Is ChatGPT HIPAA compliant?
Only certain OpenAI offerings can be used with protected health information (PHI), and only under a signed business associate agreement (BAA) with the right setup. Consumer ChatGPT is not on OpenAI's HIPAA-eligible list.
When someone on your team asks "is ChatGPT HIPAA compliant?", the honest answer is another question. Which ChatGPT do they mean? OpenAI offers several products under that name, each with its own terms. Some sit on OpenAI's own list of HIPAA eligible products in the OpenAI Help Center. Others do not, even when they come with strong security features.
Our pillar post on the seven requirements for HIPAA-compliant AI covers the full checklist. You meet those requirements with a signed BAA plus your own safeguards, so start by confirming which OpenAI offering your staff actually use.
Which ChatGPT plans can be covered by a BAA?
OpenAI lists six offerings as HIPAA eligible when a BAA is in place. They come from the OpenAI Help Center article on HIPAA eligible products and functionality, which we read in October 2026.
- ChatGPT for Healthcare
- ChatGPT for Enterprise with Regulated Workspace
- ChatGPT FedRAMP
- ChatGPT for Clinicians
- API with Modified Retention
- API FedRAMP with Modified Retention
For the API, OpenAI requires a signed BAA plus Modified Retention, unless it specifies otherwise. On the ChatGPT side, watch the exact product name. Standard ChatGPT Enterprise is not on the list. The Regulated Workspace version is.
Are all features covered inside an eligible plan?
Not every feature inside an eligible workspace is covered. OpenAI's excluded list includes "Use improved memory" and "Allow internet access in Canvas and code blocks", along with several agent and cloud work settings.
Anything new needs checking, too. In OpenAI's words, "Features not listed here are not automatically covered under the BAA." Listed features are covered only when used from an eligible workspace. Our reading is that a feature your staff switch on next month may sit outside the agreement until OpenAI adds it to the list.
The list changes over time. Have your privacy officer check it before each rollout and whenever OpenAI announces a new feature. Then save a dated copy with your signed BAA.
Which ChatGPT plans are not covered?
As of October 2026, consumer ChatGPT plans, ChatGPT Health, standard ChatGPT Enterprise and other business plans are all missing from OpenAI's HIPAA-eligible list. Keep PHI out of every one of them.
Can staff use personal ChatGPT accounts for PHI?
No. Free and paid personal plans are services for individuals. OpenAI's help article on how OpenAI uses data to improve model performance says: "ChatGPT, for instance, improves by further training on the conversations people have with it, unless you opt out."
Opting out limits training and creates no BAA. So for a personal account, the answer to "is ChatGPT HIPAA compliant" is no.
Picture someone at your front desk who pastes a patient's email into their own ChatGPT account to draft a quick reply. That email now sits in a consumer account with no BAA behind it. Switching off training would not change that, so your written AI policy should call out this exact case.
Is ChatGPT Health the same as ChatGPT for Healthcare?
No. They are separate products built for different users. OpenAI's announcement of ChatGPT Health on January 7, 2026 describes it as "a dedicated experience that securely brings your health information and ChatGPT's intelligence together." It is aimed at individuals managing their own health information. It launched on Free, Go, Plus and Pro plans.
OpenAI says "Conversations in Health are not used to train our foundation models" and that the feature "is not intended for diagnosis or treatment." The announcement does not mention HIPAA or a BAA. HIPAA Journal's ChatGPT explainer reported in January 2026 that OpenAI will not sign a BAA with ChatGPT Health users.
For example, a patient might use ChatGPT Health to manage her own health information while your team drafts prior authorization requests in a ChatGPT for Healthcare workspace under your signed BAA. Her use is a personal choice on a consumer plan. Your team's use is the part your practice answers for.
Does standard ChatGPT Enterprise qualify?
Standard ChatGPT Enterprise is off the HIPAA-eligible list, even with real security features. The OpenAI Enterprise privacy page says "We do not train on your business data, and our models don't learn from your usage." It lists "Data encryption at rest (AES-256) and in transit (TLS 1.2+)" and says "We've been audited for SOC 2 compliance."
That page does not mention HIPAA or BAAs. Our reasoning is that encryption and a SOC 2 audit do not replace a BAA. If your organization already pays for Enterprise, ask OpenAI about the Regulated Workspace version before anyone enters patient information.
How do OpenAI's offerings compare for PHI?
