Is Grammarly HIPAA Compliant? Which Plan Gets a BAA, and the Safe Setup for a Practice (2026)

TL;DR: Only on Grammarly Enterprise, and only after you sign a Business Associate Agreement (BAA). As of November 2026, Grammarly says it can enter into BAAs "only for Grammarly for Business Enterprise plans," which you buy through its sales team at a price it doesn't publish. Free and Pro get no BAA, and Grammarly's own customer terms say not to submit any HIPAA data without one. For most 5 to 20 person practices, the practical answer is: keep Grammarly out of the EHR, or use a writing tool that signs.

I get this question from practice owners who found out a front desk person or a therapist has had the Grammarly extension on for a year. It's a fair worry. Grammarly works by reading what you type, and in a clinic, what people type is chart notes and patient emails.

Is Grammarly HIPAA compliant? What Grammarly actually says

Same rule as every post in this series: no tool is HIPAA compliant on its own. A vendor is safe for patient data when it signs a BAA, a contract saying it will protect the protected health information (PHI) it handles for you. The longer version of that idea is in my guide to HIPAA compliant AI.

Grammarly's help center answers the question in three sentences. It says "Grammarly is compliant with HIPAA Security, Privacy, and Breach Notification rules." It says you should not process PHI through its services "unless you have entered into a current Business Associate Agreement with Grammarly." And it says "currently, we can enter into BAAs only for Grammarly for Business Enterprise plans."

The contract says the same thing more bluntly. Grammarly's customer business agreement (its parent company is now called Superhuman, so the contract names Superhuman) says the customer "agrees not to submit any HIPAA Data to the Services unless it has entered into a BAA with Superhuman," and that without one, Superhuman "will have no liability under this Agreement for HIPAA Data." Translation: if patient data goes into a plan without a BAA, that's on you.

Grammarly plans vs HIPAA

Prices read from grammarly.com/plans on November 8, 2026. Grammarly doesn't list a seat minimum for Enterprise on its own pages. Some third-party trackers report one, so ask sales the number before you budget. For a 10 person practice, a sales-only plan may simply not be on the table, and that's worth knowing before you spend a week on calls.

What Grammarly's AI features do with your text

Grammarly is not a dictionary on your laptop. Its trust page says its algorithms analyze your text to make suggestions, which means the text leaves the computer. Documents saved in the Grammarly editor are stored until you delete them. The generative AI features (rewrites, the AI assistant, agents) go further: they send your text to large language models to write new text.

Three facts from Grammarly's own pages decide how much that matters:

• Training is on by default for individuals. The Product Improvement and Training setting is on for Free, Premium and single-user Pro accounts. Team Pro accounts bought on the website start with it on until an admin turns it off. It's automatically off for Enterprise, Business, Pro and Education accounts bought through sales.
• Outside AI providers don't train on it. Grammarly says: "We do not allow our third-party service providers to train their models on user content."
• Generative AI is an admin decision on team plans. To turn it on, an admin has to agree to additional terms. Grammarly's pages don't say whether the BAA covers these features, so ask sales in writing.

Not training on your data is good. It is not the same as a BAA. A therapist's note typed with the extension on is still PHI sent to a vendor that hasn't signed anything with you.

The real risk in a small practice: the browser extension

Nobody pastes a chart into Grammarly on purpose. The risk is the extension someone installed on their own, on the same browser they use for the EHR. Every note, every portal message, every referral letter gets checked as they type. If that account is Free or Pro, there's no BAA, and the training setting may be on.

That's the part the top results skip. The fix isn't a policy memo. It's five minutes per workstation.

The safe setup: a settings checklist

If you're not on Enterprise (most practices):

1. Check every clinical workstation for the Grammarly extension and desktop app. Remove it, or turn it off for your EHR, patient portal and email sites.
2. On any personal Grammarly account staff keep for non-patient writing, turn off Product Improvement and Training in the account's privacy settings.
3. Write one line in your HIPAA policy: no writing assistants in clinical systems unless the vendor has signed a BAA with the practice.
4. Add it to your risk analysis as a vendor reviewed and excluded, with the date.

If you buy Enterprise:

1. Get the BAA signed before anyone touches PHI, and confirm in writing which features it covers, generative AI included.
2. Turn on SAML single sign-on and SCIM so staff use practice accounts, not personal ones.
3. Use application and domain controls to decide where Grammarly runs. Block it anywhere you haven't cleared.
4. Set a session timeout and turn on data loss prevention.
5. Leave generative AI off until the BAA question is answered.

Alternatives if you can't get a BAA

• The spellcheck in your EHR. It's already inside a system that has a BAA with you. Boring, and it works.
• Sapling. It ranks for this exact search, and its HIPAA page says it "provides a signed BAA for covered entities and business associates," with a zero data retention option. Pricing is by quote.
• Microsoft 365, if you're already on it. Microsoft's BAA is part of the data protection terms you accepted when you bought it. Check that the specific writing tools you'd use are on Microsoft's in-scope list; I walk through that list in is Copilot HIPAA compliant.
• An AI assistant on a plan that signs. For rewriting a patient letter, ChatGPT can be HIPAA compliant on specific enterprise and healthcare plans, and Claude can on its API and Enterprise; the plan details are in is Claude HIPAA compliant. Neither covers the Plus, Pro or Team plans most people already have.

What to do today

Walk the office. Open the browser on every machine that touches the EHR and look for the green Grammarly icon. That's the whole audit for most small practices, and it takes less time than reading this post.

This is a technology explainer, not legal advice; take the plan table to your compliance lead. If you want help picking which AI and writing tools your practice can use, and setting them up so staff don't route around them, see how I work with healthcare practices.

Sources

• Grammarly Support, Is Grammarly HIPAA compliant?: BAAs only for Grammarly for Business Enterprise plans. Read November 8, 2026.
• Superhuman Customer Business Agreement (effective October 29, 2025), section 3.4 HIPAA Data. Read November 8, 2026.
• Grammarly plans: Free $0, Pro $12, Enterprise Contact Sales; Enterprise security controls. Read November 8, 2026.
• Grammarly Support, Product Improvement and Training Control: training defaults by plan and purchase path. Read November 8, 2026.
• Grammarly Support, Enable generative AI for your team: admin-managed, additional terms. Read November 8, 2026.
• Grammarly, Responsible AI: third-party providers may not train on user content. Read November 8, 2026.
• Sapling, HIPAA: signed BAA, zero data retention option. Read November 8, 2026.