Last verified: October 2026, against OpenAI's own help center and privacy pages. General information, not legal advice — confirm with your compliance officer or attorney.
Is ChatGPT HIPAA compliant? Some versions can be used with patient information, but only after your practice signs a business associate agreement (BAA) with OpenAI, and the versions most staff already have are not among them. Here is what OpenAI's documentation says today and how to use ChatGPT without putting protected health information (PHI) at risk.
Short answer (dated) from OpenAI's own terms
Short answer (verified October 2026): OpenAI signs a BAA only for the products on its HIPAA eligible products list (opens in a new tab): ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT FedRAMP, ChatGPT for Clinicians, the API with Modified Retention and API FedRAMP with Modified Retention. Free, Plus, Pro and ChatGPT Business are not on it, and OpenAI's BAA article (opens in a new tab) states that it doesn't offer a BAA for ChatGPT Business. Even under a BAA, PHI belongs only in the features the BAA covers.
So the honest answer for a typical practice is no: the ChatGPT account on the front-desk computer is almost certainly a consumer or Business plan, and neither may hold patient information.
Consumer ChatGPT vs business plans vs the API
OpenAI runs three families of products, and the HIPAA answer changes across them. Staff search "openai baa" about 210 times a month, "chatgpt hipaa" 170, "chatgpt baa" 70 and "is chatgpt enterprise hipaa compliant" 40 (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026). The table answers all four.
| Product | Trains on your content by default? | BAA available? |
|---|---|---|
| ChatGPT Free, Plus, Pro | May, unless you opt out | No |
| ChatGPT Business | No | No |
| ChatGPT Enterprise with Regulated Workspace, ChatGPT for Healthcare | No | Yes, through OpenAI sales |
| ChatGPT for Clinicians (verified US clinicians) | No | Yes, an individual BAA in the app |
| OpenAI API | No | Yes, with Modified Retention |
On the training column, OpenAI's model-improvement article (opens in a new tab) says content from Free, Plus and Pro "may" be used to train models unless the user turns off "Improve the model for everyone" under Settings > Data controls. Business, Enterprise, Edu and the API are excluded by default.
ChatGPT for Clinicians (opens in a new tab) is free for verified US physicians (MD/DO), nurse practitioners, physician assistants and pharmacists. It is built for individual use. OpenAI points practices that need one BAA for several users, admin controls or central deployment to ChatGPT for Healthcare, which its enterprise privacy page (opens in a new tab) describes as a workspace "designed to support HIPAA compliance."
What OpenAI's BAA covers — and what it doesn't
The BAA covers named features, used from an eligible workspace and enabled for the member's role. OpenAI adds a warning worth copying into your policy: "A feature's availability does not, by itself, determine whether a particular use or connected third-party service is covered by your BAA."
As of October 2026, OpenAI lists these as not covered: improved memory, event-triggered scheduled tasks, Sites, Codex in the cloud and internet access for Work in the cloud, among others. Improved memory and event-triggered tasks are off by default in ChatGPT for Healthcare, and admins should keep them off for anyone who handles PHI. Third-party GPTs and connected apps carry their own terms, and OpenAI tells clinicians not to share PHI with them without the right agreements.
On the API, OpenAI's data controls documentation (opens in a new tab) says web search with live internet access "is not HIPAA eligible and is not covered by a BAA."
A signed BAA also doesn't make every use compliant. HHS still expects you to limit each use of PHI to the minimum necessary rule (HHS guidance (opens in a new tab)). The Security Rule (opens in a new tab) adds role-based access, workforce training and a risk analysis. If what a BAA is is new to your team, start there.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Practice tasks that are safe without PHI
Most marketing and admin writing never needs a patient's details. These are fine on any plan, provided nobody pastes in names, dates of service or screenshots:
- Outlining a new service page, such as "what to expect at your first physical therapy visit."
- Rewriting your cancellation policy or financial policy in plain language.
- Brainstorming ten ad headlines for a flu-shot clinic.
- Drafting a newsletter on seasonal allergies.
- Turning a staff training checklist into a one-page handout.
The practice remains responsible for every medical statement it publishes, whichever tool drafted it. Medfy's own articles are drafted from MedlinePlus and PubMed and approved by the practice before they go live. A free marketing audit shows how your current site and content score.
Tasks that need a BAA-covered setup or a different tool
These all put PHI into the prompt, so they need an eligible product under a signed BAA, or a tool your EHR vendor already covers:
- Replying to a patient email, or summarizing a patient's portal messages.
- Turning dictated visit notes into a SOAP note.
- Reviewing a patient's intake answers.
- Uploading a screenshot of tomorrow's schedule to plan staffing. Names plus appointment times are PHI.
- Drafting a prior authorization letter for a named patient.
In California, a physician's office that uses generative AI to write patient messages about clinical information must add an AI disclaimer and say how to reach a human, unless a licensed provider reviews the message first (Health and Safety Code 1339.75 (opens in a new tab)). Check your own state.
Settings and policies to set before staff use it
- Ban personal accounts for practice work. A BAA covers your organization's workspace, never an employee's own login.
- For non-PHI use on consumer plans, turn off "Improve the model for everyone" and use Temporary chats. OpenAI says thumbs-up or thumbs-down feedback can still send the whole conversation to training on individual plans, so tell staff not to rate responses.
- In an eligible workspace, keep non-covered features off through role-based access, and approve GPTs and connectors one by one.
- Write it down. Name approved tools, banned data and who to ask. The HIPAA-compliant AI guide has a starter policy; is Claude HIPAA compliant and Copilot and HIPAA cover the alternatives.
- Re-check every six months. OpenAI's eligible-feature list changes often.
Patient-facing chat on your website is a separate decision. See HIPAA-compliant website chat, and how Medfy handles patient data if you are weighing Medfy's widget.
Frequently asked questions
Will OpenAI sign a BAA for ChatGPT Plus?
No. Plus isn't on OpenAI's list of HIPAA-eligible products as of October 2026. A verified US physician, nurse practitioner, physician assistant or pharmacist can open a separate, free ChatGPT for Clinicians workspace and sign an individual BAA there. Coverage for several staff members needs ChatGPT for Healthcare or an Enterprise Regulated Workspace. Confirm the choice with your compliance officer or attorney.
Can I use ChatGPT to write patient letters?
Yes, as templates. Draft a recall letter or a post-visit instruction sheet with no names or details, then personalize it inside your EHR or patient messaging tool. Drafting a letter about a specific patient puts PHI into ChatGPT, so it belongs only in a BAA-covered workspace, with only the details the letter needs and a clinician reviewing the result before it goes out.
Is de-identified data safe to paste into ChatGPT?
Only if it meets HIPAA's definition: either an expert determination or the Safe Harbor method, which removes 18 kinds of identifiers and requires no actual knowledge that someone could be identified. Deleting the name isn't enough. Dates, ZIP codes, photos and a rare diagnosis can identify a patient. If you can't say which method you used, treat the text as PHI.
Is the ChatGPT API HIPAA compliant?
The API can be used with PHI once OpenAI has executed a BAA with your organization and provisioned Modified Retention, unless OpenAI specifies otherwise. Requests go to baa@openai.com and are reviewed case by case. Only listed endpoints are eligible, and live web search isn't. Whoever builds your app on the API is also your business associate and needs its own BAA.