Is ChatGPT HIPAA Compliant? A Guide for Solo Practices

A lot of a solo clinician’s evening goes into writing: referral letters, prior authorization letters, patient instructions, the note you didn’t finish between appointments. ChatGPT can draft most of that in seconds, which is a real way to get your evenings back.

The question that stops people is simple: is ChatGPT HIPAA compliant, and can I put patient information into it? The short answer is that it depends on which version you use and whether you have signed a business associate agreement (BAA). This guide sorts the versions, explains what changed in 2026, and gives you a setup you can follow.

We are a technology consultancy, not a law firm or a medical practice. We explain how the products work and what the official texts say. The compliance decisions are yours.

What do HIPAA terms like PHI and BAA mean here?

Covered entity

Under HIPAA, a health plan, a health care clearinghouse, or a health care provider such as a doctor, psychologist, dentist or chiropractor, "but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard" (for example, billing insurance electronically). HHS explains the definition and links to a decision tool.

PHI (protected health information)

Individually identifiable health information created, received, maintained or transmitted by a covered entity or its business associate.

Business associate

A person or company that creates, receives, maintains or transmits PHI on behalf of a covered entity. HHS's list of examples includes a cloud service provider, the vendor of an app that provides transcription services to a physician, and a third-party AI chatbot on a provider's patient portal.

BAA (business associate agreement)

The written contract in which the business associate promises to safeguard the PHI. HHS says the HIPAA Rules permit a covered entity to disclose PHI to a business associate if it obtains these "satisfactory assurances."

So an AI chat tool that stores or processes your patients’ information is, in HIPAA terms, a cloud service. HHS’s guidance on HIPAA and cloud computing is blunt about what happens without a contract: a covered entity that uses a cloud provider to maintain ePHI “without entering into a BAA with the CSP” is “in violation of the HIPAA Rules.”

Which ChatGPT plans are HIPAA eligible and offer a BAA?

OpenAI’s list of HIPAA eligible products and its HIPAA guide (posted July 9, 2026) draw a clear line. We last checked both on October 27, 2026.

ChatGPT product	BAA available?	Who it’s for	How you get the BAA
Free, Plus, Pro, and the Health feature	No	Consumers	Not available. OpenAI calls these “not Eligible Services,” and says Health in ChatGPT “does not offer a Business Associate Agreement”
ChatGPT Business	No	Teams	Not available. OpenAI: “We do not offer a BAA for ChatGPT Business”
ChatGPT for Clinicians	Yes, for eligible accounts	Verified US physicians (MD/DO), NPs, PAs and pharmacists, for individual use. Free at launch	Sign it in ChatGPT under Settings > Agreements
ChatGPT for Healthcare and ChatGPT Enterprise with Regulated Workspace	Yes	Organizations that need multiple users, admin controls and centralized deployment	Contact OpenAI. Its help center says to contact sales for a sales-managed Enterprise account
OpenAI API with Modified Retention	Yes	Developers and vendors building their own tools	Self-serve in API settings for eligible organizations since October 5, 2026, or by request

The Health tab in ChatGPT is a different thing. It lets patients connect their own records and Apple Health. OpenAI says it is “not intended for clinical or covered-entity use” and offers no BAA, so don’t use it for patient work.

Two details are easy to miss. First, the guide says that without an eligible service, a customer “may not upload, transmit, or process PHI with ChatGPT.” That is OpenAI’s own rule, on top of HIPAA. Second, OpenAI’s help article on API BAAs says accepting a BAA and enabling HIPAA compliance support “do not, by themselves, make your application HIPAA compliant.”

What is ChatGPT for Clinicians, and who can sign its BAA?

