HIPAA compliant AI chatbots: which companies sign a BAA, and for which plans

The Morse teamPublished November 9, 20269 min read

No AI chatbot is HIPAA compliant on its own, because HIPAA compliance describes how an organization handles patient information, not a product. As of November 2026, OpenAI, Anthropic, Google, Microsoft, and Amazon will sign a business associate agreement (BAA) for some business products, set up a certain way, and none of them signs one for the consumer ChatGPT, Claude, Gemini, or Copilot plans most people use.

This isn't legal advice. We read each company's own BAA, HIPAA, or terms page on November 9, 2026, along with the US Department of Health and Human Services (HHS) guidance on business associates and on cloud computing, and built the table below from them. OpenAI and Anthropic deserve credit. Both publish feature-by-feature lists of what their BAAs cover and what they don't, which is more than most software vendors put in public.

Is there such a thing as a HIPAA compliant AI chatbot?

Not as a label you can buy. Microsoft's HIPAA page says "there's currently no certification standard that the Department of Health and Human Services approves to demonstrate compliance with HIPAA" (Microsoft). What HIPAA asks is narrower. A covered entity, such as a clinic or a health plan, may share protected health information (PHI) with a vendor only if it "obtains satisfactory assurances, in the form of a contract" (HHS). That contract is the BAA.

Perplexity's enterprise page says "Perplexity is also GDPR and HIPAA compliant" (Perplexity). Its Enterprise Terms, last updated August 3, 2026, add that a customer may not use the service to process "Protected Health Information" unless "Customer and Perplexity have executed a Business Associate Agreement" (Perplexity). A team that reads only the marketing page and pastes patient notes into Perplexity Enterprise has no BAA.

A signed BAA is where compliance starts. OpenAI says accepting its BAA does "not, by themselves, make your application HIPAA compliant" (OpenAI), and Microsoft says "using Microsoft services doesn't on its own achieve HIPAA compliance" (Microsoft). So the table below answers three things for each company: whether it signs, for which products, and what the BAA leaves out.

Which AI chatbots will sign a BAA?

Five of the ten companies we checked publish a BAA for named AI products, two sign one only by separate arrangement, and three publish none. Each cell links to the company's own page, read November 9, 2026.

Top results for this search often name the plan without its setting. Medcurity's 2026 buyer's guide says "OpenAI signs BAAs for the OpenAI API and ChatGPT Enterprise" (Medcurity). The companies' own pages are stricter. OpenAI's list names "ChatGPT for Enterprise with Regulated Workspace," not Enterprise itself, and Anthropic says "Standard Claude Enterprise plans do not include BAA coverage without action from a Primary Owner." A practice that bought the plan a guide named can still be outside the BAA.

Is ChatGPT HIPAA compliant?

Only in the four ChatGPT products and the API route OpenAI lists, under a signed BAA. ChatGPT Free, Plus, Pro, and Business aren't on that list (OpenAI), and the consumer Health feature "does not offer a Business Associate Agreement," which we cover in is ChatGPT Health HIPAA compliant.

The one route for an individual is ChatGPT for Clinicians, a free workspace with its own BAA for verified US clinicians, whose eligibility list we cover in can pharmacists use ChatGPT (OpenAI). Registered nurses aren't on the list, as our page on whether nurses can use ChatGPT explains.

Inside a covered workspace, OpenAI lists what the BAA covers feature by feature. Web search stays in-house, since OpenAI "does not send queries to third-party search providers (e.g., Bing) when using a HIPAA eligible workspace." Improved memory is off by default, and an admin who turns it on is told to pass on a warning: "This feature is not covered under your BAA. PHI should not be entered when using this feature." OpenAI adds that "recently added functionality may not yet be listed on this page" (OpenAI).

For developers, the API BAA is now self-serve, under Settings > Organization > General in the API Platform, but "self-serve enrollment requires an established history of API usage" (OpenAI). Definite's guide, among the top results, still says OpenAI's BAA covers the "Zero Retention API" and that "standard API usage is not covered" (Definite). OpenAI's own page calls the requirement "Modified Retention," and once a BAA and Modified Retention are in place, the listed endpoints can process PHI "even if data is retained" (OpenAI).

Is Claude HIPAA compliant?

Only in a HIPAA-enabled Claude Enterprise organization, the first-party API, or Claude in Microsoft Foundry. Anthropic's page sends Claude Free, Pro, Max, and Ultra to a separate consumer collection, and says "the BAA only covers the single organization that accepted it" (Anthropic).

