HIPAA-compliant AI chat: what the rules allow and what a BAA covers

An AI chat can handle protected health information (PHI) only when a signed business associate agreement (BAA) covers the exact service and plan in use, the product is configured the way that agreement assumes, and the clinic's own policies permit the use. HIPAA does not certify chatbots or assistants. The questions are whether the contract, the settings and your policies line up, and whether you can show they do.

Short answer: when can an AI chat handle PHI?

HIPAA regulates covered entities (clinics, health plans, clearinghouses) and their business associates. It does not approve products. A vendor cannot be "HIPAA certified" in any legal sense. What exists is a BAA, a set of technical and administrative safeguards, and the covered entity's documented decision to use the tool.

Compliance depends on three things together: the signed BAA, the configuration, and the customer's policies. A BAA without the right settings leaves gaps, and good settings without a BAA are still an impermissible disclosure if PHI goes in.

Most AI chat in a clinic falls into one of three situations:

Situation	PHI allowed?	What decides it
Consumer chatbot or free tier	No, unless a BAA explicitly covers it OpenAI's current HIPAA-eligible products page lists only enterprise-type offerings (ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT FedRAMP, ChatGPT for Clinicians), and Anthropic's commercial BAA article excludes its consumer plans (Free, Pro, Max, Ultra). (help.openai.com)	No BAA is normally offered on these tiers, so treat inputs as non-PHI
Enterprise or API tier from a general model provider	Only if the vendor offers a BAA and the specific service is named in it	BAA scope, plan, retention and training terms, your configuration
Purpose-built healthcare bot (intake, scheduling, triage)	Only under a BAA with that vendor, plus agreements covering any model provider behind it	The whole chain of subcontractors, not just the front-end vendor

If you are still deciding which channel you need at all, start with which kind of chat you need under HIPAA. Staff-only messaging is covered by chanty.health, not here.

What "HIPAA-compliant" means for an AI chat

Covered entity and business associate. A clinic is a covered entity. When an AI vendor creates, receives, maintains or transmits PHI on the clinic's behalf, it is a business associate. The Privacy Rule requires a written agreement before that happens (45 CFR 164.502(e) and 164.504(e)), and the Security Rule applies the same requirement to electronic PHI (45 CFR 164.308(b)). A vendor that stores prompts and transcripts containing PHI is a business associate even if it says it "doesn't look at" the data. HHS has said this about cloud providers that hold encrypted ePHI without the key. (hhs.gov)

What the BAA must address. At minimum, the agreement has to cover:

• permitted and required uses and disclosures of PHI;
• safeguards, including compliance with the Security Rule for electronic PHI;
• reporting of breaches and security incidents to the covered entity;
• flow-down of the same restrictions to subcontractors that handle PHI;
• return or destruction of PHI at termination, where feasible.

Why the labels mislead. "HIPAA certified" and "HIPAA compliant product" are marketing phrases, not legal categories. HHS does not endorse or certify software. Some vendors hold third-party attestations such as SOC 2 or HITRUST. Those speak to security practices, not to whether your use is permitted, and they don't replace a BAA.

What a BAA does and does not cover

It covers named services, not the vendor. A BAA usually lists the products, plans or endpoints it applies to. A vendor can sign a BAA for an enterprise API and still exclude its consumer app, its free tier or its newest features. Read the scope clause and match it to the exact plan your account is on. Anthropic's BAA covers designated HIPAA-ready services such as the first-party API and Enterprise plans once HIPAA settings are activated, and OpenAI's covers only listed eligible products used in an eligible workspace. (privacy.claude.com)

Features that often sit outside the agreement. Check whether the BAA excludes any of the following, and get the answer from the vendor's documentation or in writing:

• beta or preview models and features;
• plugins, connectors, browser tools or third-party integrations;
• file upload, voice or image inputs, if offered as separate services;
• search or retrieval features that send content to another provider.

