Using ChatGPT-style assistants with PHI: what HIPAA requires

No assistant is "HIPAA compliant" as a product property. A clinic can put PHI into a ChatGPT-style tool only when three things line up: a signed Business Associate Agreement (BAA) that covers the specific service, a configuration of that service that matches the BAA, and the clinic's own policies and training. Free and consumer accounts without a BAA are not a place for patient information.

Short answer: when ChatGPT-style assistants can be used with PHI

A covered entity or business associate needs a BAA with any vendor that creates, receives, maintains or transmits PHI on its behalf (45 CFR 164.502(e) and 164.504(e)). The BAA has to cover the product, plan and feature actually used. A BAA for one product does not extend to a different product from the same company.

A BAA is necessary but not sufficient. Compliance depends on the signed BAA, how the service is configured, and the customer's own policies, risk analysis and training. A signed BAA does not turn a careless workflow into a compliant one.

This page is the how-to. For the vendor-by-vendor verdict, including "is ChatGPT HIPAA compliant", see hipaacompliant.wiki/is. For the wider topic, see AI chat and PHI: what HIPAA allows. If you are really asking about a different kind of chat (website chat, a developer API, video), start at Chat under HIPAA: which kind do you need.

What counts as PHI in a prompt

PHI is individually identifiable health information held or transmitted by a covered entity or business associate (45 CFR 160.103). Names are only one identifier. These also count when tied to health information or care:

• Dates: appointment, admission, discharge, birth.
• Phone numbers, email addresses, street addresses, and ZIP codes narrower than the HIPAA allowances.
• Medical record, account, claim and insurance member numbers.
• Photos, device identifiers, and free-text details that point to one person ("the only dialysis patient on the Tuesday schedule at the Elm Street office").

PHI reaches an assistant in more ways than a typed question:

• Pasted EHR text, such as a progress note or a lab result.
• Uploaded files: referral letters, scanned intake forms, billing exports.
• Screenshots of a scheduling screen or a patient portal message.
• Voice input and recorded visits.

Outputs count too. A summary of a patient note is PHI, and so is the chat history that stores it. Ask where prompts, files and conversation history are stored, and who can read them.

De-identification is a separate path, defined in 45 CFR 164.514. It requires either an expert determination or removal of the listed identifiers under Safe Harbor, including all date elements except year and any other information you know could identify the person. Deleting the patient's name from a note does not meet either standard. Treat de-identification as a documented process, not a quick workaround before pasting.

The three layers: BAA, configuration, policy

BAA. Check which services and plans the agreement names, and what the vendor lists as excluded. OpenAI's help article on ChatGPT for Healthcare states: "Your BAA covers only the eligible products and functionality listed in HIPAA Eligible Products and Functionality." Anything outside that list is outside the agreement, even inside an eligible workspace.

Configuration. Vendors publish controls that an administrator has to turn on or leave off. Examples from the vendor documents used here: OpenAI lists audit logs, access controls, SSO and a Compliance API for its eligible workspaces. For the OpenAI API, the BAA applies to the API provisioned with Modified Retention (zero data retention). Anthropic states that its covered models require 30-day retention and are not available with zero data retention unless Anthropic authorizes it. Retention terms differ by vendor and by route, so read them before you decide what may be sent.

Policy. Approved use cases, who may use the tool, staff training, incident handling and a documented risk analysis are the clinic's job. No vendor can supply them.

Layer	Vendor responsibility	Customer responsibility
BAA	Offers and signs the agreement; defines covered services and exclusions	Signs it for the right product and plan; confirms the features staff use are covered
Configuration	Provides admin controls, logs, retention options	Enables them, disables out-of-scope features, limits access to managed accounts
Policy	Publishes documentation and security information	Writes the use policy, trains staff, runs and updates the risk analysis, handles incidents

Consumer app, business plan or API: which route can carry a BAA

Assistants reach an organization in three ways: a consumer app tied to a personal account, a managed workspace (team or enterprise) with admin controls, and a developer API that your own software calls. A BAA attaches to specific products on these routes, not to the route in general.

For OpenAI, the vendor's HIPAA Implementation and Configuration Guide (July 9, 2026) states: "ChatGPT services for consumers (e.g., Free, Plus, Pro) and ChatGPT Business are not Eligible Services." OpenAI's BAA page adds: "We do not offer a BAA for ChatGPT Business."

BAA available on these OpenAI products:

Route	Product	How the BAA is obtained
Managed workspace	ChatGPT for Healthcare; ChatGPT Enterprise and Edu with Regulated Workspace; ChatGPT FedRAMP	Contact sales for sales-managed Enterprise or Edu accounts
Individual	ChatGPT for Clinicians (individual, verified US clinicians)	Sign the BAA in ChatGPT under Settings > Agreements
API	OpenAI API with Modified Retention; OpenAI API FedRAMP with Modified Retention	An organization admin accepts the standard Business Associate and Healthcare Addendum in the API Platform (Settings > Organization > General > HIPAA compliance support > Enable); self-serve requires an established API usage history, otherwise email [email protected]

ChatGPT for Clinicians is designed for individual use. OpenAI's help article says that for centralized deployment, admin controls or a BAA covering multiple users, you should look at ChatGPT for Healthcare. A clinic with several clinicians should not have each one sign up individually. Pricing: ChatGPT for Clinicians starts at $0 for individual verified US clinicians; ChatGPT Enterprise and Healthcare are sold through sales; the API is pay-as-you-go.

Teams building their own tool on a model API should also read HIPAA-compliant chat APIs for developers, which covers architecture for PHI.