Within Enterprise, chat, projects and artifacts in chat, voice, web search, and Research are covered. Skills are "available to use but not covered," and sending data to outside services through connectors or Claude in Chrome "isn't covered under Anthropic's BAA." Anthropic covers Claude Code in the terminal and Cowork in Claude Desktop once the Primary Owner applies a HIPAA configuration, while Claude Code reached through Amazon Bedrock, Google Cloud, or Microsoft Foundry is "not covered" under Anthropic's BAA. On the API, the Batch API, Files API, Code Execution, and Web Fetch are "not accessible for HIPAA-Ready API users."

Is Gemini HIPAA compliant?

In a Google Workspace account whose administrator accepted Google's BAA, yes for the Gemini app, with one exception. Google's list of Workspace services under its BAA, updated October 28, 2026, includes "Gemini App (excluding Gemini in Google Chrome)," Gemini in Google Workspace, and the Gemini Mac app (Google Cloud). Google says "Third-party applications including add-ons are not included" and that customers without a BAA "must not use PHI in Google Workspace or Cloud Identity services" (Google Workspace).

A personal Google account is another matter. No administrator accepts a BAA for it, and Google's reviewers may read its chats, as we lay out in do Claude and Gemini treat health chats differently. Developers have one more line to read. The Gemini API's terms say "You may not use the Services in clinical practice, to provide medical advice," and tell users of the unpaid tier, "Do not submit sensitive, confidential, or personal information" (Google).

What does a BAA have to say?

HHS lists ten things a business associate contract must do, in its guidance published in 2013 (HHS). Among them, it must:

• set out what the vendor may and must do with PHI, and forbid any other use or disclosure unless the law requires it
• require safeguards that meet the HIPAA Security Rule for electronic PHI
• make the vendor tell the clinic about any use outside the contract, breaches included
• bind any subcontractor that touches PHI to "the same restrictions and conditions"
• open the vendor's records to HHS, and return or destroy the PHI when the contract ends, "if feasible"

A consumer chatbot's terms of use make none of these promises to a clinic. That's why the BAA has to be a separate contract, signed by someone who can sign for the organization.

Does zero retention or encryption make a chatbot safe for PHI?

No, not without a BAA. HHS says a cloud provider that stores or processes electronic PHI for a covered entity is a business associate, and "this is true even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data" (HHS). The exception for pure carriers, like the postal service, covers only transmission "including any temporary storage," and HHS adds that entities that access PHI "on a regular or frequent basis to perform a service" are not conduits (HHS). A chatbot reads every message to answer it, so a short retention period or strong encryption doesn't remove the need for the contract.

How to keep your own health questions and de-identified work private with Morse

A BAA exists because an AI company receives and processes what you send it, so a contract has to say what it may do with it. Without one, the company's own terms decide what happens to the copy on its servers. Morse is built so your chat history isn't on its servers in the first place.

Morse doesn't claim HIPAA compliance or any certification, so identifiable patient information belongs in the product your organization has a BAA for. Morse is for everything else: questions about your own health, which HIPAA generally doesn't reach, and drafts with every identifier removed.

• E2EE, for your own diagnosis, lab results, or prescriptions. Your browser checks the secure enclave's hardware attestation, then encrypts the message on your device so only that enclave can read it. Morse's servers relay ciphertext they can't read, and the reply is decrypted only in your browser. Third-party providers run the enclaves, not Morse, and the protection depends on the enclave hardware and attestation working as designed. E2EE runs open-weight models, without web search or image generation.
• Private, for de-identified drafts and study questions. A policy outline, a patient-education handout, or a pharmacology question with no patient in it goes to open-weight models like DeepSeek, Kimi, and GLM, or to xAI's Grok. Morse has zero data retention agreements with its inference, search, and other providers, so they keep nothing. Private is the default for a new chat.
• Anonymous, to ask GPT, Claude, or Gemini without the provider knowing it's you. Our proxy strips your account, email, and IP address and sends the message under Morse's own account. The provider still reads the message and may keep it for a limited time to check for abuse, under its own policy, so leave out names, dates, and record numbers.

In every mode, your chat history is stored in your browser, encrypted, not on Morse's servers, and unlocking it takes a key that never leaves your device plus one our server gives you at sign-in. Morse doesn't train AI on your chats, sell your data, or show ads, and a file you attach is sent with the message and never stored by Morse. Because we don't store chats, we usually have very little to give authorities (privacy policy). Clearing your browser or deleting your account deletes your chats for good, so copy out anything you need to keep.

• Patient information at work: only the product named in your organization's BAA, with the covered features on.
• A question about your own health: an E2EE chat on Morse.
• A de-identified draft or a study question: a Private chat on Morse, the default.
• A general clinical question for GPT, Claude, or Gemini: Anonymous mode on Morse, with no identifiers in it.

Try a chat from the Morse home page without an account, or start free. End-to-end encrypted chats come with Pro, at $19 a month.