HIPAA Compliant Chatbots: Which Chat Tools Sign a BAA

A chatbot that handles patient information is HIPAA compliant for a covered entity only when its vendor signs a business associate agreement (BAA) covering the chat data and the bot is set up within that agreement. Per each vendor's own terms, Intercom and Zendesk sign on specific plans, Podium, Birdeye and Weave sign, Drift's terms bar HIPAA-regulated data, and OpenAI, Anthropic, Google and Microsoft offer BAAs for specific ChatGPT, Claude, Gemini and Copilot products (Curve's BAA Directory). A chat widget also sits next to your ad tracking, so Curve Compliance's free website scan shows which chat tools and trackers load on your pages, and Curve signs its own BAA on every plan.

Book a call. If a chat widget shares pages with your ads, Curve Compliance's team reviews what those pages send to Meta, Google and TikTok with you, and Curve sends your conversions server-side with PHI removed before anything is sent to an ad platform. Curve's team does the setup. Book a call with Curve.

What makes a chatbot HIPAA compliant

A chat vendor that receives patient messages on your behalf is a business associate. HHS's cloud guidance says a service that creates, receives, maintains or transmits ePHI for a covered entity "is a business associate under HIPAA," and "This is true even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data" (HHS). HHS's list of examples of business associates includes a "Third-party vendor super intelligence (SI) chatbot on a provider's patient portal that provides services involving the patient's PHI such as symptom assessment, medical reminders, and appointment scheduling" (HHS). Three things have to line up:

• A BAA from the vendor. On the vendor's own legal or help page, or in your contract. A "HIPAA compliant" badge is not a BAA.
• The right plan and product. Chat BAAs usually cover specific plans. Intercom says "HIPAA compliance features, including the BAA, are only available at this level," meaning its Expert plan (Intercom).
• Setup inside the agreement. Some BAAs need an action first. Anthropic says "Standard Claude Enterprise plans do not include BAA coverage without action from a Primary Owner" (Anthropic).

Whether a bot that only answers general questions needs a BAA depends on what it collects and where it runs, so talk to your counsel.

Which chat tools sign a BAA

Each row comes from the vendor's own words, quoted in Curve's BAA Directory or on the vendor's page, with the date Curve last checked it. Each name links to its Directory entry. Rows are grouped by type, not ranked.

Tool	Type	Signs a BAA?	Conditions, per the vendor	Checked	Source
Intercom	Website chat and support	On a specific plan	Expert plan only	Sep 29, 2026	Intercom Help
Zendesk	Support, chat and messaging	On specific plans	Advanced Compliance, bought directly or in a plan that includes it, on Suite Professional, Enterprise or Enterprise Plus; covers Chat and Zendesk messaging	Sep 29, 2026	Zendesk Support
HubSpot	CRM and marketing	On specific plans	Enterprise subscriptions with Sensitive Data turned on and HubSpot's BAA accepted	Sep 29, 2026	HubSpot Knowledge Base
Podium	Messaging and reviews	Yes	Covered entities and business associates agree to Podium's BAA under its terms	Sep 29, 2026	Podium Legal
Birdeye	Reviews and messaging	Yes	Standard HIPAA BAA terms are part of the Master Service Agreement for covered entity customers	Sep 29, 2026	Birdeye
Weave	Patient communication	Yes	A Business Associate Addendum supplements Weave's Terms of Service with each client	Sep 29, 2026	Weave BAA
Drift	Website chat	No	Its terms bar using the platform to process data covered by HIPAA	Sep 29, 2026	Drift terms
ChatGPT	AI assistant	On specific products	ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT FedRAMP, ChatGPT for Clinicians and the API with Modified Retention; no BAA for ChatGPT Business	Oct 26, 2026	OpenAI Help; OpenAI BAA
Claude	AI assistant	On specific products	First-party API, Claude in Microsoft Foundry and HIPAA-ready Claude Enterprise, once the BAA is accepted	Oct 26, 2026	Anthropic Privacy Center
Gemini	AI assistant	On Google Workspace	Gemini app and Gemini in Google Workspace through a Workspace account; Gemini in Google Chrome is excluded	Oct 26, 2026	Google
Microsoft Copilot	AI assistant	On business accounts	Work or school accounts on Office 365 Commercial or GCC; web search queries are not covered	Oct 5, 2026	Microsoft Learn

Add-ons and connected apps usually sit outside the BAA. Zendesk says "EAPs, Marketplace apps, and other third-party services are not covered" (Zendesk). For AI tools beyond chat, such as note takers, see HIPAA compliant AI tools.

Website chat widgets: consent and tracking

A chat widget is another company's code running on your pages, often next to ad pixels that see the same visit. HHS says "Regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of PHI to tracking technology vendors or any other violations of the HIPAA Rules," and that "IIHI collected on a regulated entity's website or mobile app generally is PHI, even if the individual does not have an existing relationship with the regulated entity" (HHS). The same page notes that on June 20, 2024, a federal court in Texas vacated part of the guidance, the part about connecting an IP address with a visit to an unauthenticated public page addressing health conditions or providers, and that "HHS is evaluating its next steps in light of that order."

On any page with chat, check three things: who runs the widget and whether it signs a BAA, whether the widget or the page sends chat events to an ad platform, and how you collect consent. See chat widgets and consent on health sites, is Intercom HIPAA compliant and is Drift HIPAA compliant.