Anthropic's BAA covers the first-party API, Claude in Microsoft Foundry and HIPAA-ready Enterprise plans, where the Primary Owner must turn on HIPAA in settings and accept the BAA. It excludes the Batch API, Files API (beta), Skills API (beta), Code Execution and Web Fetch, and covers Claude Code and Cowork (local mode) only when the HIPAA configuration is applied. Google covers only services on its "HIPAA Included Functionality" list once the customer has accepted the BAA, and says "some features might be blocked" in the Gemini app for BAA customers. OpenAI's BAA covers ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT FedRAMP and ChatGPT for Clinicians, plus the API with a signed BAA. Customers can turn on features the BAA doesn't cover. Chanty's healthcare offering is not available on its Free plan. (privacy.claude.com)

Terms to confirm in writing:

• Retention. How long prompts, outputs and uploaded files are stored, and whether zero or limited retention is available and on which plan.
• Training. Whether the vendor uses your inputs to train or improve models, and whether that is off by default or needs a setting.
• Logging. What is logged for abuse monitoring, who at the vendor can read it, and whether those logs fall under the BAA.
• Subprocessors. Which companies host or process the data, and whether they are bound by the same terms.

What a BAA does not do. It does not make a staff member's prompt appropriate, set up access controls, or stop someone pasting a full chart into a tool the clinic only approved for scheduling questions. Those are your policies and your configuration.

Checklist before putting PHI into an AI chat

1. A signed BAA that names the service and plan you actually use. Save the executed copy with the plan name and account ID, so you can show later what was covered.
2. Retention and training terms confirmed. Zero or limited retention and no training on your inputs, stated in the contract or official documentation, not in a sales call.
3. Access controls. Individual accounts (no shared logins), SSO where available, role limits, and audit logs you can export. A front-desk assistant doesn't need the same access as a billing analyst.
4. Minimum necessary rules written down. Define what staff may paste or ask. For example: "Summarize this de-identified referral letter" may be fine, while pasting a patient's name, date of birth and diagnosis to draft an appeal letter needs a specific decision from the privacy officer. The minimum necessary standard (45 CFR 164.502(b)) applies to AI use like any other use.
5. Risk analysis updated. The Security Rule requires an accurate risk analysis (45 CFR 164.308(a)(1)(ii)(A)). Add the AI tool, the data it touches and the vendors behind it.
6. Training and an incident path. Staff need to know which tool is approved, which is not, and whom to tell if PHI goes into the wrong one. Breach notification clocks start from discovery.
7. Configuration verified after launch. Check that training opt-outs, retention settings and connectors are set as documented, and recheck after vendor updates.

Common AI chat use cases in healthcare

Staff using a general-purpose assistant. Front-desk, billing and clinical staff use assistants to draft letters, summarize notes or rewrite patient instructions. The risk is that the convenient account is a personal one. See using ChatGPT-style assistants with PHI for what a BAA tier changes and what it doesn't.

Patient-facing intake and scheduling bots. A bot that asks about symptoms, insurance or medication collects PHI from the first message. That puts the bot vendor, its model provider and its hosting in the BAA chain. Authentication, consent language and handoff to staff matter as much as the contract. See HIPAA-ready AI chat for patient intake.

Bots layered on website live chat. Many clinics add an AI responder to an existing chat widget. The live chat vendor's BAA may not cover the bot add-on or the model behind it. The live chat side is covered in the live chat hub (linked below under "Where AI chat goes wrong").

Developers calling model or chat APIs with PHI. Product teams building a symptom checker or a documentation tool need a BAA with the model provider, a design that keeps PHI out of logs and analytics, and clarity on which API endpoints are covered. See HIPAA-compliant chat APIs for developers for architecture notes on keeping PHI paths narrow.

Where AI chat goes wrong

Shadow AI. A nurse manager pastes patient details into a personal account because the approved tool is slow. No BAA exists for that account, so the disclosure is unauthorized regardless of intent. The fix is an approved tool that is easy enough to use, plus a clear rule and training.

Assuming one BAA covers the chain. A BAA with a cloud host does not automatically cover the model provider running on it, and a BAA with a chatbot vendor does not automatically cover the model API it calls. Ask for the list of subprocessors and confirm each handles PHI under written terms.

Tracking technologies on chat pages. Analytics scripts, advertising pixels and session-replay tools on pages with a chat widget can send identifiers and chat context to third parties. HHS issued a bulletin on online tracking technologies in 2022 and revised it in 2024, and part of it was challenged in court. On June 20, 2024, a federal court in the Northern District of Texas vacated part of the bulletin (American Hospital Association v. Becerra, No. 4:23-cv-1110), namely the part saying HIPAA is triggered when a technology links an IP address to a visit to an unauthenticated public page about health conditions or providers. The rest of the bulletin remains posted, and HHS says it is evaluating its next steps. (hhs.gov) Whatever the current status, a third party receiving PHI from your site needs a BAA or an authorization. Audit the tags on any page that hosts a chat. The same issue applies to a plain chat widget; see HIPAA-compliant live chat for healthcare websites.

