On this page
Not the versions a solo practice usually has. As of November 12, 2026, OpenAI's help center says a BAA is available for sales-managed ChatGPT Enterprise or Edu accounts and for its API, and that it does not offer one for ChatGPT Business. Free, Plus and Pro aren't offered one either. On those plans, ChatGPT is fine for work with no patient in it and is not a place for patient details.
Checked November 12, 2026 on OpenAI's help center article on getting a business associate agreement and its published healthcare addendum (PDF). OpenAI changes its plans often, so confirm with OpenAI before any patient detail goes in.
What does OpenAI say?
OpenAI's help center splits the answer by product:
- ChatGPT Enterprise and Edu: for a BAA on a sales-managed account, contact OpenAI sales.
- ChatGPT Business (the small-team plan): "We do not offer a BAA for ChatGPT Business."
- The API: a BAA is available on request by email, and OpenAI says an enterprise agreement isn't required for it.
- ChatGPT Free, Plus and Pro: personal plans. The help center names no BAA for them.
OpenAI's healthcare addendum, the contract that carries its BAA, shows how narrow coverage is even then. It defines eligible services as OpenAI's zero-retention API, ChatGPT Enterprise and any others OpenAI names in writing. It says third-party services, such as plugins, actions and shared links, are not eligible and may not be used with patient information.
OpenAI's help center also lists newer products for healthcare organizations and clinicians. We couldn't open that list directly on the day we checked, so ask OpenAI which one, if any, fits a practice your size.
What can a practice use ChatGPT for without a BAA?
Anything that has no patient in it. That covers a lot of the writing a practice owner does:
- website copy, blog drafts and social posts about your services
- a first draft of a policy, a job post for a VA or an office checklist
- general patient education, such as "what to expect at your first visit," which you then review and correct
- reminder and follow-up templates with placeholders, like the ones in our follow-up message templates
- spreadsheet formulas, email subject lines and summaries of articles you paste in
Check anything clinical it writes before a patient sees it. It can be wrong and sound sure.
What should never go into ChatGPT?
- Visit notes or transcripts. "Turn this into a SOAP note" with a real visit pasted in is the most common leak.
- Lab results. No pasting or uploading a report to "summarize for the patient."
- Patient messages. Don't paste a patient's email or text to draft a reply. It carries their name, their question and often their history.
- Intake answers and exports. No spreadsheets of patients, even to "clean up the columns."
- Screenshots and photos from the chart, the portal or a text thread.
Can I just remove the patient's name?
Not safely. HIPAA's standard for de-identified data is stricter than deleting the name. It lists 18 kinds of identifier, including dates tied to the person, phone numbers, email addresses and any other unique detail. A note that says "52-year-old teacher from a small town, seen March 3, labs attached" has no name and may still point to one person.
A safer habit is to ask the general question. Instead of pasting Dana R.'s message, ask: "Draft a short, warm reply to a patient who is asking whether to reschedule a follow-up because she missed her lab draw." You get the same help, and no patient information leaves your practice.
Where do practices slip up?
Usually through someone trying to save time. A VA with a personal ChatGPT account pastes the day's patient emails to draft replies faster. Or the owner uploads a lab PDF late at night to get a plain-language summary. Neither feels like "sharing data with a vendor," but both are.
Write a one-paragraph rule for everyone who works in the practice: which AI tools are allowed, on which accounts, and that nothing from a chart, form, message or lab goes into them. Our guide to what a virtual assistant can do in a medical practice has more on setting those limits.
What about Claude, Gemini and Copilot?
The same question applies to every AI assistant: is there a BAA, and for which plan? The answers differ.
| Assistant | BAA | Plan |
|---|---|---|
| ChatGPT | Enterprise only | Sales-managed Enterprise or Edu, or the API by request. Not Free, Plus, Pro or Business |
| Claude | Enterprise only | Claude Enterprise with HIPAA turned on, or the API through sales. Not Free, Pro or Max |
| Gemini in Google Workspace | Yes, under the Workspace BAA | A Workspace account with the BAA accepted |
| Microsoft Copilot Chat | Listed among the Office 365 services Microsoft's BAA covers | A commercial Microsoft 365 plan |
| AI features in your EHR | Ask whether the EHR's BAA covers them | Depends on the EHR |
The Claude row in our BAA table has Anthropic's source. For a solo practice already on Google Workspace with the BAA accepted, Gemini inside Workspace is the assistant most likely to be covered today. See Does Google Workspace sign a BAA? A covered tool still needs a person to check what it writes before it reaches a patient or the chart.
To check every tool you use, try the HIPAA and BAA checker.
This is general information, not legal advice. Confirm BAA terms with each vendor.
Common questions
Does OpenAI sign a BAA for ChatGPT?
Only for sales-managed ChatGPT Enterprise or Edu accounts, and for its API on request. OpenAI's help center says it does not offer a BAA for ChatGPT Business (as of November 2026).
Is ChatGPT Plus HIPAA compliant?
No. Plus is a personal plan and OpenAI names no BAA for it. Keep patient names, notes, results and messages out of it.
Can I use ChatGPT to write visit notes?
Not with real patient details on a plan that has no BAA. Use an AI feature covered by a BAA, such as one inside your EHR if its BAA covers it, or write the note yourself.
Is it enough to remove the patient's name before pasting into ChatGPT?
No. HIPAA's de-identification standard covers 18 kinds of identifier, including dates and contact details. Ask a general question instead of pasting a real record.