Skip to main content
BAA Directory

Does Claude sign a BAA?

The answer

Signs a BAA on specific plans

Yes, for Anthropic's HIPAA-ready services, such as its first-party API and Claude Enterprise plans, once the BAA is accepted.

AI assistants. Checked on the vendor's own pages on .

On this page

What Anthropic says

“Anthropic provides a BAA covering our HIPAA-ready services, such as use of our first-party API or Enterprise plans.”

Source: Anthropic Privacy Center, Business Associate Agreements (BAA) for Commercial Customers, checked .

“Standard Claude Enterprise plans do not include BAA coverage without action from a Primary Owner.”

Source: Anthropic Privacy Center, Business Associate Agreements (BAA) for Commercial Customers, checked .

What the BAA covers and excludes

Excludes or limits, in Anthropic's words:

  • "For clarity, the BAA only covers the single organization that accepted it, and excludes features such as Claude Console, Claude Cowork, or features currently in beta such as Claude in Office, Claude Design, Claude Slides, and Claude Docs."

What this means for ad tracking

Marketing teams use Claude to analyze campaign exports, call notes and lead lists. Whatever is pasted in or sent through the API is shared with Anthropic.

Outside the products Anthropic names, keep patient details out of Claude. Campaign and conversion data that carries no health information is the safer input either way.

Curve Compliance gives your team conversion data to work from that has been checked for PHI-like patterns and sent server-side under a BAA Curve signs on every plan. Book a call to see it on your own funnel.

How Curve helps

  • Curve gives you conversion data that is already stripped of PHI-like patterns, so the numbers you analyze are not patient records.
  • Server-side conversion tracking in place of pixels: conversions reach your ad platforms from Curve's server, not from the patient's browser.
  • PHI-like pattern detection checks every event before it goes out, and neutral event names keep conditions and treatments out of what the platforms see.
  • Identifiers are hashed with SHA-256 to each platform's requirements.
  • Consent management for your site, alongside the tracking.
  • A HIPAA-compliant setup done by Curve's team, in about a week, with a BAA signed on every plan.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Read the full guide

For the full picture on Claude and patient data, read Is Claude HIPAA Compliant? What a Bedrock BAA Covers.

Frequently asked questions

Does Claude sign a BAA?

Yes, for Anthropic's HIPAA-ready services, such as its first-party API and Claude Enterprise plans, once the BAA is accepted. In Anthropic's words: “Standard Claude Enterprise plans do not include BAA coverage without action from a Primary Owner.” We checked Anthropic's own pages on September 29, 2026.

Which Claude plans include a BAA?

Anthropic's BAA covers its HIPAA-ready services, such as the first-party API and Claude Enterprise plans. On Enterprise, the Primary Owner activates HIPAA compliance and accepts the BAA; for the API, the Primary Owner signs and then contacts Anthropic to turn it on.

Should I paste patient data into Claude to analyze campaigns?

Only under a BAA that covers the Anthropic product you use. Otherwise, work from conversion data without health information. Curve checks every conversion event for PHI-like patterns before it goes to your ad platforms.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Anthropic before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call