BAA guide
Is Claude HIPAA compliant?
Plan by plan, from Claude's own pages.
Only on a plan where the vendor signs a BAA. Claude is not HIPAA compliant on its own. Free, Pro, and Max: no BAA. Team: no BAA. Team plans cannot enable HIPAA. Enterprise: Only after the organization's Primary Owner accepts the BAA and enables HIPAA in organization settings. API: Covers a HIPAA-ready API organization, and only the API features Anthropic lists as covered.
Checked against Claude's own pages, linked in the table.
Which Claude plans sign a BAA
| Plan | BAA | Condition | What the vendor page says |
|---|---|---|---|
| Free | No BAA | None | You can enable HIPAA from organization settings if your organization is on an Enterprise plan. Team plans and individual plans (Free, Pro, and Max) can't enable HIPAA.support.claude.com |
| Pro | No BAA | None | You can enable HIPAA from organization settings if your organization is on an Enterprise plan. Team plans and individual plans (Free, Pro, and Max) can't enable HIPAA.support.claude.com |
| Max | No BAA | None | You can enable HIPAA from organization settings if your organization is on an Enterprise plan. Team plans and individual plans (Free, Pro, and Max) can't enable HIPAA.support.claude.com |
| Team | No BAA | Team plans cannot enable HIPAA. | You can enable HIPAA from organization settings if your organization is on an Enterprise plan. Team plans and individual plans (Free, Pro, and Max) can't enable HIPAA.support.claude.com |
| Enterprise | BAA only if the condition is met | Only after the organization's Primary Owner accepts the BAA and enables HIPAA in organization settings. | Only the Primary Owner of the organization can accept the BAA and enable HIPAA. Other Owners or Admins can't complete this flow on the org's behalf.support.claude.com |
| API | BAA only if the condition is met | Covers a HIPAA-ready API organization, and only the API features Anthropic lists as covered. | Anthropic provides a BAA covering our HIPAA-ready services, such as use of our first-party API, Claude in Microsoft Foundry, or Enterprise plans.privacy.claude.com |
Training, retention, and access logs
- Access logs
- Per Anthropic, the Compliance API is covered under the BAA for HIPAA-ready organizations.
Rivvi
HIPAA BAA included
Rivvi's free organization plan (you and 2 colleagues) includes a HIPAA BAA, e-signed in the app before any patient data moves. The free personal plan is public information only.
Questions
Does Anthropic sign a BAA for Claude?
Yes. Anthropic provides a BAA for its HIPAA-ready services, including Claude Enterprise and its first-party API. On Enterprise, only the organization's Primary Owner can accept the BAA and turn on HIPAA in organization settings.
Is the free version of Claude HIPAA compliant?
No BAA is available on Free. Anthropic's support page says individual plans (Free, Pro, and Max) and Team plans can't enable HIPAA.
Does the Claude API BAA cover every API feature?
No. Anthropic's BAA covers a HIPAA-ready API organization and only the API features Anthropic lists as covered. Its BAA article lists features such as the Batch API and Files API as not covered.
Which Claude plan should a healthcare team use with patient data?
Claude Enterprise, after the Primary Owner accepts the BAA and enables HIPAA. Team, Pro, Max, and Free can't enable HIPAA. Rivvi is an AI workspace for healthcare teams. Rivvi's free organization plan (you and 2 colleagues) includes a HIPAA BAA.
Free to start. Most teams are using it the same day.
Get started for free