Is ChatGPT HIPAA compliant?

Yes

OpenAI · AI assistants

Yes. OpenAI will sign a Business Associate Agreement (BAA) for ChatGPT, usually on an enterprise plan, which is the baseline requirement for handling PHI.

What we checked

This assessment separates the consumer product from any business plan. It uses the vendor documents linked below; an unverified item is not a pass.

Business Associate Agreement: Confirmed; OpenAI publishes a BAA option. Confirm the exact plan and service are covered before sending PHI.
Enterprise route: ChatGPT Enterprise; For regulated use, validate the BAA, configured service and users under the ChatGPT Enterprise contract.
Default data training: Opt-out required; On free/Plus consumer ChatGPT, conversations are used to improve models by default unless you turn off 'Improve the model for everyone' in data controls.
Business-tier training: No by default; OpenAI does not train on inputs or outputs from ChatGPT Team, ChatGPT Enterprise, or the API platform by default.

Practical risk: Consumer/free ChatGPT uses your chats for training unless you proactively disable it, so staff pasting work data into personal accounts can leak it into model improvement.

How to make a decision

Check the precise account tier, written contract and intended data before approving ChatGPT. A security certification, DPA or setting can apply to only part of a vendor's service. Keep the source links with your supplier review and revisit them when the vendor changes its terms.

More on ChatGPT

Is ChatGPT GDPR compliant?Is ChatGPT SOC 2 compliant?Is ChatGPT ISO 27001 certified?Does ChatGPT train on your data?

See the full ChatGPT risk profile, with every data-handling fact and its source, or browse all rated AI tools.