HIPAA Compliant AI Tools: Which Ones Sign a BAA in 2026

The HIPAA compliant AI tools that sign a BAA in 2026 are named plans from OpenAI, Anthropic, Google, Microsoft and AWS, and Curve Compliance, which signs a BAA on every plan, lets you ask AI about your ad results through Curve Analyst and Curve MCP. They include ChatGPT for Healthcare and ChatGPT for Clinicians, Claude Enterprise and the Claude API, Gemini in Google Workspace, Microsoft Copilot Chat and Amazon Bedrock. Each BAA covers only the products and features its vendor lists. This guide quotes each vendor's own page, as checked on October 10, 2026.

Book a call. Curve Compliance signs a BAA on every plan. Curve Analyst answers questions about your traffic, funnels and ad spend from your own account data, and Curve MCP brings aggregate campaign results into Claude, ChatGPT or any MCP client. Curve's team does the setup, and most customers are live in about a week. Book a call with Curve.

HIPAA compliant AI tools compared

Tool	BAA covers	Watch for	Source
ChatGPT	ChatGPT for Healthcare, Enterprise with Regulated Workspace, FedRAMP, Clinicians	Improved memory, Codex in the cloud; no BAA for ChatGPT Business	OpenAI, BAA article
OpenAI API	API with Modified Retention	Needs an executed BAA and Modified Retention	OpenAI
Claude	Enterprise with HIPAA activated, first-party API, Claude in Microsoft Foundry	Claude Console, Cowork in the cloud, beta features, connectors	Anthropic
Claude Code and Cowork	Local mode with the HIPAA configuration applied	IDE extensions, cloud sessions, Bedrock or gateway access	Anthropic
Gemini	With Google Workspace: Gemini in Google Workspace, Gemini App, Gemini Mac App	Gemini in Chrome, Gemini Notebook	Google
Google Cloud AI	Gemini Enterprise, Gemini Enterprise Agent Platform, Gemini Notebook Enterprise	Products not on Google's BAA list	Google
Microsoft Copilot	Copilot and Copilot Chat prompts and responses, signed in with a work (Entra) account	Web search queries	Microsoft
AWS	Amazon Bedrock, Amazon Q Business, Transcribe with HealthScribe	Services not on the AWS list	AWS
Otter.ai	Enterprise plan	Public link sharing must be off	Otter.ai
Curve Compliance	Every plan, including Curve Analyst	Curve MCP sends your AI client aggregate results only	Curve

The BAA Directory has single-tool entries for Gemini, Microsoft Copilot and Otter.ai. For ChatGPT and Claude, go straight to OpenAI's HIPAA eligible products page and Anthropic's BAA page.

What a BAA does, and what it does not do

Under HIPAA, a covered entity may let a vendor handle PHI on its behalf only if it "obtains satisfactory assurance that the business associate will appropriately safeguard the information." That assurance "must be documented through a written contract or other written agreement" (45 CFR 164.502(e)). For an AI tool, that contract is the BAA. The vendors add three limits:

• Per feature. OpenAI: "A feature's availability does not, by itself, determine whether a particular use or connected third-party service is covered by your BAA" (OpenAI).
• Per organization, switched on. Anthropic: "Standard Claude Enterprise plans do not include BAA coverage without action from a Primary Owner" (Anthropic).
• Not compliance on its own. Microsoft: "using Microsoft services doesn't on its own achieve HIPAA compliance" (Microsoft).

OpenAI: ChatGPT for Healthcare, Clinicians, Enterprise and the API

Is ChatGPT HIPAA compliant? Only in the products OpenAI names. OpenAI "makes the following HIPAA eligible products available with a Business Associates Agreement (BAA)": ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT FedRAMP, ChatGPT for Clinicians, API with Modified Retention, and API FedRAMP with Modified Retention (OpenAI, HIPAA eligible products). OpenAI's BAA article adds: "We do not offer a BAA for ChatGPT Business" (OpenAI, BAA article).

ChatGPT for Clinicians is for verified US physicians, nurse practitioners, physician assistants and pharmacists. OpenAI says it "is designed for individual use, including the ability to sign a Business Associate Agreement (BAA)." For several staff, OpenAI points to ChatGPT for Healthcare (OpenAI, ChatGPT for Clinicians).

Inside an eligible workspace, coverage depends on the feature. OpenAI's not-covered list includes "Use improved memory," "Allow event-triggered scheduled tasks" and "Use Codex in the cloud," and it says "PHI should not be entered when using this functionality." For the API, "API HIPAA eligibility requires an executed OpenAI BAA. Your organization must also be provisioned with Modified Retention, unless OpenAI specifies otherwise" (OpenAI). See also Is ChatGPT HIPAA compliant? A marketing data verdict.