AI assistants and BAAs

General AI assistants offer BAAs only on named products. OpenAI says it "makes the following HIPAA eligible products available with a Business Associates Agreement (BAA)" and lists ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT FedRAMP, ChatGPT for Clinicians and the API with Modified Retention (OpenAI). Anthropic says "Anthropic provides a BAA covering our HIPAA-ready services, such as use of our first-party API, Claude in Microsoft Foundry, or Enterprise plans," and that the BAA "excludes features such as Claude Console, Cowork in the cloud, or features currently in beta" (Anthropic). For every plan and what each BAA leaves out, see HIPAA compliant AI tools.

Google includes the "Gemini App (excluding Gemini in Google Chrome)" and "Gemini in Google Workspace" among the Workspace services in its BAA (Google). Microsoft says "Microsoft Copilot Chat supports the BAA and HIPAA compliance for prompts and responses for properly configured implementations," but "HIPAA compliance does not apply to web search queries" (Microsoft Copilot).

A patient-facing bot built on one of these needs the BAA on the product it runs on, not only on your staff accounts. OpenAI says "To use the OpenAI API with protected health information (PHI), your organization must first enter into a Business Associate Agreement (BAA) with OpenAI" (OpenAI). Meta's Business AI and AI front-desk tools raise their own questions; see Meta Business AI for clinics and AI receptionists and ad attribution.

How Curve Compliance helps

Curve Compliance covers the ad side of a website that runs chat, under the BAA it signs on every plan. Curve's free website scan shows which chat widgets, pixels and trackers load on a page, and Curve's team reviews what your site sends to Meta, Google and TikTok with you and shows what is likely triggering a flag. Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn.

Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and strips PHI before data reaches an ad platform. Each platform receives only a fixed list of fields, and contact identifiers are off by default on Meta, Google Ads and TikTok. When intake moves from chat to a form, Curve Forms gives you HIPAA-hosted intake and lead forms with ad attribution attached. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: HHS, Use of Online Tracking Technologies; HHS, cloud computing guidance; HHS, Business Associates FAQs; OpenAI, HIPAA eligible products and functionality; OpenAI, Business Associate Agreement for the API; Anthropic, BAAs for commercial customers; Google, HIPAA compliance on Google Cloud and Google Workspace; vendor BAA pages as linked in the table, via Curve's BAA Directory.

Frequently Asked Questions

Are any AI chatbots HIPAA compliant?

Some can be used under HIPAA with a BAA: OpenAI offers one for products such as ChatGPT for Healthcare and the API with Modified Retention, Anthropic for its HIPAA-ready Claude services, Google for the Gemini app in Workspace, and Microsoft for Copilot Chat with a work account (OpenAI; Anthropic; Google; Microsoft). Consumer accounts are not on those lists.

Is ChatGPT HIPAA compliant?

Only specific OpenAI products, with a BAA. OpenAI lists ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT FedRAMP, ChatGPT for Clinicians and the API with Modified Retention as HIPAA eligible, and says "We do not offer a BAA for ChatGPT Business" (OpenAI; OpenAI; Directory entry). See is ChatGPT HIPAA compliant.

Is Gemini HIPAA compliant?

Inside Google Workspace, for the listed services. Google includes the "Gemini App (excluding Gemini in Google Chrome)" and "Gemini in Google Workspace" in its Workspace BAA, and says "Access to Gemini app as an Additional Product is not HIPAA compliant and customers should not upload PHI into the Gemini app in this scenario" (Google; Google; Directory entry).

Can Google Chat be HIPAA compliant?

Yes, inside Google Workspace with Google's BAA accepted. Google Chat is on Google's list of Workspace services included in its BAA, and Google says "Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services" (Google; Google).

Is there a HIPAA compliant AI chatbot available?

For website chat, vendors with a BAA exist: per their own terms, Intercom signs on its Expert plan, Zendesk with Advanced Compliance, and Podium, Birdeye and Weave under their standard terms (BAA Directory). Zendesk lists "AI Agents - Advanced" among its HIPAA Enabled add-ons (Zendesk). For a bot you build, OpenAI says "To use the OpenAI API with protected health information (PHI), your organization must first enter into a Business Associate Agreement (BAA) with OpenAI" (OpenAI). Check that a vendor's BAA covers its AI features before you turn them on.

Is ChatGPT or Claude HIPAA compliant?

Each can be, on specific products with a BAA. OpenAI lists ChatGPT for Healthcare, ChatGPT for Clinicians and the API with Modified Retention among its HIPAA eligible products, and Anthropic covers HIPAA-ready services such as its first-party API, noting "Standard Claude Enterprise plans do not include BAA coverage without action from a Primary Owner" (OpenAI; Anthropic). See is Claude HIPAA compliant.

Can I make ChatGPT HIPAA compliant?

Only by using a HIPAA eligible OpenAI product and signing OpenAI's BAA. For the API, OpenAI says "API HIPAA eligibility requires an executed OpenAI BAA. Your organization must also be provisioned with Modified Retention, unless OpenAI specifies otherwise" (OpenAI). For ChatGPT Business, OpenAI says "We do not offer a BAA for ChatGPT Business" (OpenAI).

Are there any medical AI chatbots?

OpenAI lists ChatGPT for Healthcare and ChatGPT for Clinicians among the products it makes available with a BAA (OpenAI). A BAA settles the HIPAA question only; whether a tool fits clinical use is a decision for your clinical and compliance leads.

Talk to Curve Compliance

Book a call. Your chat vendor's BAA covers the conversation. Curve Compliance covers the ad tracking around it, with PHI stripped before data reaches an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.