Does OpenAI API platform sign a BAA?
Yes, it signs a BAA
OpenAI signs BAAs for its API platform after a case-by-case review; you request one by email, and the organization must also be provisioned with Modified Retention. Most endpoints are covered, but live-internet web search is not.
Not fully covered by the BAA: Web search tool (Responses API), live internet access; Web search tool (Responses API), offline mode; Remote MCP servers; Codex local, signed in with an API key.
- Business associate
- OpenAI
- Tool
- OpenAI API platform
- Plans with a BAA
- API (pay-as-you-go / self-serve organizations); API (enterprise / sales-managed accounts); API FedRAMP (with Modified Retention)
- Checked
Signs a BAA
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| API (pay-as-you-go / self-serve organizations) | Signs a BAA | Request by emailbaa@openai.com | Email OpenAI with company and use-case details; OpenAI says it replies in 1-2 business days and reviews each request case by case, and some use cases may be declined. An enterprise agreement is not required. HIPAA eligibility also requires the organization to be provisioned with Modified Retention.[1],[2],[3] |
| API (enterprise / sales-managed accounts) | Signs a BAA | Through sales | OpenAI says enterprise API customers can ask their account team for access. Reconsideration of a denied request is available only to customers working with OpenAI sales.[1],[4] |
| API FedRAMP (with Modified Retention) | Signs a BAA | Not stated | Listed by OpenAI as a HIPAA-eligible product available with a BAA. How to obtain it is not described.[2] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what OpenAI says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Core model endpoints (Chat Completions, Responses, Completions, Embeddings, Moderations)API (pay-as-you-go / self-serve organizations), API (enterprise / sales-managed accounts) | Covered | Listed as covered when a BAA is executed and the organization has Modified Retention.[2] |
| Assistants, Threads, Vector Stores, Files, Batches, Fine-tuningAPI (pay-as-you-go / self-serve organizations), API (enterprise / sales-managed accounts) | Covered | Listed as covered endpoints on OpenAI's HIPAA-eligible products page. Several of these are not eligible for Zero Data Retention, but OpenAI says BAA-eligible endpoints can process PHI even when data is retained.[2],[5] |
| Image generation and editing endpointsAPI (pay-as-you-go / self-serve organizations), API (enterprise / sales-managed accounts) | Covered | /v1/images/generations, /edits and /variations are on the covered list.[2] |
| Audio (transcription, translation, speech) and Realtime / live sessionsAPI (pay-as-you-go / self-serve organizations), API (enterprise / sales-managed accounts) | Covered | Audio endpoints, /v1/realtime and /v1/live/sessions are on the covered list.[2] |
| Decisions APIAPI (pay-as-you-go / self-serve organizations), API (enterprise / sales-managed accounts) | Covered | Eligible for HIPAA use under an executed OpenAI BAA and Healthcare Addendum.[2],[5] |
| Web search tool (Responses API), live internet accessAPI (pay-as-you-go / self-serve organizations), API (enterprise / sales-managed accounts) | Excluded | OpenAI says web search with live internet access is not HIPAA eligible and not covered by a BAA.[5] |
| Web search tool (Responses API), offline modeAPI (pay-as-you-go / self-serve organizations), API (enterprise / sales-managed accounts) | Partly covered | Can be covered by a BAA only when used with an API key from a Zero Data Retention-enabled project.[5] |
| Remote MCP serversAPI (pay-as-you-go / self-serve organizations), API (enterprise / sales-managed accounts) | Excluded | OpenAI describes MCP servers as third-party services whose own data policies apply; they are not on the covered endpoint list.[2],[5] |
| Codex local, signed in with an API keyAPI (pay-as-you-go / self-serve organizations), API (enterprise / sales-managed accounts) | Partly covered | Covered only if the customer's BAA includes API Services with Modified Retention; work done on the customer's own machine is not covered.[2] |
Sources
- How can I get a Business Associate Agreement (BAA) with OpenAI?
- HIPAA eligible products and functionality
- Enterprise privacy at OpenAI
- OpenAI for Healthcare
- Data controls in the OpenAI platform
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.