Skip to main content
BAA Directory

Does ChatGPT sign a BAA?

The answer

Signs a BAA on specific plans

Yes, for the products OpenAI lists as HIPAA eligible, such as ChatGPT for Healthcare, ChatGPT for Clinicians and the API with Modified Retention. OpenAI does not offer a BAA for ChatGPT Business.

AI assistants. Checked on the vendor's own pages on .

Using ChatGPT on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What OpenAI says

“To use the OpenAI API with protected health information (PHI), your organization must first enter into a Business Associate Agreement (BAA) with OpenAI.”

Source: OpenAI Help Center, Getting a Business Associate Agreement for the OpenAI API, checked .

“For a BAA for a sales-managed ChatGPT Enterprise or Edu account, contact sales. We do not offer a BAA for ChatGPT Business.”

Source: OpenAI Help Center, Getting a Business Associate Agreement for the OpenAI API, checked .

“API HIPAA eligibility requires an executed OpenAI BAA. Your organization must also be provisioned with Modified Retention, unless OpenAI specifies otherwise.”

Source: OpenAI Help Center, HIPAA eligible products and functionality, checked .

What the BAA covers and excludes

Covers, in OpenAI's words:

  • OpenAI "makes the following HIPAA eligible products available with a Business Associates Agreement (BAA)": ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT FedRAMP, ChatGPT for Clinicians, API with Modified Retention, and API FedRAMP with Modified Retention (OpenAI)

Excludes or limits, in OpenAI's words:

  • "Web Search with live internet access is not HIPAA eligible and is not covered by a BAA." (OpenAI API docs, Your data)
  • OpenAI's list of ChatGPT functionality not covered under the BAA includes "Use improved memory" and "Use Codex in the cloud", and it says "PHI should not be entered when using this functionality." (OpenAI)

What this means for ad tracking

Marketing teams use ChatGPT to analyze campaign exports, call notes and lead lists. Whatever is pasted in or sent through the API is shared with OpenAI.

Outside the products OpenAI names, keep patient details out of ChatGPT. Campaign and conversion data that carries no health information is the safer input either way.

Curve Compliance gives your team conversion data to work from that has been checked for PHI-like patterns and sent server-side under a BAA Curve signs on every plan. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve gives you conversion data that is already stripped of PHI-like patterns, so the numbers you analyze are not patient records.
  • Curve tracks conversions server-side in place of pixels, so they reach your ad platforms from Curve's server, not from the patient's browser.
  • Curve checks every event for PHI-like patterns before it goes out, and its neutral event names keep conditions and treatments out of what the platforms see.
  • Curve hashes identifiers with SHA-256 to each platform's requirements.
  • Curve adds consent management to your site, alongside the tracking.
  • Curve signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup for you in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Read the full guide

For the full picture on ChatGPT and patient data, read Is ChatGPT HIPAA Compliant? A Marketing Data Verdict.

Frequently asked questions

Is ChatGPT HIPAA compliant?

Yes, for the products OpenAI lists as HIPAA eligible, such as ChatGPT for Healthcare, ChatGPT for Clinicians and the API with Modified Retention. OpenAI does not offer a BAA for ChatGPT Business. With a signed BAA, ChatGPT can handle patient information for you, set up the way the vendor describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.

Does ChatGPT sign a BAA?

Yes, for the products OpenAI lists as HIPAA eligible, such as ChatGPT for Healthcare, ChatGPT for Clinicians and the API with Modified Retention. OpenAI does not offer a BAA for ChatGPT Business. In OpenAI's words: “To use the OpenAI API with protected health information (PHI), your organization must first enter into a Business Associate Agreement (BAA) with OpenAI.” We checked OpenAI's own pages on October 11, 2026.

Which ChatGPT plans include a BAA?

OpenAI lists six HIPAA eligible products with a BAA: ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT FedRAMP, ChatGPT for Clinicians, API with Modified Retention and API FedRAMP with Modified Retention. For the API, an enterprise agreement is not required, and the organization must also be provisioned with Modified Retention unless OpenAI specifies otherwise. For a sales-managed ChatGPT Enterprise or Edu account, OpenAI says to contact sales. It does not offer a BAA for ChatGPT Business.

Should I paste patient data into ChatGPT to analyze campaigns?

Only under a BAA that covers the OpenAI product you use. Otherwise, work from conversion data without health information. Curve checks every conversion event for PHI-like patterns before it goes to your ad platforms.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with OpenAI before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call