Does OpenAI Codex sign a BAA?
Only on some plans or setups
OpenAI's BAA can cover Codex Local (CLI, IDE extension, desktop app), either signed in through a HIPAA-eligible ChatGPT workspace with Codex HIPAA support enabled, or through an API org whose BAA includes API services with Modified Retention. Codex Cloud is not covered.
Not fully covered by the BAA: Codex Cloud (cloud-hosted tasks); Web search, connectors, MCP servers, plugins and third-party services within Codex.
- Business associate
- OpenAI
- Tool
- OpenAI Codex
- Plans with a BAA
- ChatGPT for Healthcare / ChatGPT for Clinicians / Enterprise or Edu with Regulated Workspace; OpenAI API (API key sign-in) with Modified Retention
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| ChatGPT for Healthcare / ChatGPT for Clinicians / Enterprise or Edu with Regulated Workspace | Conditions apply | Through sales | Requires an applicable BAA, and the Account Director must enable Codex HIPAA support for the workspace. Admins enable Codex Local and should pin approved sign-in methods and workspaces through managed requirements.[1],[2] |
| OpenAI API (API key sign-in) with Modified Retention | Conditions apply | Accept or sign onlinebaa@openai.com | API organizations can accept OpenAI's BAA themselves under Settings > Organization > General > HIPAA compliance support, if they have an established history of API usage; otherwise contact baa@openai.com. Codex is covered only if OpenAI has also provisioned Modified Retention for the org and project. It is unclear whether the self-serve BAA lists API Services with Modified Retention as an Eligible Service, so confirm with OpenAI.[1],[2],[3] |
| ChatGPT Free / Plus / Pro / Business | No BAA | Not offered | OpenAI's HIPAA guide says consumer ChatGPT plans and ChatGPT Business are not Eligible Services.[2] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what OpenAI says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Codex Local: CLI, IDE extension, ChatGPT desktop appChatGPT for Healthcare / ChatGPT for Clinicians / Enterprise or Edu with Regulated Workspace, OpenAI API (API key sign-in) with Modified Retention | Covered | Covered only under the conditions above. The BAA does not apply to running the client on the customer's own machines, which is the customer's responsibility.[1],[2] |
| Codex Cloud (cloud-hosted tasks)ChatGPT for Healthcare / ChatGPT for Clinicians / Enterprise or Edu with Regulated Workspace, OpenAI API (API key sign-in) with Modified Retention | Excluded | Not an Eligible Service, so PHI must not be used with it.[1],[2] |
| Web search, connectors, MCP servers, plugins and third-party services within CodexChatGPT for Healthcare / ChatGPT for Clinicians / Enterprise or Edu with Regulated Workspace, OpenAI API (API key sign-in) with Modified Retention | Excluded | Excluded from Codex Local coverage. Any integration that receives PHI needs its own approval and BAA review.[1],[2] |
AI coding tools that offer a BAA
- Claude CodeBAA on: Claude Console API key (Commercial org) with zero data retention, Claude Enterprise (HIPAA-ready)Some plans only
- CursorBAA on: EnterpriseSome plans only
All BAA-ready alternatives to OpenAI Codex
Sources
- HIPAA configuration guide for Codex | ChatGPT Learn
- HIPAA Implementation and Configuration Guide (July 9, 2026)
- Getting a Business Associate Agreement (BAA) for the OpenAI API
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.