agent, Tab, Edit, local agent mode, inline edit)Enterprise	Covered	Listed as an Eligible Service, covered only when Privacy Mode is enabled and locked.[1]
Cloud Agents, CLI, Cursor for iOS, BugBot, AutomationsEnterprise	Covered	Listed as Eligible Services, covered only when Privacy Mode is enabled and locked.[1]
AI models / third-party model providersEnterprise	Partly covered	Only Eligible Models are covered, and the list is in the gated HIPAA guide. Cursor says third-party model providers are not automatically covered by its BAA.[1]
Third-party services and integrationsEnterprise	Excluded	Cursor says these are not automatically covered by its BAA.[1]

AI coding tools that offer a BAA

Claude CodeBAA on: Claude Console API key (Commercial org) with zero data retention, Claude Enterprise (HIPAA-ready)Some plans only
OpenAI CodexBAA on: ChatGPT for Healthcare / ChatGPT for Clinicians / Enterprise or Edu with Regulated Workspace, OpenAI API (API key sign-in) with Modified RetentionSome plans only

All BAA-ready alternatives to Cursor

Sources

HIPAA Business Associate Agreements | Cursor DocsCursor, Documentation. Checked Oct 11, 2026.
Cursor Trust CenterCursor, Trust center. Checked Oct 11, 2026.

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.