Bots that overreach. A bot that answers "should I go to the ER?" is giving clinical advice. A bot that captures symptoms before the visitor is authenticated or has seen your notice can create PHI in a system you haven't scoped. Limit bots to defined tasks, put a handoff to a human at the first sign of clinical content, and decide before launch what the bot may collect.

Vendor verdicts and where to check them

Per-vendor BAA verdicts (which plans, which services, which exclusions) live on hipaacompliant.wiki /hipaa-compliant/ai-tools/ (individual vendor entries are under /is/) (hipaacompliant.wiki). They are kept there so they have one owner and one verification date. This page doesn't restate them.

If a vendor isn't listed, ask it these questions and get the answers in writing:

1. Will you sign a BAA, and which products and plans does it name?
2. Are consumer, free, beta or preview features excluded?
3. Are prompts, outputs and files retained, for how long, and can retention be set to zero or limited?
4. Are customer inputs used for training or improvement by default? Can that be turned off, and is the opt-out contractual?
5. Which subprocessors and model providers touch the data, and are they bound by the same terms?
6. What audit logs, SSO and role controls are available, and on which plan?
7. How and how quickly will you notify us of a breach or security incident?

An "Ask HIPAA" assistant is planned for this section, built on verified wiki entries. [confirm launch status before publishing] Until it launches, use the wiki directly.

Sources and last verified

FAQ

Can I use ChatGPT with patient information?

Only if the specific ChatGPT service and plan you use is named in a signed BAA with OpenAI, and you configure and use it within that agreement and your own policies. Personal and free accounts shouldn't receive PHI. OpenAI's HIPAA-eligible products page lists ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT FedRAMP and ChatGPT for Clinicians, and covers functionality only when used in an eligible workspace. (help.openai.com) The step-by-step version is in the guide on using ChatGPT-style assistants with PHI.

Is there such a thing as a HIPAA-certified AI chatbot?

No. HHS doesn't certify or endorse software, so "HIPAA certified" isn't a legal status. A vendor can offer a BAA for named services, and a clinic can use those services in a way that meets its obligations. Treat a certification claim as a prompt to ask for the BAA and its scope.

Does a BAA make an AI chat compliant?

No. A BAA is required before a business associate handles PHI, but it doesn't configure the tool, restrict what staff enter, or complete your risk analysis. It also covers only the services it names. Compliance comes from the BAA, the configuration and your policies together.

Can a website chatbot collect PHI?

It can, if the chatbot vendor and any model provider behind it sign BAAs covering the service, the page has no unauthorized tracking technologies, and your notice and authentication flow are set up for what the bot collects. Many clinics limit website bots to non-PHI tasks such as hours, directions and appointment requests that route to a secure channel. See HIPAA-ready AI chat for patient intake for intake design.

Do I need a BAA if the chat is de-identified?

Not for data that meets the HIPAA de-identification standard, because de-identified data is no longer PHI. The standard in 45 CFR 164.514(b) has two routes: Safe Harbor, which removes 18 listed identifier types and requires no actual knowledge that the rest could identify someone, and Expert Determination, where a qualified statistician documents that the re-identification risk is very small. Removing a patient's name isn't enough. Free-text prompts often carry dates, locations or rare conditions that defeat de-identification, so many clinics get a BAA anyway.

Can AI vendors train on PHI under a BAA?

It depends on the agreement. A business associate may use PHI only as the BAA and the Privacy Rule permit, and using customer PHI to train general models for the vendor's own purposes generally isn't a permitted use unless the agreement and the rules allow it. Ask for the training terms in the contract, not just the vendor's FAQ. For example, OpenAI says business data from ChatGPT Business, Enterprise, Healthcare, Edu, Teachers and the API isn't used for training by default unless the customer opts in. Anthropic's Commercial Terms state that "Anthropic may not train models on Customer Content from Services." (help.openai.com)

• Using ChatGPT-style assistants with PHI: what HIPAA requires
• HIPAA-Ready AI Chat for Patient Intake: What a Medical Practice Needs