Last verified: October 2026, against Grammarly's compliance FAQ, support center and acceptable use policy. General information, not legal advice — confirm with your compliance officer or attorney.
Is Grammarly HIPAA compliant? Grammarly says yes, with a catch most practices miss: it signs a business associate agreement (BAA) only for Grammarly for Business Enterprise plans, and its own policy forbids patient data in any account without one. The free extension that a receptionist installed to tidy up emails is not covered. Because a browser extension sees every text box, that includes the EHR, the patient portal and webmail.
Short answer from Grammarly's documentation
Short answer (verified October 2026): Grammarly's compliance FAQ (opens in a new tab) answers "Yes, Grammarly is HIPAA compliant," and adds that you must not process PHI through its services "unless you have entered into a current Business Associate Agreement with Grammarly." Its support center (opens in a new tab) says "we can enter into BAAs only for Grammarly for Business Enterprise plans," requested through sales. Free and Pro accounts have no BAA.
Grammarly is now part of Superhuman. Its acceptable use policy (opens in a new tab), effective October 29, 2025, names "a current Business Associate Agreement with Superhuman" as the condition for handling PHI.
What a writing assistant can see in a browser
A writing-assistant extension works by reading what you type so it can suggest changes. In a practice, staff type patient information all day: visit notes in the EHR, replies in the patient portal, referral emails, insurance appeals.
Grammarly's privacy and security FAQ (opens in a new tab) says the extension is blocked from "sensitive fields" such as payment, password and address entries, but only "on a best-efforts basis." Clinical note fields aren't on that list. It also says "All components that process your data operate in Grammarly's private network," which means the text leaves your computer to be checked.
That is the HIPAA question in one line: a vendor is receiving patient information for your practice. The HIPAA Security Rule expects you to know where that happens and to control it.
Plans, BAAs and admin controls
| Grammarly plan | BAA available? | What it means for a practice |
|---|---|---|
| Free | No | Keep it off every computer that touches patient information |
| Pro (individual) | No | Same; a personal subscription is not a practice account |
| Business | No | Admin console, but no BAA |
| Grammarly for Business Enterprise | Yes, through sales | Get the covered features in writing |
Grammarly's pages don't say which features an Enterprise BAA covers, such as the browser extension, desktop app or generative AI. Ask before you sign. Team admins can also manage accounts, roles and SAML single sign-on, which lets you remove a departing employee's access in one place.
Turning it off where PHI lives: EHR, email, portals
If you don't have an Enterprise BAA, keep Grammarly away from anywhere patient information is typed.
One computer at a time. Grammarly's help article (opens in a new tab) says to open the site, click the Grammarly icon in the browser toolbar and turn off "Allow extension to check text on…" for that site. Do it for:
- your EHR or practice-management system,
- webmail (Gmail, Outlook on the web),
- the patient portal and secure messaging,
- billing and clearinghouse sites.
Every computer at once. User toggles are easy to undo. A managed browser is sturdier. Google's Chrome Enterprise policy guide (opens in a new tab) explains that the ExtensionSettings policy can block or force-install extensions, and runtime_blocked_hosts stops extensions from interacting with the sites you list. Your IT provider can block Grammarly outright, or allow it everywhere except your EHR and email domains.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Rules for AI rewrite and compose features
Generative features send your text to AI models to draft or rewrite it. Grammarly's privacy FAQ says prompt data goes to a small number of vetted service providers, and that it does not allow those large language model providers "to train their models on user content." Grammarly itself may use aggregated, de-identified samples to improve its product unless you turn off "Product Improvement and Training," per its trust page (opens in a new tab).
Team admins can switch generative AI off for everyone: Organization > Feature access, then turn off AI assistant, Strategic suggestions and Paragraph-level rewrites (Grammarly (opens in a new tab)). If staff want AI drafting, route them to a tool your practice has covered; HIPAA-compliant AI compares the options, and practices on Microsoft 365 should read Copilot and HIPAA. Practices on Google can check Google Workspace and HIPAA, which covers Gemini's place in Google's BAA.
A staff rule set that fits on one page:
- Approved tools list. Name the writing and AI tools staff may use, and on which sites.
- No personal accounts on work devices. Personal Grammarly, ChatGPT or browser profiles stay off practice computers.
- Quarterly review. Check installed extensions and admin settings every three months; add it to your HIPAA compliance checklist.
Medfy keeps its own writing work away from patient data: SEO articles are drafted from MedlinePlus and PubMed and approved by the practice, and patient information from Medfy forms is stored in separate, encrypted HIPAA databases in the US or Canada. See Medfy's patient-data safeguards, run a free marketing audit, or check other tools in HIPAA-compliant software.
Frequently asked questions
Does Grammarly sign a BAA?
Yes, but only for Grammarly for Business Enterprise plans, according to Grammarly's support center. You request it through Grammarly's sales team. Its acceptable use policy bars processing protected health information without a current BAA, which Grammarly's parent company Superhuman now signs. Free, Pro and other plans aren't covered. Confirm the scope of any BAA with your compliance officer or attorney.
Can staff use Grammarly in the EHR?
Only under a Grammarly Enterprise account with a signed BAA, and many practices still choose to block it there. A browser extension can read clinical notes, portal messages and patient emails as staff type. Without an Enterprise BAA, turn Grammarly off on the EHR, email and portal sites, ideally through managed browser policy. Agree the rule with your compliance officer or attorney.
Is the free Grammarly extension HIPAA compliant?
No. Grammarly enters into BAAs only for Grammarly for Business Enterprise plans, and its acceptable use policy says not to process protected health information without one. A free extension installed on a front-desk computer can read anything typed into a web page, including patient details. Remove it or block it on patient-facing sites, and check your device policy with your compliance officer.
How do we control browser extensions on practice computers?
Manage the browser centrally. On managed Chrome, the ExtensionSettings policy can block, allow or force-install extensions, and runtime_blocked_hosts stops extensions from touching listed sites such as your EHR and webmail. Keep a short approved-extensions list, stop personal browser profiles on work computers, and review installed extensions each quarter. Confirm the policy with your IT provider and compliance officer.