Are GitHub Copilot's AI features covered by the BAA?

Copilot (code completion, Copilot Chat, coding agent): excluded from the baa.

Does GitHub Copilot sign a BAA?

Q: Does GitHub Copilot sign a HIPAA BAA?

No BAA available. GitHub publishes no BAA offering for Copilot. Its Data Protection Agreement, which covers Copilot, bars customers from sending GitHub HIPAA-regulated health data unless GitHub gives prior, written, specific consent.

No BAA available

GitHub publishes no BAA offering for Copilot. Its Data Protection Agreement, which covers Copilot, bars customers from sending GitHub HIPAA-regulated health data unless GitHub gives prior, written, specific consent.

Based on 5 sources, all from GitHub unless marked.

Business associate: GitHub
Tool: GitHub Copilot
Plans with a BAA: None
Checked: Oct 11, 2026

No BAA

GitHub won't sign a BAA for GitHub Copilot.

By plan

Plan	BAA	How to get it	Conditions
Copilot Business / Copilot Enterprise (governed by the GitHub DPA)	No BAA	Not offered	Section 12 of the GitHub DPA (October 2025) bars customers from giving GitHub HIPAA protected health information unless GitHub gives prior, written, specific consent. GitHub publishes no BAA or way to request one. Microsoft's HIPAA BAA in-scope service list does not include GitHub, so Microsoft's BAA does not cover Copilot.[2],[1],[3]
Copilot Free / Pro / Pro+ (individual accounts)	Not confirmed	Not stated	The GitHub Terms of Service do not mention HIPAA, PHI or BAAs, and no BAA offering for individual plans was found. GitHub does not say whether the DPA's PHI restriction applies to these plans.[4],[5]

Are the AI features covered?

Vendors often sign a BAA for the core product but leave some AI features out. Here is what GitHub says about each one.

AI feature	Under the BAA	Details
Copilot (code completion, Copilot Chat, coding agent)Copilot Business / Copilot Enterprise (governed by the GitHub DPA)	Excluded	No BAA exists to cover Copilot features. The DPA, which applies to Copilot, prohibits sending PHI without GitHub's specific written consent.[1],[2]

AI coding tools that offer a BAA

Claude CodeBAA on: Claude Console API key (Commercial org) with zero data retention, Claude Enterprise (HIPAA-ready)Some plans only
CursorBAA on: EnterpriseSome plans only
OpenAI CodexBAA on: ChatGPT for Healthcare / ChatGPT for Clinicians / Enterprise or Edu with Regulated Workspace, OpenAI API (API key sign-in) with Modified RetentionSome plans only

All BAA-ready alternatives to GitHub Copilot

Sources

Customer agreements · GitHubGitHub, Legal terms. Checked Oct 11, 2026.
GitHub Data Protection Agreement (October 2025)GitHub, Legal terms. Checked Oct 11, 2026.
HIPAA/HITECH - Microsoft complianceMicrosoft, Documentation. Checked Oct 11, 2026.
GitHub Terms of ServiceGitHub, Legal terms. Checked Oct 11, 2026.
GitHub Copilot Trust CenterGitHub, Trust center. Checked Oct 11, 2026.

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.