Is ChatGPT, Claude or Gemini HIPAA Compliant?

The short answer

Interest in this question has jumped as clinicians and health systems adopt these tools. U.S. Google searches for “is claude hipaa compliant” went from roughly 100 a month in late 2025 to about 1,000 a month through the summer of 2026, according to DataForSEO estimates, while “is chatgpt hipaa compliant” has held steady at 700 to 1,000 a month.

What “HIPAA compliant” does and does not mean for an AI tool

HIPAA applies to covered entities (healthcare providers that bill electronically, health plans and clearinghouses) and to their business associates, the vendors that create, receive, maintain or transmit protected health information on their behalf. An AI provider processing your patients’ data is a business associate, and HIPAA requires a written Business Associate Agreement before PHI goes to them.

That is why the honest answer to “is this AI tool HIPAA compliant?” is always conditional. A vendor can do three things: offer products whose security and data handling are suitable for PHI, sign a BAA covering those products, and document what is in and out of scope. It cannot run your access controls, decide what your staff type into it, or perform your risk analysis.

The same logic applies to cloud services. HHS guidance is explicit that a cloud provider storing ePHI is a business associate even if it only holds encrypted data and has no key. Being a business associate does not make the customer’s use compliant; it creates obligations on both sides.

Product, agreement, implementation, and you

Most confusion about AI and HIPAA comes from blending four separate questions into one. Keep them apart and the vendor comparison becomes much easier to read.

The comparison below covers layers 1 and 2 for each provider. Layers 3 and 4 are covered at the end of this article and in depth in our HIPAA-compliant AI requirements checklist.

ChatGPT vs Claude vs Gemini for HIPAA: side by side

Each cell summarizes the provider’s own documentation as of October 5, 2026. Filter by product type, or on a phone, switch between providers.

“BAA available” means the provider offers one for that product. It still has to be signed and the product configured as the BAA requires. Sources are listed at the end.

Is ChatGPT HIPAA compliant? OpenAI in detail

OpenAI reorganized its healthcare offering in 2026. It now lists six HIPAA-eligible products available with a BAA: ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT FedRAMP, ChatGPT for Clinicians, the API with Modified Retention and the API FedRAMP with Modified Retention. Everything else, including the plans most people use, is outside the BAA.

What changed for the OpenAI API

Older articles say an OpenAI BAA requires zero data retention. That is no longer the whole picture. OpenAI’s current HIPAA guide requires Modified Retention, a family of arrangements that includes ZDR but also Modified Abuse Monitoring and others. Once an organization is provisioned, OpenAI says the listed endpoints can be used for PHI “even if data is retained.” That matters for builders: endpoints that store state, such as Assistants, Files and vector stores, are on the BAA list even though they are not eligible for ZDR.

By default, API abuse-monitoring logs are kept for up to 30 days, and the Responses API keeps application state for 30 days unless store is turned off. OpenAI does not use API, Business, Enterprise or Edu data to train its models by default.

ChatGPT for Clinicians

This is the most consequential change for individual practitioners. OpenAI describes ChatGPT for Clinicians as free for verified U.S. physicians, nurse practitioners, physician assistants and pharmacists, with a BAA that eligible clinicians can sign under Settings > Agreements. It fills a gap that previously pushed clinicians toward consumer plans. For clinicians employed by a health system, the employer’s approved-tools policy still applies.

Is Claude HIPAA compliant? Anthropic in detail

Anthropic offers a BAA covering what it calls HIPAA-ready services: its first-party API and Claude Enterprise plans. In 2026 it made this self-serve. A Primary Owner of an eligible Enterprise organization can turn on HIPAA-ready configuration in organization settings and accept the BAA with a click, and Anthropic launched Claude for Healthcare in January 2026 as a set of HIPAA-ready tools and connectors for providers, payers and health tech companies.

On the API side, Anthropic enforces scope technically: a HIPAA-enabled organization that calls a non-eligible feature gets an error rather than silently sending PHI out of scope. Its documentation also warns against putting PHI into JSON schema definitions for structured outputs, a detail worth passing to your developers.

For consumer plans, Anthropic changed its terms in August 2025 so that Free, Pro and Max users choose whether their chats are used for training. Commercial products, the API, and Claude accessed through Amazon Bedrock or Google Cloud were excluded from that change.

Is Gemini HIPAA compliant? Google in detail

Google’s answer runs through two existing agreements rather than a Gemini-specific one. The Google Workspace BAA lists the Gemini app (excluding Gemini in Chrome), the Gemini Mac app and Gemini in Workspace as included functionality as of August 31, 2026. The Google Cloud BAA covers Gemini Enterprise and generative AI on Gemini Enterprise Agent Platform, the 2026 name for what was Vertex AI.

The AI Studio point trips up a lot of developers. Google’s Gemini API terms say that on unpaid services, human reviewers may read inputs and outputs, and warn against submitting sensitive personal information. Paid usage is not used to improve Google’s products, but the developer API still does not appear on either BAA list. For PHI, build on Agent Platform under the Cloud BAA.

For consumer Gemini, Google says a subset of chats is reviewed by humans and reviewed chats are kept for up to three years. That alone rules it out for patient information. Google’s former healthcare model line, MedLM, was retired in September 2025.

Using these models through Azure, AWS or Google Cloud

Many healthcare organizations never sign a BAA with a model company at all. They use models through the cloud where their PHI already lives, under the BAA they already have with that cloud. In that case the cloud provider, not the model developer, is the business associate and data processor.

One subtlety: Anthropic’s own HIPAA readiness does not extend to Claude on Bedrock or Google Cloud, because those run under the cloud’s agreement. Anthropic also says its 30-day retention for Covered Models applies on every platform, with retained data staying inside AWS or Google Cloud. Read both the cloud’s BAA scope and the model’s terms. Our post on HIPAA cloud infrastructure covers the rest of the cloud setup.

What your organization still has to configure

Whichever provider you choose, the BAA leaves a predictable list of work on your side. These are the items we see missed most often.

1. Sign the right BAA for the right account

   The agreement must cover the exact plan, organization or project you use. A BAA on one workspace does not cover a colleague’s personal account.

2. Turn off what the BAA excludes

   Disable or block excluded features: live web search, beta tools, connectors to uncovered services, memory features and anything pre-GA. Where the provider supports enforcement, use it.

3. Set retention deliberately

   Know what the provider retains and for how long, and what your own application stores: transcripts, files, embeddings and logs.

4. Control access with SSO and roles

   Single sign-on, MFA, role-based access, and prompt offboarding. Shared logins defeat audit trails.

5. Limit what goes in

   Apply the minimum necessary standard to prompts, and de-identify where identity is not needed. Our PHI de-identification work covers the HIPAA standard for this.

6. Document, train and monitor

   Update the risk analysis, write an acceptable-use policy for AI, train staff on what can and cannot be entered, and review usage logs. Track the vendor through BAA and vendor risk management.

If you are building your own assistant on one of these APIs rather than using the chat products, the architecture matters as much as the agreement. That is the subject of part 1: how to build a HIPAA-compliant AI chatbot or agent.

Can I use this AI tool with patient information?

Answer a few questions about a specific tool and use case. This is a starting point for a conversation with your privacy officer, not a legal determination.

Frequently asked questions about ChatGPT, Claude, Gemini and HIPAA