Is OpenRouter HIPAA compliant?
Not confirmed. We couldn't find a Business Associate Agreement offer on OpenRouter's own pages. Without a signed BAA, keep patient data out of it.
Does OpenRouter sign a BAA?
Not confirmed
OpenRouter's terms, privacy policy, docs and enterprise page never mention HIPAA, PHI or a BAA. It routes prompts to many third-party model providers under their own terms, so BAA availability is unknown.
- Business associate
- OpenRouter
- Tool
- OpenRouter
- Plans with a BAA
- Not stated
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Pay-as-you-go API | Not confirmed | Not stated | The Terms (updated August 31, 2026) don't mention HIPAA or PHI. They make the customer responsible for judging whether a model suits regulated or sensitive uses and disclaim medical uses. Prompts are not logged unless the customer opts in, and a Zero Data Retention setting limits routing to providers that don't store data.[2],[1],[3] |
| Enterprise | Not confirmed | Not stated | The enterprise page mentions an enterprise agreement, data protection agreements, GDPR and regional routing, but not HIPAA or a BAA.[4] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what OpenRouter says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Model routing to third-party providers (chat completions API) | Not stated | No BAA is documented. Requests are passed to outside model providers whose own terms apply; the privacy policy says providers may use data under their own terms.[1],[3] |
LLM APIs that offer a BAA
- Claude API (Claude Platform)BAA on: First-party API (custom / negotiated BAA), First-party API (self-serve Console enablement)Some plans only
- CohereBAA on: Custom model development engagementSome plans only
- GroqCloudBAA on: GroqCloud paid, generally available services (customers with an existing Groq agreement)Some plans only
- Hugging FaceBAA on: EnterpriseSome plans only
- ModalBAA on: EnterpriseSome plans only
- BasetenBAA on: All plans (Basic, Pro, Enterprise)Signs a BAA
All BAA-ready alternatives to OpenRouter
Sources
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.