Does Grok sign a BAA?

Q: Does Grok sign a HIPAA BAA?

Only on some plans or setups. xAI says it can support HIPAA compliance under some circumstances and takes BAA requests through a questionnaire. Its Enterprise Terms allow PHI only after a BAA is signed and only through the Zero Data Retention-enabled API. The consumer Grok terms never mention HIPAA.

Q: Are Grok's AI features covered by the BAA?

Stateless chat/completions via ZDR-enabled API: covered by the baa. Files API, Collections (RAG), Batch API, deferred completions, stored Responses state: excluded from the baa. Image/video generation and voice agents under ZDR: partly covered.

Only on some plans or setups

xAI says it can support HIPAA compliance under some circumstances and takes BAA requests through a questionnaire. Its Enterprise Terms allow PHI only after a BAA is signed and only through the Zero Data Retention-enabled API. The consumer Grok terms never mention HIPAA.

Based on 6 sources, all from xAI (SpaceXAI LLC) unless marked.

Not fully covered by the BAA: Files API, Collections (RAG), Batch API, deferred completions, stored Responses state; Image/video generation and voice agents under ZDR.

Business associate: xAI (SpaceXAI LLC)
Tool: Grok
Plans with a BAA: API (ZDR-enabled)
Checked: Oct 11, 2026

Some plans only

xAI (SpaceXAI LLC) signs only for the plans listed.

By plan

Plan	BAA	How to get it	Conditions
Consumer Grok (grok.com, apps, Grok in X, SuperGrok)	Not confirmed	Not stated	The consumer Terms do not mention HIPAA, PHI, or a BAA. They point business and developer use to the Enterprise Terms.[1]
API (ZDR-enabled)	Conditions apply	Request by emailRequest page	An authorized representative fills out the BAA questionnaire, and xAI reviews it and follows up. Enterprise Terms section 11.1 requires a signed BAA and routing of PHI through the ZDR-enabled API. ZDR is enabled per team in the xAI Console.[2],[3],[4],[5]
Grok Business / Grok Enterprise (team chat app)	Not confirmed	Not stated	The Business page shows a HIPAA badge and a BAA footer link but no details. The Enterprise Terms cover 'related services (including Grok)' yet require PHI to go only through the ZDR-enabled API. The pages checked never say whether the chat app itself can receive PHI under a BAA.[2],[6]

Are the AI features covered?

Vendors often sign a BAA for the core product but leave some AI features out. Here is what xAI (SpaceXAI LLC) says about each one.

AI feature	Under the BAA	Details
Stateless chat/completions via ZDR-enabled APIAPI (ZDR-enabled)	Covered	Under ZDR, prompts and outputs are never written to disk. This is the only route the Enterprise Terms allow for PHI, and only after a BAA.[2],[5]
Files API, Collections (RAG), Batch API, deferred completions, stored Responses stateAPI (ZDR-enabled)	Excluded	These features are unavailable or blocked once ZDR is on, and PHI must go through ZDR. They therefore cannot be used with PHI.[2],[5]
Image/video generation and voice agents under ZDRAPI (ZDR-enabled)	Partly covered	Under ZDR, image generation is limited to grok-imagine models with no stored outputs or file inputs, agentic image generation is excluded, and voice conversation history is not kept. The pages do not say how the BAA treats these features.[5]

AI chat assistants that offer a BAA

ChatGPTBAA on: ChatGPT FedRAMP, ChatGPT for Clinicians, ChatGPT for Healthcare, Edu, EnterpriseSome plans only
Claude apps (Claude.ai)BAA on: Enterprise (self-serve or sales-assisted)Some plans only
PerplexityBAA on: API (Sonar), Enterprise Pro / Enterprise MaxSome plans only
BastionGPTBAA on: API, Professional, Professional Plus, Ultra (Enterprise)Signs a BAA
CompliantChatGPTBAA on: Enterprise, Starter / Pro / FullSigns a BAA
Hathr AIBAA on: API (Base / Starter / Scale), Enterprise, Single Subscription WebappSigns a BAA

All BAA-ready alternatives to Grok

Compare Grok

ChatGPT vs GrokChatGPT: some plans

Sources

Terms of Service (consumer)xAI (SpaceXAI LLC), Legal terms. Checked Oct 11, 2026.
Terms of Service - EnterprisexAI (SpaceXAI LLC), Legal terms. Checked Oct 11, 2026.
BAA QuestionnairexAI (SpaceXAI LLC), Legal terms. Checked Oct 11, 2026.
Enterprise FAQxAI (SpaceXAI LLC), Legal terms. Checked Oct 11, 2026.
FAQ - API Security (Developers)xAI (SpaceXAI LLC), Documentation. Checked Oct 11, 2026.
Grok for BusinessxAI (SpaceXAI LLC), Documentation. Checked Oct 11, 2026.

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.