Even on eligible products, some features sit outside the OpenAI BAA:

• Improved memory (disabled by default and not covered; OpenAI says PHI should not be entered when using it).
• Event-triggered scheduled tasks.
• Codex in the cloud, and Codex Cloud administration.
• Internet access in Canvas and code blocks, and browser use or network access for Work in the cloud.
• Workspace agents shared with agent-owned connections.
• Third-party GPTs and connected apps, which are not automatically covered.

Other assistants have their own terms, and consumer tiers are excluded in each case. These are short summaries, not a comparison; the wiki holds the verdicts.

• Anthropic Claude: BAA available on Claude Enterprise (click-to-accept by the Primary Owner, 20-seat minimum), the first-party API and Claude in Microsoft Foundry. Free, Pro, Max and Team plans cannot enable HIPAA.
• Google Gemini: BAA available for Gemini in Google Workspace and the Gemini app on paid Workspace editions where Gemini Apps is a core service, and for Gemini on Google Cloud. Gemini in Chrome, Gemini with consumer accounts and the Gemini API via Google AI Studio are not covered.
• Microsoft Copilot: BAA available through the Online Services DPA for Microsoft Copilot and Copilot Chat used with a work account. Web search queries sent to Bing and consumer Copilot are not covered.

A practical workflow for clinics

Step 1: List the tasks and mark which need PHI. A typical clinic list:

• Drafting a patient letter from a visit summary (PHI).
• Summarizing a clinician's note (PHI).
• Suggesting billing codes from a chart (PHI).
• Rewriting the website's "new patient" page (no PHI).
• Writing a recall-campaign email template (no PHI, if no patient data goes in).

Step 2: Keep non-PHI tasks on non-PHI tools. The minimum necessary standard applies: if a task can be done without patient information, do it that way. Marketing copy, policy drafts and generic scripts rarely need PHI.

Step 3: For PHI tasks, get a BAA that covers the service, configure it and document the risk analysis. Name the exact product, plan and feature staff will use. Switch off features outside the BAA (memory, browsing, connectors, third-party apps). Record the decision and the settings in the risk analysis.

Step 4: Train staff, restrict accounts and review logs. Require sign-in through the managed workspace or organization account. Where the vendor publishes audit logs, assign someone to review them on a schedule.

Step 5: Require human review of any output that enters a clinical or patient-facing record. A clinician or trained staff member checks a generated letter or summary against the chart before it is sent or filed.

Common mistakes and risk areas

• Shadow AI. A front-desk employee pastes a patient message into a personal ChatGPT account to "make it friendlier". Free and Plus plans have no BAA. Block personal accounts on work devices and give staff an approved alternative.
• Treating a security page as a BAA. A vendor's trust center, a SOC 2 report or a "built for healthcare" slogan is not a signed agreement covering your account.
• A patient-facing chatbot on a general model without a BAA. Intake bots collect names, symptoms and insurance details directly from patients. See HIPAA-ready AI chat for patient intake. A bot embedded in website chat raises the same question; see HIPAA-compliant live chat for healthcare websites.
• Ignoring accuracy. Assistants produce wrong or invented content. A fabricated medication detail in a letter, or a code unsupported by the note, is a clinical and billing risk.
• A stale risk analysis. A new feature, a changed setting or a new connector changes where data flows. Update the analysis when the tool or its configuration changes.

Questions to ask a vendor before sending PHI

1. Will you sign a BAA, and for which products, plans and endpoints? Are any features listed as excluded?
2. Is customer content used to train models? Is that off by default or only after a setting change?
3. What are retention and deletion terms, including abuse-monitoring logs? Is zero data retention available, and what does it change?
4. Which subprocessors and data locations apply? Are residency options offered on your plan?
5. What happens in a breach: notification timelines and who does what under the BAA?
6. Which connectors, plug-ins and third-party apps fall outside the agreement?

Sources and last verified

FAQ

Is ChatGPT HIPAA compliant?

Compliance is not a property of the product. It depends on a signed BAA that covers the specific ChatGPT product, the configuration, and the organization's policies. For the verdict on each ChatGPT plan, see hipaacompliant.wiki/is.

Can I use ChatGPT with patient information if I remove the name?

Not on that basis alone. Dates, contact details, record numbers and descriptive free text can still identify a patient. Data counts as de-identified only under 45 CFR 164.514, through expert determination or Safe Harbor removal of all listed identifiers.

Does a BAA make an AI tool OK to use with PHI?

No. A BAA covers only the products and features it lists. You still need to configure the service, switch off excluded features, train staff and keep a risk analysis.

Does the free version of ChatGPT have a BAA?

No. OpenAI states that ChatGPT services for consumers (Free, Plus, Pro) and ChatGPT Business are not Eligible Services. Do not put PHI into them.

Can staff use ChatGPT for marketing copy at a clinic?

Yes, if no PHI goes in. Generic copy for a service page or a recall-email template needs no patient data. Do not paste patient stories, testimonials with identifying details, or appointment lists into a prompt. Marketing use of patient information has its own HIPAA authorization rules.

Is de-identified data still PHI?

Data de-identified under 45 CFR 164.514 is no longer PHI. Data with only some identifiers removed generally is. The process should be documented.

What should a clinic's AI use policy include?

• Approved tools and accounts, with personal accounts prohibited.
• Which tasks may involve PHI and which may not.
• The BAA and configuration requirements for any PHI task.
• Features that are off-limits (memory, browsing, connectors, third-party apps).
• Human review rules for outputs that enter records or reach patients.
• Training requirements and who owns them.
• Incident reporting steps.
• A review schedule for the risk analysis when tools or settings change.