Skip to main content
BAA Directory

Does ChatGPT sign a BAA?

The answer

Signs a BAA on specific plans

Yes, for the OpenAI API and for sales-managed ChatGPT Enterprise or Edu accounts. OpenAI does not offer a BAA for ChatGPT Business.

AI assistants. Checked on the vendor's own pages on .

On this page

What OpenAI says

“To use our API platform with PHI, you'll first need a BAA with OpenAI.”

Source: OpenAI Help Center, How can I get a BAA with OpenAI for the API Services?, checked .

“Only ChatGPT Enterprise or Edu customers that have a sales-managed account are eligible for a BAA for ChatGPT at this time. Please note that we don't offer a BAA for ChatGPT Business.”

Source: OpenAI Help Center, How can I get a BAA with OpenAI for the API Services?, checked .

What the BAA covers and excludes

Excludes or limits, in OpenAI's words:

  • "Web Search with live internet access is not HIPAA eligible and is not covered by a BAA." (OpenAI API docs, Your data)
  • "We review each BAA request on a case-by-case basis and may need additional information."

What this means for ad tracking

Marketing teams use ChatGPT to analyze campaign exports, call notes and lead lists. Whatever is pasted in or sent through the API is shared with OpenAI.

Outside the products OpenAI names, keep patient details out of ChatGPT. Campaign and conversion data that carries no health information is the safer input either way.

Curve Compliance gives your team conversion data to work from that has been checked for PHI-like patterns and sent server-side under a BAA Curve signs on every plan. Book a call to see it on your own funnel.

How Curve helps

  • Curve gives you conversion data that is already stripped of PHI-like patterns, so the numbers you analyze are not patient records.
  • Server-side conversion tracking in place of pixels: conversions reach your ad platforms from Curve's server, not from the patient's browser.
  • PHI-like pattern detection checks every event before it goes out, and neutral event names keep conditions and treatments out of what the platforms see.
  • Identifiers are hashed with SHA-256 to each platform's requirements.
  • Consent management for your site, alongside the tracking.
  • A HIPAA-compliant setup done by Curve's team, in about a week, with a BAA signed on every plan.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Read the full guide

For the full picture on ChatGPT and patient data, read Is ChatGPT HIPAA Compliant? A Marketing Data Verdict.

Frequently asked questions

Does ChatGPT sign a BAA?

Yes, for the OpenAI API and for sales-managed ChatGPT Enterprise or Edu accounts. OpenAI does not offer a BAA for ChatGPT Business. In OpenAI's words: “To use our API platform with PHI, you'll first need a BAA with OpenAI.” We checked OpenAI's own pages on September 29, 2026.

Which ChatGPT plans include a BAA?

OpenAI signs BAAs for its API, where an enterprise agreement is not required, and for ChatGPT Enterprise or Edu customers with a sales-managed account. It does not offer a BAA for ChatGPT Business.

Should I paste patient data into ChatGPT to analyze campaigns?

Only under a BAA that covers the OpenAI product you use. Otherwise, work from conversion data without health information. Curve checks every conversion event for PHI-like patterns before it goes to your ad platforms.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with OpenAI before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call