Does OpenAI Sign a BAA? ChatGPT and HIPAA

Short answer: yes, OpenAI will sign a Business Associate Agreement (BAA), but only for some of its products. It signs one for the OpenAI API and for sales-managed ChatGPT Enterprise and ChatGPT Edu accounts. It runs a separate BAA flow for eligible clinicians using ChatGPT for Clinicians. It says plainly that it does not offer a BAA for ChatGPT Business, and Free and Plus are not on the list at all. For a small practice, that usually means the ChatGPT account your staff already use cannot touch patient data. We checked all of this against OpenAI's own help article on 20 October 2026, and the live answer sits on our Is ChatGPT HIPAA compliant? page.

Why the BAA decides the question

Under HIPAA, a practice that shares protected health information (PHI) with a vendor needs a business associate agreement with that vendor first. The rule is in the Privacy Rule at 45 CFR 164.502(e) and 164.504(e), and the US Department of Health and Human Services publishes sample BAA provisions for it. If an AI tool processes a patient's name, a session note or an appointment detail on your behalf, the vendor is acting as a business associate. Without a signed BAA, putting that information into the tool is a disclosure HIPAA does not allow, however good the vendor's security is. That is why "is ChatGPT HIPAA compliant?" really means "will OpenAI sign a BAA for the account we use?"

Which OpenAI products come with a BAA

There are three routes. The API route is self-serve: an organization admin opens the API Platform, goes to Settings, then Organization, then General, and enables HIPAA compliance support, which means accepting OpenAI's standard Business Associate and Healthcare Addendum. OpenAI says an enterprise agreement is not required, but self-serve enrollment needs an established history of API usage. If the setting shows Not eligible yet, OpenAI points you to [email protected]. The ChatGPT route is through sales: a BAA is available for sales-managed ChatGPT Enterprise and Edu accounts. The third route is ChatGPT for Clinicians, which OpenAI describes as having its own in-product BAA flow for eligible individual clinicians. Anything outside those routes, including the Business, Plus and Free plans, has no BAA.

Why ChatGPT Business is not enough

This is the trap we see most. ChatGPT Business, the plan once called Team, feels like the responsible choice. It is a paid workspace with admin controls, and OpenAI does not train on Business data by default. Many practice managers reasonably assume that makes it safe for patient work. It does not. OpenAI's help article states that it does not offer a BAA for ChatGPT Business. Not training on your data is a privacy setting, not a HIPAA contract. If your practice is on Business and staff paste in anything from a patient record, you have the same problem as if they used a free account.

What about ChatGPT for Clinicians?

OpenAI lists ChatGPT for Clinicians as a separate product where eligible individual clinicians can accept a BAA inside the product. It is aimed at individual practitioners rather than whole organizations. If you are a solo therapist or a clinician working alone, it may be the simplest route, but check who qualifies and exactly what the BAA covers inside the product before you rely on it. Only the account that accepted the BAA is covered. A colleague on a personal ChatGPT login is not.

The API route, in plain terms

Most small practices never touch the OpenAI API directly. They meet it through software built on top of it: an AI scribe, an intake form tool or a patient messaging product. In that setup there are two agreements that matter. The software vendor needs a BAA with OpenAI, and your practice needs a BAA with the software vendor. Ask the vendor for both in writing. OpenAI also says that accepting a BAA does not by itself make an application HIPAA compliant, and that only certain API services are eligible for PHI, so a good vendor should be able to tell you which features they use and how they are configured. One detail worth knowing: once HIPAA support is enabled for an API organization, it cannot be switched off in the settings.

Signing the BAA is step one

A BAA moves responsibility onto paper. It does not configure anything. After it is signed, a practice still needs to decide who gets access, turn on the right workspace settings, and set out what staff may and may not enter. HIPAA's minimum necessary standard still applies, so staff should share only what a task needs. You also need a record: which tools are approved, for what data, and proof that each person read the rules. That record is what you will want to show if a patient, an insurer or an auditor ever asks how AI is used in your practice.

How ChatGPT compares with other AI tools

OpenAI is not unusual here. Nearly every AI vendor that offers a BAA ties it to a business, enterprise or API account. Anthropic signs one for Claude Enterprise and its API once the BAA is accepted, Microsoft includes one for Microsoft 365 Copilot on commercial plans through its Data Protection Addendum, and Google covers the Gemini app and Gemini in Workspace once a Workspace admin accepts its BAA. Others, like Notion AI, are harder to pin down. Our HIPAA-compliant AI tools table shows every tool we track, which plan carries the BAA, the vendor page and the date we checked.

What to tell your staff this week

Keep it to three rules. First, no patient information goes into a personal or free ChatGPT account, or into ChatGPT Business. Second, if the practice needs ChatGPT for clinical or admin work involving PHI, use only an account covered by a signed BAA. Third, write the rules down and get each person to confirm they have read them. Our free healthcare AI policy preset drafts the rules in a few minutes. The HIPAA AI Kit adds your approved tools, staff sign-off and a printable record for $99, paid once. This is guidance, not legal advice, so have your own advisor review the policy before you adopt it.