Is ChatGPT HIPAA Compliant? What You Can Paste (2026)

Is ChatGPT HIPAA compliant?

We have not verified BAA coverage for any ChatGPT plan. That is a finding about the pages we could read, not proof that OpenAI cannot offer a BAA.

Under 45 CFR 160.103, a business associate creates, receives, maintains or transmits PHI on behalf of a covered entity for a regulated function, or provides certain services involving PHI. An AI vendor receiving PHI falls within that relationship.

Under 45 CFR 164.502(e), the covered entity must obtain satisfactory assurance, through a BAA, that the business associate will safeguard the information. Before sending PHI, ask whether your organization has a BAA covering the service and feature you intend to use.

A training statement does not answer that question. OpenAI’s pricing documentation says “No training on your business data by default” for ChatGPT Business and lists “Data retention and data residency controls” for Enterprise and Edu. Those statements do not establish BAA coverage. The readable page says nothing about a BAA; OpenAI’s help-center BAA article was blocked to our access.

Microsoft’s compliance page also states that there is no HHS-approved certification proving HIPAA compliance. Check the agreement and its scope rather than relying on a compliance label. For product context, see our ChatGPT overview for professionals.

Which assistants state a BAA on their own pages?

Anthropic describes BAA coverage for HIPAA-ready services, and Microsoft lists Copilot services within its enterprise compliance scope. OpenAI’s readable pricing documentation does not establish ChatGPT BAA coverage.

Vendor BAA and HIPAA statements checked 2026-10-20.

Anthropic also names its first-party API and Claude in Microsoft Foundry as HIPAA-ready services covered by its BAA. Its commercial BAA article directs Claude Free, Pro and Max users to a separate article; do not infer consumer-plan coverage from the commercial article.

For budgeting, Claude Enterprise is $20 per user per month billed annually, plus usage at API rates, with a 20-seat minimum. The Microsoft 365 Copilot enterprise add-on is $30 per user per month billed annually, or $31.50 per user per month paid monthly on an annual commitment; it requires a qualifying Microsoft 365 plan. ChatGPT Business and Enterprise: price not verified.

These are USD list prices excluding tax, checked 2026-10-19. Readers in the UK, Australia and India should check locally because prices, taxes and rules differ.

We have not verified the vendors’ broader data/privacy terms beyond the statements quoted here. Read the relevant plan terms and your professional confidentiality rules before pasting patient, client or employee data.

What can you paste into ChatGPT without a verified BAA?

For patient-related work, use only information de-identified under 45 CFR 164.514(b), subject to your organization’s approval. Removing a name alone does not satisfy that standard.

The rule provides two routes: a qualified expert determines and documents that re-identification risk is very small, or the Safe Harbor method applies. Safe Harbor requires removing the following 18 categories for the individual and their relatives, employers or household members. The covered entity must also have no actual knowledge that the remaining information could identify the individual.

1. Names.
2. Geographic subdivisions smaller than a state: street address, city, county, precinct and ZIP code. The first three ZIP digits may remain only if that area has more than 20,000 people.
3. All elements of dates except year directly related to the individual, including birth, admission, discharge and death dates, and all ages over 89.
4. Telephone numbers.
5. Fax numbers.
6. Email addresses.
7. Social Security numbers.
8. Medical record numbers.
9. Health plan beneficiary numbers.
10. Account numbers.
11. Certificate or license numbers.
12. Vehicle identifiers and serial numbers, including license plates.
13. Device identifiers and serial numbers.
14. Web URLs.
15. IP addresses.
16. Biometric identifiers, including finger and voice prints.
17. Full-face photographs and comparable images.
18. Any other unique identifying number, characteristic or code.

Use this as a paste-checklist, including identifiers embedded in narrative text. Do not stop after removing demographic fields.

The final category and the actual-knowledge condition require judgment. Review distinctive clinical, occupational or geographic details together, not just individually. If the covered entity has actual knowledge that the remaining information could identify the person, the Safe Harbor condition is not met. Ask your privacy officer when that assessment is uncertain.

How do you de-identify a note before pasting it?

Remove identifiers within your organization’s approved environment before sending text to an assistant without a verified BAA. Never submit PHI to such a chatbot to have it perform the initial removal: that submission itself discloses the information.

