Skip to main content
BAA Directory

Does ChatGPT sign a BAA?

The answer

Signs a BAA on specific plans

Yes, for the OpenAI API and for sales-managed ChatGPT Enterprise or Edu accounts. OpenAI does not offer a BAA for ChatGPT Business.

AI assistants. Checked on the vendor's own pages on .

Using ChatGPT on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What OpenAI says

“To use our API platform with PHI, you'll first need a BAA with OpenAI.”

Source: OpenAI Help Center, How can I get a BAA with OpenAI for the API Services?, checked .

“Only ChatGPT Enterprise or Edu customers that have a sales-managed account are eligible for a BAA for ChatGPT at this time. Please note that we don't offer a BAA for ChatGPT Business.”

Source: OpenAI Help Center, How can I get a BAA with OpenAI for the API Services?, checked .

What the BAA covers and excludes

Excludes or limits, in OpenAI's words:

  • "Web Search with live internet access is not HIPAA eligible and is not covered by a BAA." (OpenAI API docs, Your data)
  • "We review each BAA request on a case-by-case basis and may need additional information."

What this means for ad tracking

Marketing teams use ChatGPT to analyze campaign exports, call notes and lead lists. Whatever is pasted in or sent through the API is shared with OpenAI.

Outside the products OpenAI names, keep patient details out of ChatGPT. Campaign and conversion data that carries no health information is the safer input either way.

Curve Compliance gives your team conversion data to work from that has been checked for PHI-like patterns and sent server-side under a BAA Curve signs on every plan. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve gives you conversion data that is already stripped of PHI-like patterns, so the numbers you analyze are not patient records.
  • Curve tracks conversions server-side in place of pixels, so they reach your ad platforms from Curve's server, not from the patient's browser.
  • Curve checks every event for PHI-like patterns before it goes out, and its neutral event names keep conditions and treatments out of what the platforms see.
  • Curve hashes identifiers with SHA-256 to each platform's requirements.
  • Curve adds consent management to your site, alongside the tracking.
  • Curve signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup for you in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Read the full guide

For the full picture on ChatGPT and patient data, read Is ChatGPT HIPAA Compliant? A Marketing Data Verdict.

Frequently asked questions

Is ChatGPT HIPAA compliant?

Yes, for the OpenAI API and for sales-managed ChatGPT Enterprise or Edu accounts. OpenAI does not offer a BAA for ChatGPT Business. With a signed BAA, ChatGPT can handle patient information for you, set up the way the vendor describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.

Does ChatGPT sign a BAA?

Yes, for the OpenAI API and for sales-managed ChatGPT Enterprise or Edu accounts. OpenAI does not offer a BAA for ChatGPT Business. In OpenAI's words: “To use our API platform with PHI, you'll first need a BAA with OpenAI.” We checked OpenAI's own pages on September 29, 2026.

Which ChatGPT plans include a BAA?

OpenAI signs BAAs for its API, where an enterprise agreement is not required, and for ChatGPT Enterprise or Edu customers with a sales-managed account. It does not offer a BAA for ChatGPT Business.

Should I paste patient data into ChatGPT to analyze campaigns?

Only under a BAA that covers the OpenAI product you use. Otherwise, work from conversion data without health information. Curve checks every conversion event for PHI-like patterns before it goes to your ad platforms.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with OpenAI before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call