Is Warp HIPAA compliant?
Not for patient data. Warp doesn't sign a Business Associate Agreement, and HIPAA requires one before a vendor handles PHI for you.
Does Warp sign a BAA?
No BAA available
Warp publishes no BAA. Its terms bar customers from uploading personal information other than login credentials unless Warp agrees otherwise in writing, which rules out PHI under standard terms.
- Business associate
- Warp
- Tool
- Warp
- Plans with a BAA
- None
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| All plans (Free, paid, Business, Enterprise) | No BAA | Not offered | Section 5.4 of Warp's terms bars uploading personal information other than user login credentials unless agreed in writing. No Warp page mentions HIPAA or a BAA. Only a separately negotiated written agreement could change this, and Warp publishes no such route.[1],[2],[3] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Warp says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Warp AI agents and terminal AI | Excluded | AI requests go through Warp's proxy to US-hosted model APIs under zero-data-retention agreements. That doesn't amount to a BAA, and the terms still bar uploading personal information.[1],[2],[3] |
AI coding tools that offer a BAA
- Augment CodeBAA on: EnterpriseSome plans only
- Claude CodeBAA on: Claude Console API key (Commercial org) with zero data retention, Claude Enterprise (HIPAA-ready)Some plans only
- CursorBAA on: EnterpriseSome plans only
- Gemini Code AssistBAA on: Standard / Enterprise (Google Cloud)Some plans only
- OpenAI CodexBAA on: ChatGPT for Healthcare / ChatGPT for Clinicians / Enterprise or Edu with Regulated Workspace, OpenAI API (API key sign-in) with Modified RetentionSome plans only
All BAA-ready alternatives to Warp
Sources
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.