OpenAI announced ChatGPT for Clinicians on April 22, 2026 as “free for any verified physician, NP, PA, or pharmacist, starting in the U.S.” According to the help center:

• Sign-up needs a ChatGPT account, a valid NPI and a license that can be verified through a third-party verification provider.
• It’s a separate workspace. Your existing ChatGPT workspace stays, and you switch between them from the account switcher. Our advice: keep patient work in the Clinicians workspace only.
• The BAA is opt-in. OpenAI says many clinical tasks do not require PHI, and you should not share PHI there “unless a BAA is in place and you are authorized to sign a BAA for your account.”
• Training: content shared with ChatGPT for Clinicians is not used to train OpenAI’s models.
• Third parties: don’t share PHI with third-party GPTs or connected apps unless you have the appropriate permissions and agreements in place.
• Public data apps: the Healthcare Public Data plugin searches sources like PubMed, DailyMed and ClinicalTrials.gov. OpenAI says not to include patient names, medical record numbers or other PHI in those queries.
• It’s for one person. For a BAA that covers multiple users, OpenAI points you to ChatGPT for Healthcare.

For a solo physician or NP, that’s a big change: a version of ChatGPT with a BAA available, without an enterprise contract.

What if you’re a dentist, therapist or chiropractor?

You’re not on the list yet. OpenAI says eligible clinicians “currently include physicians (MD/DO), nurse practitioners (NP), physician assistants (PA), and pharmacists,” and that it plans to expand access over time. HHS, meanwhile, names dentists, psychologists and chiropractors as covered health care providers when they transmit health information electronically in a HIPAA standard transaction, such as billing insurance electronically.

That leaves three realistic paths:

1. An organization plan (ChatGPT for Healthcare or Enterprise with Regulated Workspace), arranged with OpenAI.
2. A healthcare tool that signs a BAA, such as a dental or therapy note tool. Our guide to AI note-takers for therapists covers the state consent laws that apply to those tools.
3. No PHI at all. Use any ChatGPT plan only for work that contains no patient information, or properly de-identified information (next section).

Can you use ChatGPT if you remove patient names?

Removing the name isn’t enough. HHS’s de-identification guidance describes two methods: a formal determination by a qualified expert, or the “Safe Harbor” method. Safe Harbor requires removing 18 types of identifiers of the patient or of relatives, employers or household members, and having no “actual knowledge” that what remains could identify the person.

Those identifiers go well beyond names. They include all elements of dates (except year) directly related to the patient, such as birth and visit dates, and geographic details smaller than a state, including street address, city and ZIP code (with a narrow exception for the first three digits). Phone numbers, email addresses, medical record numbers and full-face photographs are on the list too, and so are voice prints.

HHS’s cloud guidance confirms the payoff: a cloud provider that receives only properly de-identified information is not a business associate, because that information “is not considered protected health information.”

Practical advice, not an HHS rule: a free-text note is where identifiers hide (a date, a town, a daughter’s name). If you can’t be sure a note is clean, treat it as PHI.

How do you set up ChatGPT safely in a solo practice?

This is the order we follow when we set up ChatGPT with a solo clinician. It’s practical advice built on the sources above, not a legal requirement.

1. Check whether HIPAA applies to you. Use HHS’s covered entity page and its decision tool. If you bill insurance electronically, assume it does.
2. Sort your tasks into two lists. “No patient data” (patient leaflets, policies, emails to vendors, marketing) can go in any plan. “Patient data” (referrals, prior auth letters, note drafts) needs a BAA-covered product.
3. Pick the covered product that fits. ChatGPT for Clinicians if you’re an eligible physician, NP, PA or pharmacist working alone. An organization plan or a healthcare tool with a BAA if you have staff who need access or you aren’t on the eligible list.
4. Sign the BAA before the first patient detail goes in, and save a copy. For Clinicians, it’s under Settings > Agreements.
5. Stay inside the covered features. OpenAI’s eligible functionality list says features not listed “are not automatically covered,” and that newly added features may not be listed yet. It names improved memory, event-triggered scheduled tasks, internet access in Canvas, and browser or network access for Work in the cloud as not covered. Keep PHI away from third-party GPTs and connected apps unless they have their own agreements.
6. Keep the official record in your EHR. OpenAI’s HIPAA guide says customers may not use its services “to maintain PHI as a part of a designated record set.” Draft in ChatGPT, then paste the final, reviewed version into your record system.
7. Lock down your devices. The same guide says OpenAI may store some data locally on a device, and that customers who require encryption of PHI at rest should encrypt all devices that run OpenAI apps or browser sessions. Add a strong password and two-factor sign-in.
8. Review every draft yourself. OpenAI says ChatGPT for Clinicians is intended to support, not replace, professional judgment, and that clinicians remain responsible for all care decisions.
9. Write it into your risk analysis. HHS says covered entities must conduct risk analyses to identify and assess potential threats and vulnerabilities to all the ePHI they create, receive, maintain or transmit. Add the AI tool, the BAA date and the rules above.