Only the offerings on OpenAI's HIPAA-eligible list can hold PHI, and only under a signed BAA with your own safeguards in place. This table matches that list as we read it in October 2026. Check OpenAI's current list before you decide.
| OpenAI offering | On OpenAI's HIPAA-eligible list? | BAA available? | Use with PHI? |
|---|---|---|---|
| Consumer ChatGPT plans (Free, Go, Plus, Pro) | No | Not listed | No |
| ChatGPT Health | No | No, per HIPAA Journal | No |
| Standard business plans, such as ChatGPT Enterprise without Regulated Workspace | No | Not listed. Check OpenAI's current list | No |
| ChatGPT for Enterprise with Regulated Workspace | Yes | Yes | Only under a signed BAA, with excluded features turned off |
| ChatGPT for Healthcare | Yes | Yes | Only under a signed BAA, with excluded features turned off |
| OpenAI API with Modified Retention | Yes | Yes, and Modified Retention is required | Only under a signed BAA, for eligible customers, after checking each endpoint and tool |
Does turning off model training make ChatGPT safe for PHI?
No. Training settings and a BAA answer two separate questions. A training setting decides whether OpenAI uses your content to improve its models. A BAA sets what OpenAI may do with PHI and the safeguards it has to keep.
Under the HHS sample business associate agreement provisions, a BAA must "establish the permitted and required uses and disclosures of protected health information by the business associate." It also has to require the business associate to "implement appropriate safeguards to prevent unauthorized use or disclosure of the information." A training toggle does neither.
Standard ChatGPT Enterprise shows the gap. OpenAI's help article on model training says "We don't use content from our business offerings" for training by default, and Enterprise is one of the offerings it names. That plan still sits outside the HIPAA-eligible list.
HHS guidance on HIPAA and cloud computing says a cloud provider that handles ePHI for a covered entity is a business associate "even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data." We read that rule as applying to AI vendors too. If an AI tool receives PHI, you need a BAA, whatever its training settings.
What does ChatGPT for Healthcare include?
ChatGPT for Healthcare is OpenAI's organizational workspace for healthcare teams. In its OpenAI for Healthcare announcement of January 8, 2026, OpenAI describes it as a secure workspace for clinicians, administrators and researchers that supports "HIPAA-compliant use" when paired with a BAA. The features it lists include:
- Evidence retrieval with citations
- Integration with Microsoft SharePoint
- Shared templates for tasks such as discharge summaries and prior authorization support
- Role-based access controls, with user management through SAML SSO and SCIM
OpenAI states that "Content shared with ChatGPT for Healthcare is not used to train models." The announcement also mentions "options for data residency, audit logs, customer-managed encryption keys." Those are options, so someone on your team has to decide which ones you need and then review them.
Plan for the BAA review to take time. HIPAA Journal's article on ChatGPT for Healthcare reported in January 2026 that OpenAI prepares BAAs case by case and lets organizations preview them only under an NDA. Put legal review on your rollout schedule before anyone loads patient data.
Confirm the workspace type in writing, too, because ChatGPT Health and ChatGPT for Healthcare share most of a name. A mix-up puts PHI in a product with no BAA.
What about the OpenAI API?
The API with Modified Retention is on OpenAI's HIPAA-eligible list. For API use, OpenAI requires a signed BAA and Modified Retention unless it specifies otherwise. Its healthcare announcement says "Eligible customers can apply for a Business Associate Agreement (BAA) with OpenAI."
The OpenAI developer documentation on data controls says "data sent to the OpenAI API is not used to train or improve OpenAI models" by default, though customers can opt in. Abuse monitoring logs are generated for all API feature usage and "retained for up to 30 days" by default. Retention can run longer when it is legally required or needed to protect services or third parties.
Modified Abuse Monitoring and Zero Data Retention keep customer content out of those logs. Both need OpenAI's approval before you start, so apply early.
Some endpoints, including Assistants, Files and Batch, are not eligible for Zero Data Retention and may keep application state until deleted. Web Search with live internet access is not HIPAA eligible and is not covered by a BAA. Your developers should check each endpoint and tool against OpenAI's list before connecting it to PHI.
If you are scoping a custom assistant on the API, our AI agents and copilots service can help your IT lead plan the build.
What does a practice still have to do with a BAA in place?
Most of the safeguards stay with your practice. A BAA covers OpenAI's duties, and you keep your own obligations under the HIPAA Security Rule. Our pillar post lists seven requirements to meet before PHI goes into any AI tool. Four of them sit on your side once the BAA is signed.