Use this routine:

1. Prepare the excerpt in an approved environment before opening the assistant.
2. Review every checklist category, replacing identifiers with placeholders such as [PATIENT], [DATE] and [MRN].
3. Review the remaining narrative for distinctive details and combinations that could identify someone.
4. Resolve uncertainty with your privacy officer before uploading anything.
5. Paste only the de-identified material needed for the task, after checking the plan’s data/privacy terms.

The prompt below is an optional second review of text already de-identified, not a way to make PHI suitable for upload. It has not been tested in our benchmark and cannot establish that the regulatory standard is met.

Review this clinical excerpt, which I have ALREADY de-identified before submitting it.

Check for these HIPAA Safe Harbor identifier categories:
names; geographic subdivisions smaller than a state; dates other than year and ages over 89; telephone numbers; fax numbers; email addresses; Social Security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate or license numbers; vehicle identifiers and serial numbers; device identifiers and serial numbers; web URLs; IP addresses; biometric identifiers; full-face photographs and comparable images; any other unique identifying number, characteristic or code.

Consider identifiers of the individual and their relatives, employers or household members.

- Flag possible remaining identifiers without repeating their exact values.
- Name the category and describe where the concern appears.
- Flag distinctive details or combinations that warrant privacy review.
- Do not infer the person's identity.
- Do not add clinical findings or rewrite the clinical content.
- Do not certify the text as de-identified or safe to upload.
- If you find no concerns, say that this does not establish compliance.

Excerpt:
[PASTE ONLY TEXT ALREADY DE-IDENTIFIED AND APPROVED FOR THIS USE]

If the assistant flags a concern, stop the downstream task and ask your privacy officer how to proceed. Do not treat a clean response as clearance.

For drafting resources after the input review, consult our healthcare prompt library. Keep privacy review separate from clinical review: de-identification does not establish that a generated note or handout is accurate.

What should a practice do before anyone pastes a note?

Choose the permitted workflow, verify the agreement and document the input rules before staff use patient information. Use these steps as a discussion checklist with your privacy officer.

1. Define the tasks, such as note drafting, patient handouts or documentation queries, and the information each needs.
2. Decide whether each workflow uses PHI under an applicable BAA or only de-identified text.
3. Obtain and review the agreement. For Claude Enterprise, confirm Primary Owner activation and BAA acceptance. For Microsoft, confirm the applicable agreement and in-scope service. For ChatGPT, obtain terms directly because we could not verify them.
4. Record the approved tool, plan, features, permitted inputs and person responsible for reviewing output.
5. Train staff using the identifier checklist, and arrange review of the workflow.

Our drafting results do not answer the compliance question. In testing on 2026-10-19, Claude Opus 5.5, Claude Sonnet 5 and GPT-6 Astra each passed all 5 criteria in 3 of 3 runs for both the de-identified SOAP-note prompt and the non-leading CDI query. Claude Fable 5.1 and Gemini 4 Argon, added on 2026-10-20 with the same prompts and rubrics, did the same on the English SOAP-note and CDI prompts.

Across round-1 healthcare prompts, criteria passed were 89% for Claude Opus 5.5, 92% for Claude Sonnet 5 and 97% for GPT-6 Astra. Claude Fable 5.1 and Gemini 4 Argon, graded by the same judge as Opus and Sonnet (gpt-6-astra), passed 89% and 91%. The Claude models and GPT ran as API calls through a command-line harness with tools, web and memory off, while Gemini 4 Argon ran through Google’s Antigravity CLI with a tool-less agent; none were consumer-app tests, and app results may differ.

The judges were not equally strict. In round-1 calibration, Claude outputs passed 93% with the published judge and 98% with the swap judge; GPT outputs passed 97% with either judge, with claude-opus-5-5 as the published judge and gpt-6-astra as the swap judge. For Claude Fable 5.1 and Gemini 4 Argon (10 sampled runs each), scores were respectively 88% and 92% with published judge gpt-6-astra, versus 100% and 98% with swap judge claude-opus-5-5. Part of the Claude-versus-GPT gap therefore comes from grading, not the model. These scores do not establish overall superiority or professional sign-off. See the methodology for the evaluation approach.

Limits: This is not legal, medical or compliance advice. Have your privacy officer and, where needed, a licensed attorney in your jurisdiction check organizational status, permitted disclosures, de-identification and BAA scope. A licensed clinician must review clinical output before it enters a chart or reaches a patient. Our healthcare guide provides broader workflow context, not approval for your organization’s use.

FAQ