Is ChatGPT HIPAA compliant? Not on Plus or Business, and only with a signed agreement

ChatGPT isn't HIPAA compliant on Free, Go, Plus, Pro or Business. OpenAI signs a business associate agreement (BAA) only for sales-managed Enterprise and Edu, ChatGPT for Healthcare, the free ChatGPT for Clinicians, and its API. Even with a BAA, some features stay outside it, and the agreement doesn't make your practice compliant on its own.

This guide covers each ChatGPT plan, the free option for US clinicians, what the agreement leaves out, the API, and how Copilot and Gemini compare. Facts come from OpenAI's, Microsoft's and Google's own pages, checked on 6 November 2026. Several popular guides are now out of date, so we point out where. Citenook isn't connected to OpenAI, and this isn't legal advice, so check your setup with your compliance lead.

Which ChatGPT plans can be HIPAA compliant?

HIPAA needs a signed BAA before a company handles patient data for you. Our Claude HIPAA guide explains why. Here's where OpenAI offers one.

OpenAI's help center puts it in one line:

OpenAI's list of eligible products calls the Enterprise option "ChatGPT for Enterprise with Regulated Workspace", so ask sales for the BAA and that setup together rather than assuming an existing Enterprise workspace is covered.

Is ChatGPT Business HIPAA compliant?

No. This is the plan that catches small practices out. ChatGPT Business, called Team until August 2025, costs $25 a seat a month, or $20 billed yearly, with at least 2 seats. It doesn't train on your data by default, and it looks like a business product, but OpenAI says plainly: "We do not offer a BAA for ChatGPT Business."

Some guides still say Team can get a BAA, or mix up which name came first. Going by OpenAI's own pages, no version of Business or Team can.

ChatGPT for Clinicians: the free option for US prescribers

This is the newest route, and most guides miss it. OpenAI says "ChatGPT for Clinicians is free for verified clinicians in the United States." It's a separate workspace with clinical search and documentation help, and each clinician can sign a BAA under Settings, Agreements.

• Who qualifies: physicians (MD or DO), nurse practitioners, physician assistants and pharmacists, with a valid NPI and a license the verification service can check. Therapists, dentists, registered nurses and office staff aren't on that list.
• One person only: it covers your own workspace. For a BAA that covers several users, OpenAI points you to ChatGPT for Healthcare.
• Third-party add-ons: OpenAI says not to share patient data with third-party GPTs or connected apps unless you have the right agreements with them too.
• Free "at launch": that's OpenAI's wording, so the price could change.

Is ChatGPT Health HIPAA compliant?

No, and it isn't meant to be. Health in ChatGPT lets US users on Free, Go, Plus and Pro connect their own medical records and Apple Health. OpenAI says it "is not intended for clinical or covered-entity use and does not offer a Business Associate Agreement."

That's fine for its purpose. HIPAA rules apply to providers, health plans and their vendors, not to you reading your own records. A doctor shouldn't use it for patients, though.

What the BAA doesn't cover

Even on a covered plan, OpenAI lists features that aren't covered, and says "PHI should not be entered when using this functionality." PHI means protected health information. The list on 6 November 2026:

• Improved memory, which uses your past chats
• Browser use and network access for Work in the cloud
• Internet access in Canvas and code blocks
• Scheduled tasks triggered by activity in connected apps
• Sharing workspace agents that use agent-owned connections
• Two Codex settings: Enable Computer History and Administer Codex Security

These are turned off by default, but an admin can turn them on. OpenAI also says "Features not listed here are not automatically covered," so a new feature isn't covered until it appears on the list. Web search is covered, because covered workspaces search OpenAI's own index and don't send queries to outside search engines like Bing.

Using the OpenAI API with patient data

The API can be covered, which is how most healthcare apps built on OpenAI work. You need two things: a signed BAA, and an organization set up with what OpenAI calls Modified Retention, which changes how long OpenAI keeps your data.

1. An admin signs in to the API Platform and opens Settings, Organization, General.
2. Under HIPAA compliance support, they choose Enable, read the agreement and accept it.
3. If the page says "Not eligible yet", the organization doesn't have enough API usage history. Try again later or email baa@openai.com.

You can't turn it off again from settings. Older guides say the API BAA covers only a few endpoints. OpenAI's current list includes chat, responses, assistants, files, embeddings, audio and image generation. OpenAI adds that accepting a BAA and turning on HIPAA support "do not, by themselves, make your application HIPAA compliant."

What about Copilot and Gemini?

Both depend on how you sign in. A work account under your organization's Microsoft 365 or Google Workspace contract can be covered. A personal account isn't.

Microsoft makes its BAA available "by default to all customers who are covered entities or business associates," and lists Microsoft Copilot and Copilot Chat in scope. Google's list, updated 28 October 2026, includes the Gemini app, Gemini in Workspace and the Gemini Mac app. Both say no government body certifies products for HIPAA, and both say compliance stays partly your job. More on each in is Copilot safe and is Gemini safe.

For a small practice, this is often the easiest answer. If you already pay for business Microsoft 365 or Google Workspace, its AI may already be covered. Ask whoever runs your account to confirm the BAA is in place.

Your options if you're a small practice

• Keep patient data out of personal ChatGPT. It's still useful for policies, handouts and learning, with nothing about patients in the prompt.
• Sign up for ChatGPT for Clinicians if you're a US prescriber working alone, and sign the BAA before entering any patient data.
• Use the AI in the Microsoft 365 or Workspace plan you already have, once its BAA is confirmed.
• Use ChatGPT for Healthcare or Enterprise if you're a larger organization. Prices aren't public.
• Remove identifying details properly first. Deleting the name isn't enough. HIPAA's Safe Harbor method lists 18 kinds of identifiers, and our test of hiding personal details shows how easy they are to miss.
• Run the AI on your own computer, so patient files don't go to an AI company at all.

Keeping patient files on your Mac

Citenook is a Mac app that answers questions from your own files, such as referral letters, reports and protocols. With a model running on the Mac, the files, questions and answers stay on the Mac, it works with Wi-Fi off, and we never receive any of it. See how it fits doctors.

The limits matter here. Citenook isn't certified for HIPAA and doesn't sign BAAs. Keeping data on a Mac doesn't replace your other duties, like encrypting the disk and controlling who uses the computer. If you connect an online AI, that company receives the text, and our personal-detail hiding isn't de-identification. Citenook is for one person on a Mac, doesn't connect to an EHR, and gives no medical advice. It's free for 30 days, then from $9.99 a month. See exactly what goes where.

Questions

Sources, checked 6 November 2026: OpenAI business associate agreements, HIPAA eligible products and functionality, ChatGPT for Clinicians, ChatGPT for Healthcare, Health in ChatGPT and ChatGPT Business overview; Microsoft HIPAA and HITECH and enterprise data protection in Copilot; Google Cloud HIPAA compliance; US Department of Health and Human Services guidance on HIPAA and cloud computing. Plans and coverage change, so confirm against your signed agreement. This isn't legal advice.

Related: Citenook for doctors · Is Claude HIPAA compliant? · Is ChatGPT confidential?