What about AI receptionists and scribes built on OpenAI?

On October 5, 2026, OpenAI’s API changelog announced an in-product flow so admins of eligible organizations can accept the standard BAA and enable HIPAA compliance support. The help article adds that self-serve enrollment “requires an established history of API usage,” that no enterprise agreement is required, and that once enabled, HIPAA compliance support can’t be disabled in the API settings.

You won’t touch this yourself unless you build software. It matters because many AI phone receptionists and scribes are built on models like these (see what an AI agent is). HHS lists a third-party AI chatbot on a provider’s patient portal that handles symptom assessment, reminders and scheduling as a business associate, so ask any such vendor for its own BAA with you, and ask whether its AI provider is covered too. HHS says a business associate must have a BAA with its own subcontractor before disclosing PHI to it.

What about Claude, Gemini and other AI chatbots?

The same rule applies: no BAA, no patient data. Two examples, checked October 27, 2026:

• Claude. Anthropic says its BAA covers “HIPAA-ready services, such as” its API and Claude Enterprise. Even on Enterprise, the account owner has to turn HIPAA compliance on and accept the BAA first (Anthropic’s BAA page).
• Gemini. Google lists the Gemini app (but not Gemini in Chrome) and Gemini in Workspace as covered under its Workspace HIPAA BAA (HIPAA Included Functionality). Google says customers who haven’t signed its BAA “must not use PHI” in Workspace services.

For any tool, check three things: is your plan named on the vendor’s HIPAA page, have you signed its BAA, and is the feature you’re using covered.

Beyond ChatGPT: where else can AI help a solo practice?

ChatGPT is one tool. For a solo practice, the safest gains usually come from the work around the patient, not the decision about the patient. Sorted roughly by risk:

Use	What it does	Risk	Where to start
Appointment and admin automation	Reminders, rescheduling, intake forms, message routing, billing preparation	Low	Yes: the best first project
Clinical documentation (AI scribes)	Drafts the note from the session for you to edit	Medium: errors end up in the record if not caught	Yes, with review of every note
Patient message drafts	Drafts replies for you to approve	Medium	Yes, with approval before sending
Literature search and summaries	Finds and summarizes studies and guidelines	Medium: summaries can be wrong	Yes, always open the original source
Diagnostic decision support	Flags findings on images or signals	High	Only regulator-authorized devices, used as intended

AI scribes: what the evidence shows

An ambient AI scribe listens to the visit (with the patient’s consent), transcribes it and drafts a structured note that the clinician reviews, edits and signs. The best-documented example is The Permanente Medical Group, which made one available to 10,000 physicians and staff in October 2023. In a peer-reviewed report in NEJM Catalyst, the group described 3,442 physicians using it in up to 303,266 patient encounters within ten weeks, with drafts of high quality for physicians to edit. It later published learnings after one year and over 2.5 million uses.

