Is ChatGPT HIPAA compliant? The consumer version is not something you should put protected health information into. OpenAI has stated that it can sign Business Associate Agreements for certain business and API offerings under specific conditions, but a BAA is only one piece, and you should verify the current terms directly with OpenAI.
This is general information, not legal advice, and it reflects what was publicly stated as of October 2026. Terms, products, and eligibility change. Treat this post as a map of the questions to ask, then confirm the answers with OpenAI and your compliance advisor before any patient data touches an AI tool.
First, What "HIPAA Compliant" Actually Means
No software product is "HIPAA compliant" by itself. HIPAA applies to covered entities (such as providers and health plans) and their business associates. A tool can support your compliance, but compliance is about how you use it, what agreements are in place, and what safeguards surround it.
Whenever a vendor will create, receive, store, or transmit protected health information (PHI) on your behalf, HIPAA generally expects a signed Business Associate Agreement (BAA) with that vendor, plus appropriate administrative, technical, and physical safeguards. Without a BAA in place, sharing PHI with the vendor is a problem no matter how secure the product claims to be.
Where ChatGPT Stands
- Consumer ChatGPT (free and individual paid plans). Do not enter PHI. These plans are not set up for HIPAA workloads, and a standard consumer account does not come with a BAA.
- Business and enterprise offerings, and the API. As of October 2026, OpenAI has stated publicly that it can enter into BAAs for certain business and API offerings, generally under specific conditions such as eligibility review and particular configurations. Which products qualify, and on what terms, is something to confirm directly with OpenAI rather than assume.
- Anything in between. A teammate pasting a patient note into a personal account is the common failure. A policy and a technical control should prevent it.
Because these terms are time-sensitive and can change, do not rely on this post, a forum thread, or a salesperson's offhand answer. Get the current BAA terms and product eligibility in writing from OpenAI, and have your compliance advisor or counsel review them.
A BAA Is Necessary, Not Sufficient
Even where a BAA is available, signing it does not make a workflow safe. A BAA is a contract. The safeguards still have to exist, and you still have to configure and use the tool correctly. A chat window where staff paste information is a very different risk than a system built so staff never have to.
What a HIPAA-Ready AI System Needs
Whether you use ChatGPT's business offerings or any other model, these are the questions to ask about the full system around it.
| Requirement | What to look for |
|---|---|
| Business Associate Agreement | Signed with every vendor that touches PHI, including the model provider and any hosting or messaging layer |
| Encryption | In transit and at rest, for messages, recordings, transcripts, and stored files |
| Access control | Role-based access, unique logins, and the ability to remove access when someone leaves |
| Audit logs | A record of who accessed or changed what, and when |
| Minimum necessary | Only the data needed for the task is sent to the model; unrelated PHI stays out |
| Retention and training | Clear terms on how long data is kept and whether it is used to train models |
| Staff policy and training | Written rules on which tools are approved, and training so no one improvises |
The Minimum Necessary Principle in Practice
Many practical AI uses do not need PHI to reach a model at all. A system that books appointments, answers common questions, or routes calls can often be designed to collect only what the task requires, pass only that to the model, and keep the rest in a secured system of record. De-identifying data before it is processed is another approach, but it has its own rules, so have your advisor confirm what qualifies.
The design question is not "can we paste this into ChatGPT?" It is "what is the smallest amount of data this task needs, and where does it travel?"
How Acrion Approaches It
At Acrion.ai we build AI systems around how a business already works, and for healthcare clients that starts with the safeguards above: encryption in transit and at rest, role-based access, audit logging, and a signed BAA with healthcare clients. We describe what our systems do, and your compliance obligations remain yours to confirm with your own advisor. You can read the specifics on our HIPAA page.
If you are weighing a specific use, these related pages go deeper:
- HIPAA-compliant chatbot for website and patient or client questions.
- HIPAA-compliant text messaging for appointment, intake, and follow-up messages.
- Is an AI receptionist HIPAA compliant? for voice and phone workflows.
A Short Checklist Before You Use Any AI Tool With Patient Data
- Confirm in writing whether the vendor will sign a BAA for the exact product and plan you intend to use.
- Verify the current data retention and training terms for that plan.
- Check encryption, access control, and audit logging for the full workflow, not only the model.
- Limit what is sent to the minimum necessary for the task.
- Write an approved-tools policy, and block personal accounts where you can.
- Have your compliance advisor or counsel review the setup.
That list will not make you compliant on its own, and nothing here guarantees an outcome. It will keep you from the most common mistake, which is treating a powerful tool as safe because it is popular.
Frequently Asked Questions
Is ChatGPT HIPAA compliant?
Not in its consumer form. Do not enter protected health information into a free or individual ChatGPT account. As of October 2026, OpenAI has stated that it can sign Business Associate Agreements for certain business and API offerings under specific conditions. Verify the current terms and eligibility directly with OpenAI and consult your compliance advisor.
Can I put patient information into ChatGPT?
Not into a consumer account. Any use involving PHI requires a signed BAA with the vendor for the specific product, plus appropriate safeguards and your compliance advisor's review. This is general information, not legal advice.
Does OpenAI sign a BAA?
OpenAI has stated publicly that it can sign BAAs for certain business and API offerings under specific conditions, as of October 2026. Eligibility, products, and terms can change, so confirm the current details directly with OpenAI in writing.
If there is a BAA, is ChatGPT safe for PHI?
A BAA is necessary but not sufficient. You also need encryption, access control, audit logs, minimum-necessary data handling, clear retention terms, and staff policies. The surrounding system matters as much as the contract.
What makes an AI system HIPAA-ready?
A signed BAA with every vendor that touches PHI, encryption in transit and at rest, role-based access, audit logging, minimum-necessary data handling, clear retention and training terms, and staff policies. Your compliance advisor should confirm what applies to your situation.
Does Acrion.ai offer HIPAA-ready AI systems?
Acrion.ai builds AI systems with encryption in transit and at rest, role-based access, audit logging, and a signed BAA with healthcare clients. Your own compliance obligations remain yours to confirm with your advisor. See our HIPAA page for details.
Need an AI System Built With HIPAA Safeguards in Mind?
We build AI systems with encryption, role-based access, audit logging, and a signed BAA for healthcare clients. See our HIPAA page, or the HIPAA-compliant chatbot and HIPAA-compliant text messaging options.
Acrion.ai is based in Knoxville, TN and works with businesses nationwide.