Is ChatGPT HIPAA compliant?

Which ChatGPT products can handle PHI

• ChatGPT for Healthcare, ChatGPT for Clinicians and ChatGPT Enterprise or Edu with the Regulated Workspace are Eligible Services when the BAA names them, per OpenAI's HIPAA Guide posted July 9, 2026.
• Consumer plans such as ChatGPT Free, Plus and Pro, and ChatGPT Business, are not Eligible Services, per the same guide, so protected health information can't go into them.
• The OpenAI API can process PHI only when the BAA names the API as an Eligible Service, and the July 9, 2026 guide says that currently requires the account to be set up for Modified Retention.
• Web search with live internet access is not HIPAA eligible and is not covered by a BAA, per OpenAI's API data controls page checked Oct. 28, 2026.

What HIPAA asks of an AI vendor

A vendor that creates, receives, maintains or transmits protected health information for a covered entity is a business associate, under the HIPAA definition in 45 CFR 160.103, checked Oct. 28, 2026.

A covered entity may share PHI with a business associate only after getting satisfactory assurance the vendor will safeguard it, and that assurance must be documented in a written contract, under 45 CFR 164.502(e), checked Oct. 28, 2026. That contract is the BAA.

What stays your job after the BAA

1. Check that your contract names the exact product your team uses as an Eligible Service.
2. Keep PHI out of user names, email addresses, workspace names and support tickets, which OpenAI's HIPAA Guide of July 9, 2026 lists as PHI-prohibited fields.
3. Keep early access features away from PHI. The same guide says they do not support HIPAA compliance.
4. Set retention and deletion yourself. The guide says OpenAI keeps ChatGPT customer content for the term of the agreement unless a user deletes it or you set a shorter period.
5. Run your own risk analysis. The guide says following it does not ensure compliance with your HIPAA obligations.

Sources

1. HIPAA Implementation and Configuration Guide · OpenAI, July 9, 2026Supports: Which ChatGPT and API services are eligible under a BAA, the Modified Retention requirement, PHI-prohibited fields, retention and the customer's duties.
2. Data controls in the OpenAI platform · OpenAI, Oct. 28, 2026Supports: Checked Oct. 28, 2026: web search with live internet access is not HIPAA eligible or covered by a BAA.
3. 45 CFR 160.103, Definitions (Business associate) · U.S. Department of Health and Human Services, via eCFR, Oct. 28, 2026Supports: Checked Oct. 28, 2026: the HIPAA definition of a business associate.
4. 45 CFR 164.502(e), Disclosures to business associates · U.S. Department of Health and Human Services, via eCFR, Oct. 28, 2026Supports: Checked Oct. 28, 2026: the rule that disclosures to a business associate need satisfactory assurance documented in a written contract.

Related questions

• Is Claude HIPAA compliant?
• Is ChatGPT confidential?
• What is an AI governance framework?

General information, not legal advice.

Intrica helps AI companies get found in Google and named in AI answers. SEO and AI search for AI companies →