Is ChatGPT HIPAA compliant?
Not the version most people use. OpenAI's own HIPAA guide says:
"For clarity, ChatGPT Services for consumers (e.g., Free, Plus, Pro) and ChatGPT Business are not Eligible Services." (OpenAI HIPAA Guide, July 9, 2026)
The rule behind it is HHS's: any cloud service that holds or processes your patients' data needs a Business Associate Agreement (BAA) first.
"If a covered entity (or business associate) uses a CSP to maintain (e.g., to process or store) electronic protected health information (ePHI) without entering into a BAA with the CSP, the covered entity (or business associate) is in violation of the HIPAA Rules." (HHS: HIPAA and Cloud Computing)
A "CSP" is a cloud service provider. ChatGPT is one.
Which OpenAI products come with a BAA
As of November 2026, OpenAI lists these as HIPAA eligible with a BAA (OpenAI Help Center):
| Product | Who it's for | How to get the BAA |
|---|---|---|
| ChatGPT Free, Plus, Pro, Business | Everyone | Not available (OpenAI HIPAA Guide) |
| ChatGPT for Clinicians | One verified US clinician: MD/DO, NP, PA or pharmacist | Sign in-product under Settings > Agreements; free at launch (OpenAI) |
| ChatGPT for Healthcare | Organizations: clinical, admin and support staff | Contact OpenAI sales; priced like ChatGPT Enterprise (OpenAI) |
| ChatGPT Enterprise with Regulated Workspace | Organizations with a sales-managed account | Contact OpenAI sales (OpenAI) |
| OpenAI API with Modified Retention | Software you or a vendor build | Self-serve in the API Platform, once the account has usage history (OpenAI) |
ChatGPT for Clinicians covers one person. For a BAA covering several staff, OpenAI points you to ChatGPT for Healthcare (OpenAI), where OpenAI tells "large hospitals and health systems" to contact sales (OpenAI). Dentists, therapists, chiropractors and front-desk staff are not on the Clinicians eligible list. For most small clinics, the realistic route is a vendor whose product carries its own BAA.
A BAA is not the finish line
Even with a BAA, some features are excluded. OpenAI lists improved memory and event-triggered scheduled tasks as not covered, and says features not on its covered list "are not automatically covered under the BAA" (OpenAI Help Center).
"Accepting a BAA and enabling HIPAA compliance support do not, by themselves, make your application HIPAA compliant." (OpenAI Help Center)
Before staff use it with patient data, check:
- The BAA names the exact product your staff log into.
- Uncovered features are switched off for those staff.
- Third-party GPTs and connected apps get no patient data unless they have their own agreement (OpenAI).
- Your HIPAA risk analysis lists the tool.
Can I paste a message if I remove the name?
Only if the text is truly de-identified. Under HHS's Safe Harbor method, you remove 18 kinds of identifiers, including names, street address, city and ZIP code, every date element except the year, phone numbers and email addresses (HHS: De-identification). A patient message with a first name, an appointment date or a phone number still counts as patient data. In practice, safe uses of regular ChatGPT are ones with no patient in them: a template reply, a policy draft, a blog post.
HIPAA compliant AI note taker, AI receptionist or texting app
The same test applies to every tool that touches patient information: will the vendor sign a BAA covering the product you use? A vendor that creates, receives, keeps or sends patient data for you is a "business associate," and HHS requires that written agreement before you share it (HHS: Business Associates). If the tool runs on OpenAI's API, OpenAI says API use with patient data "requires an executed OpenAI BAA" (OpenAI), so ask the vendor whether it has one. Then sign the vendor's own BAA with your practice.
A "HIPAA compliant" badge on a website is not a BAA. HHS does not certify products: "OCR does not endorse, certify, or recommend specific technology or products" (HHS).
Does HIPAA even apply to my practice?
It applies to health care providers, including clinics, psychologists, dentists and chiropractors, "but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard" (HHS: Covered Entities). Sending insurance claims electronically, yourself or through a billing service, is such a transaction (HHS: Privacy Rule summary).
Canada is different. HIPAA is a US law. In Canada, health information falls under provincial health privacy laws; Ontario, New Brunswick, Newfoundland and Labrador and Nova Scotia have health privacy laws declared substantially similar to the federal PIPEDA, and other provinces have their own (Office of the Privacy Commissioner of Canada). ChatGPT for Clinicians is US-only at launch (OpenAI).
Example
Front desk using ChatGPT Plus to answer portal messages
The receptionist pastes "Maria, 42, rescheduling her Tuesday root canal" into ChatGPT Plus. That is patient data in a product OpenAI says is not eligible. Stop, and switch to templates with no patient details.
A family physician drafting referral letters
She signs up for ChatGPT for Clinicians with her NPI and signs the BAA under Settings > Agreements before entering any chart details. Her two registered nurses aren't on the eligible list; for a BAA covering several staff, the practice would look at ChatGPT for Healthcare.
A dental office buying an AI receptionist at $300 a month
Before go-live, the office gets the vendor's signed BAA naming the product, and confirms the vendor's AI provider is covered too.
Different for you?
- An AI receptionist for a dental office. See AI receptionist for a dental office.
- Tracking pixels on your booking pages. See Meta pixel and Google tags on a clinic website.
- Replying to reviews. See responding to patient reviews without breaking HIPAA.
- Texting patients after a missed call. See missed-call text back consent.
- Turning inquiries into booked visits. See the Conversion agent.