Anthropic: Claude Enterprise, the API, Claude Code and Cowork

Is Claude HIPAA compliant? Anthropic says it "provides a BAA covering our HIPAA-ready services, such as use of our first-party API, Claude in Microsoft Foundry, or Enterprise plans." On Enterprise, the Primary Owner must "activate HIPAA compliance" in the organization settings and accept the BAA. Covered features include Chat, Projects, Artifacts, Voice, Web Search and Research (Anthropic, BAA for commercial customers).

Claude Code and Cowork are covered in local mode after a second step: "the Primary Owner must also apply the HIPAA configuration to both products." Claude Code in the terminal is covered "when members sign in with their Claude Enterprise account and Claude Code connects directly to Anthropic, not through a cloud provider or gateway." The IDE extensions are not covered (Anthropic).

The BAA "excludes features such as Claude Console, Cowork in the cloud, or features currently in beta such as Claude in Office, Claude Design, Claude Slides, and Claude Docs." For connectors and MCP servers, "Your BAA doesn't cover any of them, even after an Owner turns them on," and "Covered Models require 30-day data retention" (Anthropic). The life sciences program is out too: "As a beta, LSVP is not available for BAA-enabled orgs" (Anthropic). For the Bedrock route, see Is Claude HIPAA compliant? BAA options explained.

Google Gemini

Google's answer is "Gemini can support HIPAA workloads," in a privacy hub that applies when Gemini is used "with a qualifying edition of Google Workspace" (Google, Gemini privacy hub). The Google Workspace services in Google's BAA include "Gemini App (excluding Gemini in Google Chrome)," "Gemini in Google Workspace" and "Gemini Mac App" (Google, HIPAA compliance). Two Gemini products are out: Google says both Gemini Notebook and Gemini in Chrome are "not covered by the Google Business Associate Agreement (BAA) for HIPAA compliance" (Google).

A Workspace super administrator accepts the BAA in the Admin console (Google, privacy compliance and records). On Google Cloud, the BAA product list includes "Gemini Enterprise," "Gemini Enterprise Agent Platform," "Gemini Notebook Enterprise," "Generative AI on Agent Platform" and "Vertex AI Workbench instances" (Google Cloud).

Microsoft Copilot and Azure

Microsoft says "Microsoft Copilot Chat supports the BAA and HIPAA compliance for prompts and responses for properly configured implementations. HIPAA compliance does not apply to web search queries as they are not covered by the DPA and BAA" (Microsoft, Copilot Chat FAQ). It lists "Microsoft Copilot, Microsoft Copilot Chat" as in-scope services for Office 365 Commercial and GCC (Microsoft, HIPAA and HITECH). Those are the work versions, which Microsoft says "are for work and education" and are used "after signing in with their Entra account"; a separate "Microsoft Copilot is for personal use" with a personal account (Microsoft, Copilot Chat FAQ). Note the rename: "Microsoft 365 Copilot is now named Microsoft Copilot" (Microsoft).

For Azure, "There is no separate contract to sign," because the BAA "is available via the Microsoft Product Terms (formerly Online Services Terms) by default to all customers who are covered entities or business associates under HIPAA" (Microsoft, Azure HIPAA). Microsoft lists covered Azure services on its audit scope page, so check the AI service you plan to use there.

Amazon Bedrock and other AWS AI services

AWS lists "Amazon Bedrock," "Amazon Bedrock AgentCore," "Amazon Q Business," "Amazon Comprehend Medical" and "AWS Transcribe [Includes Healthscribe]" among its HIPAA eligible services. AWS says "Customers still must configure these services consistent with HIPAA requirements," and covered entities and business associates agree not to use them with PHI "without first entering into an AWS business associate agreement" (AWS, HIPAA eligible services).

AI scribes and meeting note takers

An AI scribe hears patient details by design, so it needs a BAA like any other vendor. OpenAI lists "Use ChatGPT Record" as covered in eligible workspaces (OpenAI). AWS lists Transcribe with HealthScribe as eligible (AWS). For meeting notes, Otter says "HIPAA compliance is only available for the Enterprise plan," and "Customers must explicitly disable these features to avoid unauthorized disclosures," meaning public and link-based sharing (Otter.ai, HIPAA).

Features each BAA leaves out

• Web search. Not covered in Microsoft Copilot Chat (Microsoft).
• Connectors and MCP servers. Not covered by Anthropic's BAA (Anthropic). OpenAI lists connector use as covered in eligible workspaces, but says a feature's availability does not decide "whether a particular use or connected third-party service is covered by your BAA" (OpenAI).
• Memory and cloud agents. OpenAI excludes improved memory and Codex in the cloud (OpenAI); Anthropic excludes Cowork in the cloud (Anthropic).
• Browser assistants and betas. Gemini in Chrome is not covered (Google), and Anthropic excludes features "currently in beta" (Anthropic).

