Is ChatGPT HIPAA Compliant? Every Plan, Checked

Short answer: ChatGPT can be used with protected health information only under a Business Associate Agreement, and OpenAI offers one for ChatGPT only to sales-managed ChatGPT Enterprise or Edu customers. OpenAI's BAA article is direct about the plan most small and mid-sized firms buy: "We do not offer a BAA for ChatGPT Business." The API is a separate path: "To use the OpenAI API with protected health information (PHI), your organization must first enter into a Business Associate Agreement (BAA) with OpenAI."

This post is for the IT lead, compliance officer or controller who already knows staff are using ChatGPT, usually on personal accounts and usually with good intentions: drafting a patient letter, summarizing a referral, cleaning up a claims spreadsheet. Email and smartphones came into the office the same way: people used them before the company had a policy. The work now is to move that use onto a plan the company controls, and to be precise about which plan can hold PHI.

ChatGPT HIPAA eligibility, plan by plan

From OpenAI's help center and enterprise privacy page, checked on the live pages on November 2, 2026. OpenAI rewrote its BAA article that same week, so confirm the current text with OpenAI before you sign anything.

OpenAI also lists a ChatGPT for Healthcare workspace among the plans whose content it does not train on by default, and its BAA article points individual clinicians to a separate in-product BAA flow for "ChatGPT for Clinicians." If a clinical team is asking for one of those products, get the BAA terms for that specific product from OpenAI in writing.

Why "ChatGPT Business" is the trap

The usual way this goes wrong at a mid-sized practice or health-adjacent firm is sensible on its face. IT notices personal accounts, buys ChatGPT Business seats to get admin control and stop training on company data, and considers the problem solved. It is solved for ordinary business data: OpenAI's data-controls article says "By default, OpenAI does not use content from ChatGPT Business, Enterprise, Edu, or ChatGPT for Healthcare workspaces to train its models," and the enterprise privacy page says workspace admins "can view, access, export, and delete end user conversations in the workspace."

It is not solved for PHI. Business has no BAA. Unless the written rule that comes with those seats says plainly that patient information never goes into ChatGPT Business, the firm has replaced one HIPAA problem with another and given it an invoice.

What a personal ChatGPT account does with work data

• Training is on unless the user turns it off. "On personal workspaces with ChatGPT Free, Plus, or Pro, data sharing is enabled by default." The setting is "Improve the model for everyone".
• Feedback overrides the opt-out. From OpenAI's model-training article: a user who has opted out can still give a thumbs up or down, and "If you choose to provide feedback, the entire conversation associated with that feedback may be used to train our models." As of November 2, 2026 the article no longer carves out business plans, so tell staff on any plan not to rate conversations that contain client or patient data.
• Temporary Chats help a little. OpenAI says they are not used to improve its models but may be retained for up to 30 days. They are a user habit, not a company control.
• The company is not a party. A personal account is a contract between your employee and OpenAI. You cannot see it, export it for a legal hold, or delete it when the employee leaves.

The Microsoft route, and its two catches

Most of our clients already pay for Microsoft 365, and Microsoft Copilot Chat comes with eligible licenses: "Using Copilot Chat doesn't require a Microsoft 365 Copilot license." Microsoft's enterprise data protection page says Copilot and Copilot Chat "support HIPAA compliance for properly configured implementations." There are two catches. First: "HIPAA compliance doesn't apply to web search queries as they aren't covered by the DPA and Business Associate Agreement (BAA)." Second, the protection depends on staff signing in with their work account; Microsoft tells admins to "instruct them to sign in with their work or school account." A personal Microsoft account in the same app is the same consumer problem under a different logo.

We don't think Copilot is automatically the answer. If your people prefer ChatGPT or Claude, the job is to put them on the right business tier of that tool. The HIPAA question then gets the same answer for every vendor: a BAA for that exact product, plus configuration that keeps PHI inside covered features. For Claude, see Is Claude HIPAA compliant? Plan by plan.

What internal IT should do this month

1. Size the current use. Use firewall, proxy or DNS logs, or Defender for Cloud Apps discovery if you license it. Microsoft's catalog has a Generative AI category, and Microsoft says marking an app unsanctioned blocks it on devices onboarded to Defender for Endpoint. You are counting users and departments, not hunting individuals.
2. Decide where PHI is allowed, if anywhere. If clinical staff need AI on PHI, the ChatGPT path is sales-managed Enterprise with a BAA, or an API build under a BAA. Everyone else can use Business, or another vendor's business tier, for non-PHI work under a written rule.
3. Back the rule with a control. Microsoft's Edge for Business can apply DLP to consumer ChatGPT on managed devices. Note that Microsoft lists protection of data shared to unmanaged apps as a pay-as-you-go capability, not part of E5.
4. Move people, then close the door. Give staff the sanctioned tool first. KPMG and the University of Melbourne's 2025 global study found that risky use of AI at work, including uploading sensitive company data to public AI tools, was most common among employees whose organization had banned generative AI (67%), against 33% where there was no policy. KPMG's own reading: "outright bans may be ineffective."

This is IT and operational guidance, not legal advice. If PHI has already gone into a personal account, bring in your privacy officer; whether it is a reportable breach is their determination.