Is ChatGPT HIPAA compliant?
It depends on the product and on whether a signed BAA covers the features you use. Here is what HHS and OpenAI say.
It depends on the product, not the brand. HHS/OCR states it does not endorse, certify, or recommend specific technology or products, so there is no official "HIPAA compliant" label to look for. The real questions are whether the company will sign a business associate agreement (BAA), and whether that BAA covers the exact product and features you use.
OpenAI lists six products as HIPAA eligible with a BAA. The standard ChatGPT Free, Go, Plus, and Pro plans are not on OpenAI's HIPAA eligible product list. ChatGPT for Clinicians is a separate product with its own BAA process, covered below.
Why the BAA decides it
HIPAA expects a clinic to have a BAA in place before it shares patient information with a business associate. HHS lists a third party AI chatbot that handles PHI on a provider's patient portal, for things like symptom questions, reminders, and scheduling, as an example of a business associate. Our BAA guide explains how that works.
Our rule of thumb: if you would need a BAA with a billing company that sees certain information, you need one with an AI company that sees the same information.
Which OpenAI products have a BAA
OpenAI's help page names these as HIPAA eligible:
- ChatGPT for Healthcare
- ChatGPT for Enterprise with Regulated Workspace
- ChatGPT FedRAMP
- ChatGPT for Clinicians
- OpenAI API with Modified Retention
- OpenAI API FedRAMP with Modified Retention
OpenAI describes ChatGPT for Healthcare as an enterprise version built for clinicians, administrators, and researchers, with enterprise security controls, no training on your data, and data retention controls. For access, it points large hospitals and health systems to its sales team. Check OpenAI's current terms to see which product fits a small practice.
ChatGPT for Clinicians is a different product from the standard ChatGPT plans. OpenAI describes it as a version for verified clinicians in the United States, designed for individual use, where an eligible clinician reviews and signs the BAA for that workspace. For a BAA that covers multiple users, or for admin controls, OpenAI points to ChatGPT for Healthcare. A BAA on a Clinicians workspace does not cover the same person's regular ChatGPT account.
A BAA does not cover every feature
This is the detail most people miss. OpenAI says some functions are not covered by the BAA, and PHI should not be entered when using them. Two examples from its list:
- Improved memory, which uses context from a person's past chats. It is off by default.
- Event triggered scheduled tasks, which respond to activity in connected apps. These are off by default in ChatGPT for Healthcare.
OpenAI also says features it does not list are not automatically covered. So even with a BAA, check each feature before your team turns it on.
"I'll just take the patient's name out"
That is not enough. HHS describes two accepted ways to strip identifying details from health information. One of them, called Safe Harbor, requires removing many identifiers, including:
- Names
- Anything smaller than a state, such as a street address, city, county, or ZIP code (with a narrow exception for the first three digits of a ZIP code)
- Every part of a date except the year, including admission and discharge dates
- Dates tied to lab results. HHS says dates associated with test measures, such as those from a laboratory report, are directly related to the patient and cannot be kept under Safe Harbor, apart from the year
A note that says "seen on March 3, ZIP 33701" still has identifiers in it.
What you can do today
Use any AI tool freely for work that involves no patient information. That might be drafting a job post, outlining a staff training, or explaining a billing term in general. Check what it writes before you use it.
For anything with patient information, ask three questions:
- Is there a signed BAA with the maker of this exact product?
- Does that BAA cover the features we are using?
- Does our team know which features are off limits?
If any answer is no, leave patient information out.
What we do
Where AI helps with a clinic's workflow, we scope it with the clinic first. It runs in the clinic's own cloud account under a BAA, and patient information does not go into consumer AI tools. See Security and Compliance.
This guide is general information, not legal advice. Your compliance adviser can confirm what applies to your practice.