HIPAA Compliant AI (2026): Which Claude, ChatGPT, Gemini and Copilot Plans Get a BAA, and What It Costs

HIPAA compliant AI: the short answer

No AI model is HIPAA compliant. What makes an AI tool usable with patient data is a signed Business Associate Agreement (BAA) that covers the exact plan and feature you use. As of October 2026 all four big vendors will sign one, and each draws the line somewhere different: Anthropic covers the Claude API and Claude Enterprise, OpenAI covers its API and sales-managed Enterprise and healthcare plans, Google covers Gemini inside Google Workspace once an admin accepts the BAA, and Microsoft covers Microsoft 365 Copilot through the agreement its business customers already accepted. The two plans a small practice is most likely to buy, Claude Team and ChatGPT Business, are both outside. Below is one table read from each vendor's own pages this week, the features that stay outside even a signed BAA, and what the covered path costs a 10-person practice.

I set up these tools for owner-led businesses, and the question I get from practices is never "is AI compliant." It is "we already pay for something; can we use it with patients?" That question has a checkable answer. It just lives in four different help centers.

Which AI is HIPAA compliant? The four vendors, side by side

Each row has a full page behind it: is Claude HIPAA compliant, is ChatGPT HIPAA compliant and is Microsoft Copilot HIPAA compliant. Gemini's answer is short enough to live here.

What changed this week: self-serve Claude Enterprise can now be covered

Until this month, Anthropic tied its BAA to the sales-assisted Enterprise plan, and buying Enterprise with a card did not get you one. Anthropic's BAA article, marked updated this week, now says the BAA covers "Enterprise plans," and its Enterprise help page lists "HIPAA-readiness / BAA: Available" for both the self-serve and the sales-assisted versions. The Primary Owner still has to switch HIPAA on and accept the agreement; a standard Enterprise organization is not covered until somebody does. Team is still excluded at any price.

The catch for a small practice is the seat floor. Anthropic's Enterprise help page sets a minimum of 20 seats for self-serve and 50 for sales-assisted, at $20 per seat per month billed annually, with every bit of usage billed on top at API rates.

What the covered path costs a 10-person practice

Same practice, four vendors, cheapest path that is actually covered by a BAA. AI seat costs only; the practice's existing Microsoft 365 or Google Workspace subscription is assumed, not counted.

So the practice that already runs on Microsoft 365 or Google Workspace has a covered path sitting inside a contract it signed years ago. The practice that wants Claude specifically pays for 20 seats to cover 10 people. And the practice that bought Team or Business last spring because they "felt like the business-grade option" has a nice tool it cannot use with a single patient name. That last one is the most common thing I see, and it is why the Claude Team plan page carries a HIPAA warning near the top.

The cheapest HIPAA compliant AI is often no PHI at all

Before you pay for coverage, sort the jobs. Recall-message templates, a procedure explainer, a summary of an insurance policy, a cleaned-up claims-narrative template, staff training notes: none of those need a patient's identity. De-identify them and they can run on any plan, including the ones excluded above. The jobs that genuinely need PHI, such as drafting a visit summary from a specific chart, are the ones that decide which covered plan you need. In most small practices that list is shorter than the owner expects.

A signed BAA is a starting line

The BAA covers the vendor's side. Your side is still yours: who gets a seat, which features they may open with patient data (see the last column of the table), what goes in a prompt, where outputs are stored, and how you would notice and report a problem. Write that down as a one-page policy before the first seat goes live, and have your privacy officer sign it.

Who can help a medical or dental practice set up HIPAA-compliant AI?

For the setup side, that's my work. I'm Justin McKelvey, an AI consultant in Austin, Texas, and I set up Claude, ChatGPT and Microsoft 365 Copilot for teams of 10 to 200. For a practice that handles patient data, that means picking the plan that is actually covered (often the one riding the contract you already have), sorting which jobs need PHI and which can be de-identified, writing the staff rules with your privacy officer, and training the people who will use it. The AI Readiness Assessment is $2,500 flat for a two-week written plan, credited in full if we build it together within 90 days. A done-for-you rollout starts at $4,500 and takes about two weeks, with vendor seats paid separately. The first 30-minute call is free, and the full menu is on AI consulting services. I'm not a lawyer or a compliance officer; your privacy officer signs off on the BAA and the policy, and I build to what they decide.

Sources

• Anthropic, "Business Associate Agreements (BAA) for Commercial Customers," privacy.anthropic.com (read October 10, 2026)
• Anthropic, "What is the Enterprise plan?," support.claude.com, and Claude pricing, claude.com/pricing (read October 10, 2026)
• Google Workspace Admin Help, "HIPAA compliance with Google Workspace and Cloud Identity," support.google.com/a/answer/3407054, and Google Cloud HIPAA compliance, Google Workspace supported services (read October 10, 2026)
• Microsoft Learn, "HIPAA/HITECH" compliance offering, learn.microsoft.com (read October 10, 2026; Copilot web-search note read September 1, 2026)
• OpenAI Help Center, HIPAA-eligible products and functionality, BAA for API services, and ChatGPT Business overview (read September 12, 2026)
• Microsoft 365 Copilot Business price, Microsoft pricing page (read September 2026)