Is ChatGPT HIPAA Compliant? What Clinics Need to Know Before Staff Use It

The short answer

No — not on the plans most people use.

ChatGPT Free, Plus, and Team do not include a BAA. OpenAI will not sign a BAA for those plans. That means any patient information typed into a standard ChatGPT account is PHI leaving your practice without a compliant data handling agreement in place.

The only paths to a ChatGPT BAA are ChatGPT Enterprise (custom pricing, direct sales) or the OpenAI API (developer access, requires building your own interface).

What opting out of training actually does

ChatGPT lets users turn off chat history and opt out of having conversations used to train future models. This is useful for general privacy. It is not HIPAA compliance.

A BAA is a signed legal contract that defines how a vendor handles PHI, what they must do in the event of a breach, and what your rights are as a covered entity. A settings toggle in a consumer app does not carry any of those obligations. OpenAI has been explicit that these settings do not make Free or Plus plans HIPAA compliant.

The PHI risk problem in clinics

The problem is not that staff intend to violate HIPAA. The problem is that ChatGPT is genuinely useful for drafting prior authorization letters, summarizing clinical notes, writing referral correspondence, and answering insurance coding questions. Staff find it and start using it — with real patient data — before anyone has thought through the compliance implications.

A front-office coordinator drafts a prior auth letter by pasting a patient’s name, diagnosis, and treatment plan into ChatGPT Plus. That conversation is now outside any BAA. One incident report to HHS is all it takes.

This is accelerating. AI tool adoption in healthcare is growing faster than compliance policies can keep up with, and most staff reach for their personal free accounts first.

Who can use ChatGPT with PHI

ChatGPT Enterprise is a reasonable path for large health systems that want GPT-4 capabilities, have an IT team to manage the rollout, and can negotiate directly with OpenAI. The per-seat cost is higher than Plus and requires a multi-seat contract.

For developers, the OpenAI API with a signed BAA lets engineering teams build HIPAA-compliant clinical tools on top of GPT models. This requires infrastructure work — it is not a plug-and-play solution for a 10-person medical practice.

Who should look elsewhere

Small clinics that need AI drafting capabilities for clinical correspondence have better options than negotiating an enterprise contract with OpenAI.

Microsoft Azure OpenAI Service covers GPT-4 under Microsoft’s existing HIPAA BAA for Azure — accessible if your practice is already on Microsoft 365. Google Vertex AI with Gemini is covered under Google Cloud’s HIPAA BAA for practices on Google Workspace.

For practices that need HIPAA-compliant task management and workflow tooling without the AI complexity, PHIGuard starts at $20/month flat for up to 10 staff. We built PHIGuard after seeing how many small clinics were managing patient-adjacent tasks in tools with no BAA at all. Every PHIGuard tier includes a BAA, no sales call required.