Is ChatGPT HIPAA Compliant? What Healthcare Teams Need to Know

Can healthcare staff put patient information into ChatGPT?

Not into consumer ChatGPT. Clinicians are using AI widely: in the AMA's 2026 survey, 81% of physicians said they use AI professionally, and 86% said data privacy is critical for broader adoption.¹ The question is which tools are allowed to touch protected health information (PHI).

Under HIPAA, a vendor that creates, receives, maintains or transmits PHI on behalf of a covered entity is a business associate, and the covered entity needs satisfactory written assurances, a business associate agreement (BAA), before sharing PHI with it.² HHS's cloud computing guidance adds that a cloud provider that stores or processes electronic PHI is a business associate even if it cannot actually view the data, and that using one without a BAA puts the covered entity in violation of the HIPAA Rules.³

So the first question for any AI tool is simple: will the vendor sign a BAA for this specific product?

Which ChatGPT products will OpenAI sign a BAA for?

Only specific products and configurations. Here is what OpenAI's help pages list as of late October 2026, including ChatGPT FedRAMP and API FedRAMP, which aren't shown; check the current pages before you decide.

OpenAI's BAA guidance and its list of HIPAA-eligible products are the sources for this table.⁴⁵ Note the fine print: even in eligible workspaces, some features fall outside the BAA, including improved memory, event-triggered scheduled tasks, and internet access in Canvas and code blocks, and OpenAI says features not listed are not automatically covered.⁵ The clinicians' product offers an individual BAA; for a BAA that covers multiple users, OpenAI points to ChatGPT for Healthcare.⁶

Does a BAA make ChatGPT HIPAA compliant?

No. A BAA is required, but it sets the vendor's obligations. OpenAI itself says a BAA does not, by itself, make your application HIPAA compliant.⁴

Your organization still owns its HIPAA duties: a risk analysis that covers the AI tool, access controls, the minimum necessary standard, workforce training, and policies on what may be entered and who reviews the output. A tool that is covered by a BAA but used carelessly is still a risk.

What about Microsoft Copilot, Google Gemini and Claude?

The major vendors each offer BAAs for some products, not all. In their own documentation:

• Microsoft: its HIPAA BAA is available by default through the Microsoft Online Services Data Protection Addendum, and Microsoft lists Microsoft Copilot and Microsoft Copilot Chat among in-scope Office 365 commercial services.⁷
• Google: its Google Cloud BAA covers listed Google Workspace services, including the Gemini app (excluding Gemini in Google Chrome) and Gemini in Google Workspace, plus listed Google Cloud generative AI services such as Gemini Enterprise.⁸
• Anthropic: it provides a BAA for its HIPAA-ready services, such as its first-party API and Enterprise plans, with listed exclusions such as beta features.⁹

The pattern is similar across these vendors: coverage depends on the product, the plan and sometimes the feature. Get the specific product and configuration confirmed in writing.

Can you use AI with de-identified data instead?

Yes, if the data is truly de-identified. HHS recognizes two methods, Expert Determination and Safe Harbor, and the Safe Harbor method requires removing 18 types of identifiers and having no actual knowledge that what remains could identify the patient. HIPAA does not restrict the use or disclosure of properly de-identified health information.¹⁰

Be careful with free-text clinical notes and documents. Names, dates and other identifiers hide in narrative text, and staff copying and pasting under time pressure can miss some. De-identification works best as a designed step in a workflow.

What other rules apply to AI in healthcare?

Three are worth knowing alongside HIPAA: a pending Security Rule update, Section 1557's rule on decision support tools, and state laws such as California's AB 3030.

• HIPAA Security Rule update: HHS proposed major changes in January 2025. The current rule remains in effect while HHS finalizes it, and the 2026 Unified Agenda lists it under long-term actions with a target final action date of July 2027.¹¹
• Section 1557 nondiscrimination: covered entities (defined differently from HIPAA) must not discriminate through the use of patient care decision support tools. Since May 1, 2025, they must also make reasonable efforts to identify tools that use race, color, national origin, sex, age or disability as inputs, and to mitigate the risk of discrimination, under 45 CFR 92.210.¹²
• State laws: in California, since January 1, 2025, health facilities, clinics and physician offices that use generative AI to communicate patient clinical information must include a prominent AI notice and instructions for reaching a human, unless a licensed or certified provider read and reviewed the message.¹³

This is general information, not legal advice. Your compliance officer and counsel should confirm how these rules apply to your organization.

What should a healthcare team do before using ChatGPT with patient information?

Treat an AI tool like any other vendor that touches PHI, then add the AI-specific checks.

1. Confirm the BAA covers the exact product and features you plan to use, in writing.
2. Ban PHI in consumer and other non-covered accounts, and give staff an approved alternative so they aren't tempted.
3. Update your risk analysis to include the AI tool, its data flows and its retention settings.
4. Apply minimum necessary: share only the PHI the task requires.
5. Have a clinician or qualified staff member review output before it reaches a patient or the record.
6. Train staff and log use, so you can show who used what, and how.
7. Check state rules, such as California's notice requirement for AI-generated patient clinical communications.

When does a healthcare organization need more than ChatGPT?

When the work has to happen inside your own systems, such as the EHR, scheduling or billing, rather than in a chat window. Work like prior authorization packets and patient intake is a good example: the value comes from pulling the right records together and routing them for review.

Soren AI works with healthcare organizations and signs business associate agreements. Our engineers build AI into the systems a team already uses, and we've shipped cloud, on-premises and hybrid deployments. People stay in control of approvals and decisions, with a human in the loop. More on how we work. For the parallel questions law firms face, see whether lawyers can use ChatGPT with client documents.