Update your risk analysis
The HHS guidance on risk analysis says "The risk analysis process should be ongoing." Add the specific OpenAI product, and every feature you turn on, to that analysis before go-live.
Limit PHI to the minimum necessary
The HHS minimum necessary requirement asks covered entities to limit PHI to "the minimum necessary to accomplish the intended purpose." In practice, staff should share only the details a task needs. A draft appeal letter rarely needs the whole chart.
Set access and audit controls
The HHS summary of the HIPAA Security Rule calls for access controls "to allow only authorized persons to access ePHI" and audit controls that "record and examine activity in information systems that contain or use ePHI." In ChatGPT for Healthcare, the SSO user management and audit log options OpenAI lists can support this. Someone on your team still has to own them.
Train staff and write a policy
The Security Rule summary also says "A regulated entity must train all workforce members on its security policies and procedures." We recommend a short written AI policy that names your approved workspace and bans PHI in personal ChatGPT accounts. Tell staff which excluded features to leave off, such as improved memory. If no one has time to own this, our fractional Chief AI Officer service can help with the policy.
Can you use AI without sending PHI to OpenAI?
Yes. You can run AI workflows inside systems your practice controls. Through our medical industry work, we build custom workflows to HIPAA requirements in your own environment, without your information ever touching OpenAI.
For medical teams, those workflows include prior authorizations and claims follow-up. Our intelligent workflow automation service covers that build.
Frequently Asked Questions
Is ChatGPT Plus HIPAA compliant?
No. Plus is a consumer plan, and consumer ChatGPT is not on OpenAI's HIPAA-eligible list. OpenAI says ChatGPT for individuals improves by training on conversations unless the user opts out, and opting out creates no BAA. Keep PHI out of Plus and every other personal account your staff use.
Does OpenAI sign a ChatGPT BAA?
Yes, for certain offerings. As of October 2026, OpenAI lists ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT FedRAMP, ChatGPT for Clinicians and API offerings with Modified Retention as HIPAA eligible with a BAA. Leave time for legal review. HIPAA Journal reported in January 2026 that OpenAI prepares BAAs case by case and lets organizations preview them only under an NDA.
Is ChatGPT Enterprise HIPAA compliant?
Only one version is on OpenAI's list. As of October 2026, ChatGPT for Enterprise with Regulated Workspace is HIPAA eligible with a BAA. Standard ChatGPT Enterprise is not on the list, even though it encrypts data and does not train on business data. We do not treat those features as a substitute for a BAA. Ask OpenAI about Regulated Workspace before staff use Enterprise with patient information.
Is ChatGPT Health HIPAA compliant?
ChatGPT Health is not on OpenAI's HIPAA-eligible list. It is a consumer feature for individuals managing their own health information, launched on Free, Go, Plus and Pro plans. OpenAI's announcement does not mention HIPAA or a BAA, and HIPAA Journal reported in January 2026 that OpenAI will not sign a BAA with ChatGPT Health users. ChatGPT for Healthcare, the organizational workspace, is a separate product.
Can staff use ChatGPT if they remove patient names?
Not if names are all you remove. HHS de-identification guidance describes a Safe Harbor method that requires "the removal of specified individual identifiers", and that list goes beyond names to dates and medical record numbers. In our reading, a note with names stripped usually still carries some of those details. Until your privacy officer confirms the data is de-identified, treat it as PHI and keep it in a HIPAA-eligible workspace under a signed BAA.
Can we use the OpenAI API with patient data?
Yes, with conditions. OpenAI lists the API with Modified Retention as HIPAA eligible, and API use requires a signed BAA and Modified Retention unless OpenAI specifies otherwise. Some endpoints, such as Assistants, Files and Batch, may keep application state until deleted. Web Search with live internet access is not covered by a BAA. Have your IT lead check each endpoint before it touches PHI.
Final Takeaways
- Ask "is ChatGPT HIPAA compliant" about a specific product, because the answer changes by plan and setup.
- Put PHI only in offerings on OpenAI's HIPAA-eligible list, under a signed BAA and your own safeguards. Recheck that list before each rollout.
- Keep PHI out of personal ChatGPT accounts and ChatGPT Health, whatever their training settings.
- Turn off excluded features such as improved memory, even inside an eligible workspace.
- Add the OpenAI product to your risk analysis and train staff on a written AI policy before go-live.
This post does not give legal advice. Have your healthcare attorney review any BAA before you sign it.
To map your team's current ChatGPT use against OpenAI's list, book a strategy call with Aprendio.