The note is still a draft. Read every line before signing, especially medications, doses and negatives (“no chest pain” versus “chest pain”). Ask the patient first, make opting out easy, and ask the vendor whether audio is stored, where and for how long. A scribe that handles PHI needs its own BAA with you. Recording a visit can also fall under state recording laws. Florida and California require everyone’s consent; our AI notetaker guide explains Florida, Texas and California rules (it’s written for lawyers, but the recording statutes apply to anyone).

What should you never do with AI?

WHO’s guidance on large multi-modal models in health warns that these models can produce false, inaccurate, biased or incomplete statements and can encourage automation bias, where professionals overlook errors they would otherwise have caught. From that follow some firm rules:

• Never paste identifiable patient data into a tool without a BAA. See the plan table above.
• Never let AI make the final diagnosis or treatment decision. General-purpose chatbots are not medical devices. The US FDA keeps a list of AI-enabled medical devices authorized for specific uses.
• Never sign or send AI output unread. Notes, letters and patient replies all get a human check.
• Never trust a citation you have not opened. Fabricated references are a known failure mode.
• Don’t let it become a security hole. AI tools connected to your systems need the same access controls as any other clinical software.

Questions to ask any AI vendor

Ask these in writing before you sign:

• Where is data stored and processed, and for how long?
• Is our data used to train models? The answer should be no, by contract.
• Will you sign a business associate agreement, and is your own AI provider covered?
• What is the regulatory status of the product, and its intended use?
• Does it integrate with our scheduling and records systems, or create copy-paste work?
• Are there audit logs, and can we export our data if we leave?
• What is the total cost, including set-up and per-user fees?

If a vendor cannot answer clearly, treat that as your answer.

Where to go from here

See what we set up for doctors, therapists and dentists.

If you run a therapy practice, start with our guide to AI note-takers under the new state laws.

If you prepare tax returns, the rules that matter are the IRS’s, not HIPAA’s: see what the IRS expects when tax preparers use AI.

Choosing the right plan, signing the BAA, turning off the features that aren’t covered and building a few reusable prompts for referrals and patient instructions is exactly what we do in a 1-hour, 1:1 AI setup session ($100). We set it up with you on video, in your own accounts, and you leave with a written plan. Not sure it fits your practice? Book the free 15-minute fit call first.

Sources

• OpenAI, HIPAA Implementation and Configuration Guide (posted July 9, 2026)
• OpenAI Help Center, HIPAA eligible products and functionality (checked October 27, 2026)
• OpenAI Help Center, Getting a Business Associate Agreement for the OpenAI API (checked October 27, 2026)
• OpenAI Help Center, ChatGPT for Clinicians (checked October 27, 2026)
• OpenAI Help Center, Health in ChatGPT (checked October 27, 2026)
• OpenAI, Making ChatGPT better for clinicians (April 22, 2026)
• OpenAI, API changelog (entry dated October 5, 2026)
• U.S. Department of Health and Human Services, Covered Entities and Business Associates
• U.S. Department of Health and Human Services, Are we required to “certify” our organization’s compliance with the standards of the Security Rule?
• Anthropic, Business Associate Agreements (BAA) for Commercial Customers (checked October 27, 2026)
• Google Workspace, HIPAA Included Functionality (as of August 31, 2026)
• U.S. Department of Health and Human Services, Business Associates
• U.S. Department of Health and Human Services, Guidance on HIPAA & Cloud Computing
• U.S. Department of Health and Human Services, Guidance Regarding Methods for De-identification of Protected Health Information
• World Health Organization, WHO releases AI ethics and governance guidance for large multi-modal models (18 January 2024)
• Tierney A.A. et al., Ambient Artificial Intelligence Scribes to Alleviate the Burden of Clinical Documentation, NEJM Catalyst Innovations in Care Delivery 2024; 5(3)
• NEJM Catalyst, Ambient Artificial Intelligence Scribes: Learnings after 1 Year and over 2.5 Million Uses
• US FDA, List of AI-Enabled Medical Devices