Is ChatGPT HIPAA Compliant in 2026? Not on Plus, Pro, or ChatGPT Business

Is ChatGPT HIPAA compliant? The short answer

No, not on the plans most offices actually buy. As of September 2026, OpenAI will not sign a Business Associate Agreement (BAA) for ChatGPT Free, Go, Plus, Pro, or ChatGPT Business, and its help center says so plainly: "we don't offer a BAA for ChatGPT Business." A BAA is available only for a short list: ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT FedRAMP, ChatGPT for Clinicians, and the API with modified retention. Everything here comes from OpenAI's own help center and announcements, read on September 12, 2026. It's a technology explainer from someone who sets these tools up for small businesses, not legal advice.

The question usually shows up after the fact. Somebody at the front desk has been using ChatGPT to clean up patient follow-up emails for six months, and now the office manager wants to know how worried to be. Fair question. Here's the part most answers skip.

No software is HIPAA compliant. A signed BAA is what counts.

HIPAA doesn't certify apps. When a vendor handles protected health information (PHI) for a covered entity, the vendor signs a BAA agreeing to protect it. No BAA, no PHI. That's the test, and it's decided product by product, not brand by brand.

So "is ChatGPT HIPAA compliant?" really means: will OpenAI sign a BAA covering the exact ChatGPT product my staff is typing into? For most small practices, the answer is no.

Which OpenAI products come with a BAA

OpenAI's "HIPAA eligible products and functionality" article lists what it will sign for. Here's how that maps to the plans people actually search for:

OpenAI's BAA article adds the eligibility rule for ChatGPT itself: "Only ChatGPT Enterprise or Edu customers that have a sales-managed account are eligible for a BAA for ChatGPT at this time."

Is ChatGPT Business HIPAA compliant? No, and it's the plan that fools people

ChatGPT Business is the one I'd circle in red marker. It costs real money, $20 a user a month billed annually or $25 monthly. It has "Business" in the name. It comes with admin controls, SSO, and OpenAI's promise that it "won't train on your workspace's data." That last line is where people talk themselves into it.

Not training on your data is a privacy setting. A BAA is a legal agreement about PHI. Different things, and OpenAI draws the line itself: its Business overview says anyone who needs "Zero Data Retention, BAAs, or other sales-led options" should "use a contracted offering instead of self-serve ChatGPT Business." Moving your office from Plus to Business fixed your admin problem. It didn't touch your HIPAA problem. (What Business does buy you, seat by seat, is on ChatGPT Business pricing.)

Even with a BAA, some ChatGPT features aren't covered

This is the part that catches organizations that did everything right. OpenAI's covered list is long: chat, ChatGPT Work locally and in the cloud, projects, GPTs, files, voice, ChatGPT Record, and the Excel and PowerPoint extensions. But it also names features that are not covered under the BAA, even inside an eligible workspace:

• Sites
• Improved memory (off by default in ChatGPT for Healthcare and Regulated Workspace)
• Browser use and network access for ChatGPT Work in the cloud
• Event-triggered scheduled tasks
• Codex in the cloud
• Internet access in Canvas and code blocks

OpenAI's instruction for all of them is the same: "PHI should not be entered when using this functionality." It also says features not on the covered list "are not automatically covered" and that recently added functionality "may not yet be listed." So the admin job isn't "sign the BAA and relax." It's sign the BAA, then keep the uncovered features switched off for anyone who touches patient data.

ChatGPT for Healthcare vs ChatGPT for Clinicians

OpenAI now sells two healthcare versions, built for very different buyers.

ChatGPT for Healthcare is the organizational one. OpenAI announced it in January 2026 with health systems including Cedars-Sinai, HCA Healthcare, and UCSF. It comes with a BAA, role-based access, SAML SSO and SCIM, audit logs, data residency options, customer-managed encryption keys, and clinical search with citations. OpenAI says pricing "is based on ChatGPT Enterprise and depends on organization size and deployment needs," and it points "large hospitals and health systems" to sales. A four-chair dental office isn't who that page is talking to.

ChatGPT for Clinicians is the individual one, and it's the most useful fact on this page for a small practice. It's free for verified clinicians in the United States: physicians (MD/DO), nurse practitioners, physician assistants, and pharmacists. You need a ChatGPT account, a valid NPI, and a license the third-party verifier can confirm. An eligible clinician signs a BAA for their own workspace under Settings, then Agreements.

The catch is in the name. It covers the clinician, not the practice. OpenAI says if you need "a BAA that covers multiple users, centralized controls, or organization-wide deployment," that's ChatGPT for Healthcare. Your front desk and billing staff aren't covered because the doctor signed up.

The API route most small practices never hear about

If a practice or its software vendor builds its own tool on OpenAI's models, say an intake summarizer or a recall-message drafter, the API has its own BAA path, and it's lighter than people expect. OpenAI's help article says to email baa@openai.com with your company and use case, that the team responds "within 1-2 business days," and that "an enterprise agreement is not required to sign a BAA" for the API. OpenAI says it approves most requests, though some use cases don't pass review.

Two conditions matter. API eligibility is "contingent on Customer's account being provisioned with Modified Retention," and the BAA covers a named list of endpoints. This route is for whoever builds the tool. It doesn't mean your staff can paste charts into the regular ChatGPT app.

ChatGPT Health is a consumer product

ChatGPT Health is the part of ChatGPT where a person connects their own medical records and wellness apps to ask about their own health. OpenAI said in July 2026 that it's launching to US users 18 and older on web and iOS, and that Health conversations aren't used to train its foundation models. That's a thoughtful privacy design for a patient.

It's also not on OpenAI's list of HIPAA-eligible products. It's built for individuals managing their own health, not for a practice handling other people's records. "Health" in the name is branding, not a BAA.

What I'd do in a small practice this week

Most small practices I talk to don't need an enterprise contract. They need three rules written down.

1. Take PHI out of the prompt. Recall campaigns, policy rewrites, website copy, insurance explainers, and templates don't need a patient's name to work. De-identify first and most workflows never enter HIPAA territory.
2. Stop using personal accounts for practice work. The real leak usually isn't your configured workspace. It's someone's personal ChatGPT on their phone at lunch. Write down which tool is approved for what, then train the team on it instead of hoping.
3. If a workflow truly needs PHI, price the covered options side by side. An eligible clinician on ChatGPT for Clinicians, a BAA-covered API tool, or a sales-managed Enterprise deal. Then check the other vendors, because they draw their lines in different places: is Copilot HIPAA compliant and is Claude HIPAA compliant cover Microsoft and Anthropic.

For practice workflows that stay on the right side of the line, AI for dental practices has the examples I actually use.

One more time, plainly: I set up AI tools for businesses. I'm not your compliance attorney. HIPAA turns on your data, your workflows, and your risk analysis. Use this page to ask counsel a sharper question: "Which of our AI tools are covered by a signed BAA, and who signed it?"