Is Claude HIPAA compliant?

Which Claude products the BAA covers

• Anthropic's BAA covers HIPAA-ready services such as the first-party API, Claude in Microsoft Foundry and Enterprise plans, per its BAA article checked Oct. 28, 2026.
• A standard Enterprise plan has no BAA coverage until the Primary Owner turns on HIPAA in organization settings and accepts the BAA, per the same article.
• Only the Primary Owner can accept the BAA and enable HIPAA on Enterprise, and Anthropic says it can't be reversed from organization settings, per its HIPAA-ready Enterprise article checked Oct. 28, 2026.
• Enabling HIPAA alone doesn't bring Claude Code or Cowork under the BAA, per the same article. A separate configuration covers them in local mode.

What the BAA leaves out

• The Batch API, Files API, Skills API, code execution and web fetch are not covered, per Anthropic's BAA article checked Oct. 28, 2026.
• Use of the Claude Console, Cowork in the cloud and beta features such as Claude Design, Claude Slides and Claude Docs sit outside the BAA, per the same article.
• Data sent to third parties through connectors, MCP servers or Enterprise Search is not covered under Anthropic's BAA, per the same article.
• A HIPAA-enabled API organization gets a 400 error when a request uses a feature that isn't eligible, per Anthropic's API docs checked Oct. 28, 2026.

How to set it up on the API

1. Use a separate organization for PHI. Anthropic's API docs, checked Oct. 28, 2026, say HIPAA readiness applies to the whole organization and can't be turned off once enabled.
2. Accept the standard BAA from the Data retention page in the Claude Console, or ask Anthropic's sales team for a negotiated BAA, per the same docs.
3. Keep PHI in message content. The same docs say not to put PHI in JSON schema definitions, and that workspace names, user details, billing data and support tickets are not expected to hold PHI.
4. Check every feature against the docs' eligibility table before it ships.

What HIPAA asks of an AI vendor

A covered entity may share protected health information with a business associate only after getting satisfactory assurance the vendor will safeguard it, documented in a written contract, under 45 CFR 164.502(e), checked Oct. 28, 2026. Anthropic's BAA is that contract.

Sources

1. Business Associate Agreements (BAA) for Commercial Customers · Anthropic, Oct. 28, 2026Supports: Checked Oct. 28, 2026: which products the BAA covers, how Enterprise and API customers accept it, and the features it excludes.
2. HIPAA-ready Enterprise plans · Anthropic, Oct. 28, 2026Supports: Checked Oct. 28, 2026: only the Primary Owner can enable HIPAA, the change can't be reversed from organization settings, and Team, Free, Pro and Max plans can't enable it.
3. API and data retention · Anthropic, Oct. 28, 2026Supports: Checked Oct. 28, 2026: HIPAA readiness on the Claude API, Console enablement, feature eligibility, the 400 error and PHI handling rules.
4. 45 CFR 164.502(e), Disclosures to business associates · U.S. Department of Health and Human Services, via eCFR, Oct. 28, 2026Supports: Checked Oct. 28, 2026: the rule that disclosures to a business associate need satisfactory assurance documented in a written contract.

Related questions

• Is ChatGPT HIPAA compliant?
• How much does the Claude API cost?
• Is ChatGPT confidential?

General information, not legal advice.

Intrica helps AI companies get found in Google and named in AI answers. SEO and AI search for AI companies →