Using AI on ad results without PHI

Most marketing questions need totals, not patient data. The risk sits in exports. A lead list or funnel export can hold identifiers that HIPAA's de-identification rule lists, among them "Names," "Telephone numbers," "Electronic mail addresses," "Web Universal Resource Locators (URLs)" and "Internet Protocol (IP) address numbers" (45 CFR 164.514(b)(2)). Paste that file into an AI tool and the identifiers go to the vendor. See why you cannot paste a patient funnel into ChatGPT.

Curve Compliance is built so marketers can ask AI about results without that export. Curve Analyst is the AI chat inside Curve: ask about traffic, goals, funnels or ad spend, and it answers from your own account data. Curve's launch post says Analyst "runs on Claude through Amazon Bedrock, inside infrastructure covered by our Business Associate Agreement with AWS," and Curve signs a BAA with every customer, on every plan.

Curve MCP connects Claude, ChatGPT, Cursor and other MCP clients to your campaign and conversion results. Its answers are aggregate and checked before they leave Curve: counts of people under 11 show as "<11," other counts are rounded to the nearest 5, and names, emails, phone numbers and page addresses stay in Curve. Every request is recorded with what was returned. See Curve MCP and Curve Analyst: when to use which.

The numbers underneath come from Curve's tracking. Curve sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, each platform receives a fixed list of fields, and Curve detects PHI-like patterns before data reaches an ad platform. Start with a free website scan, or read 9 things to require from HIPAA compliant AI analytics.

Vendors update these pages often. Confirm the BAA and the covered features for your plan before any PHI goes in, and talk to your counsel about your own HIPAA obligations.

Sources, checked October 10, 2026: OpenAI, HIPAA eligible products and functionality; OpenAI, BAA for the API; OpenAI, ChatGPT for Clinicians; Anthropic, BAA for commercial customers; Anthropic, Life Sciences Verification Program; Google, Generative AI in Google Workspace privacy hub; Google, HIPAA compliance on Google Cloud and Google Workspace; Google, privacy compliance and records; Microsoft, Copilot Chat FAQ; Microsoft, enterprise data protection; Microsoft, HIPAA and HITECH; Microsoft, Azure HIPAA; AWS, HIPAA eligible services; Otter.ai, HIPAA; 45 CFR 164.502; 45 CFR 164.514; and the Curve Compliance BAA Directory.

Frequently Asked Questions

Is ChatGPT HIPAA compliant?

Only in the products OpenAI lists with a BAA, such as ChatGPT for Healthcare, ChatGPT for Clinicians and the API with Modified Retention. OpenAI says "We do not offer a BAA for ChatGPT Business" (OpenAI).

Does ChatGPT for Clinicians include a BAA?

Yes. OpenAI says eligible individual clinicians can sign one "in ChatGPT under Settings > Agreements." For several users, OpenAI points to ChatGPT for Healthcare (OpenAI).

Is Claude HIPAA compliant?

Anthropic offers a BAA for its first-party API, Claude in Microsoft Foundry and Enterprise plans. On Enterprise, the Primary Owner activates HIPAA compliance and accepts the BAA; for the API, the Primary Owner signs a BAA and then contacts Anthropic to turn it on. Claude Console, Cowork in the cloud and beta features are excluded (Anthropic).

Is Claude Code covered by Anthropic's BAA?

Yes, in local mode on a HIPAA-ready Enterprise plan with the HIPAA configuration applied, signed in with the Enterprise account and connected directly to Anthropic. The IDE extensions and access through Bedrock or a gateway are not covered (Anthropic).

Is Gemini covered by Google's BAA?

With a qualifying Google Workspace edition, Gemini in Google Workspace, the Gemini App (excluding Gemini in Google Chrome) and the Gemini Mac App are on the Workspace services list in Google's BAA (Google). Gemini Notebook and Gemini in Chrome are not (Google).

Does Copilot's BAA cover web searches?

No. Microsoft says "HIPAA compliance does not apply to web search queries as they are not covered by the DPA and BAA" (Microsoft).

Can I paste ad reports with patient data into an AI tool?

Only into a product and feature covered by that vendor's BAA, and only if your policy allows it. Safer still, ask with aggregate numbers. Curve Analyst answers from your Curve data, and Curve MCP gives your AI client aggregate results while names and contact details stay in Curve.

Are AI scribes HIPAA compliant?

Only with a BAA. AWS lists Transcribe with HealthScribe as HIPAA eligible (AWS), OpenAI covers ChatGPT Record in eligible workspaces (OpenAI), and Otter offers HIPAA compliance on its Enterprise plan (Otter.ai).

Talk to Curve Compliance

Book a call. Want AI answers about your ad results without sending patient data to a chat tool? Curve's team sets up your tracking and switches on Curve MCP for your organization, Curve Analyst works inside Curve, and Curve signs a BAA on every plan. Most customers are live in about a week. Book a call with Curve.