BAA guide
Is Grok HIPAA compliant?
Plan by plan, from Grok's own pages.
Only on a plan where the vendor signs a BAA. Grok is not HIPAA compliant on its own. API (business and enterprise customers): The Enterprise FAQ on x.ai says it can support HIPAA compliance under some circumstances and asks customers to inquire through a BAA Questionnaire, which it describes as for customers using its APIs. The team reviews each request.
Checked against Grok's own pages, linked in the table.
Which Grok plans sign a BAA
| Plan | BAA | Condition | What the vendor page says |
|---|---|---|---|
| API (business and enterprise customers) | BAA only if the condition is met | The Enterprise FAQ on x.ai says it can support HIPAA compliance under some circumstances and asks customers to inquire through a BAA Questionnaire, which it describes as for customers using its APIs. The team reviews each request. | Under some circumstances, we can support a customer's HIPAA compliance obligations. To inquire about a Business Associate Agreement (BAA), please complete our BAA Questionnaire. A member of our team will review your responses and reach out with next steps.x.ai |
Training, retention, and access logs
- Model training
- The Enterprise FAQ on x.ai says business data, including prompts and outputs, is not used to train its models, unless a customer accepts free credits in exchange for allowing it.
- Retention
- The Enterprise FAQ on x.ai says inputs and outputs are automatically deleted within 30 days unless otherwise agreed in writing or required to be kept by law.
- Access logs
- The x.ai security page says Business Tier accounts get a 90 day in-app audit trail that can be exported from the admin console.
Rivvi
HIPAA BAA included
Rivvi's free organization plan (you and 2 colleagues) includes a HIPAA BAA, e-signed in the app before any patient data moves. The free personal plan is public information only.
Questions
Does Grok offer a BAA?
The Enterprise FAQ on x.ai says it can support a customer's HIPAA compliance under some circumstances. Customers inquire by completing a BAA Questionnaire, and the team reviews the answers before reaching out with next steps.
Which Grok products does the BAA questionnaire cover?
The x.ai BAA Questionnaire says it is for customers requesting a BAA to enable HIPAA compliance when using its APIs. The pages Rivvi checked do not describe a BAA for the consumer Grok app or SuperGrok.
Does xAI train on business data?
The Enterprise FAQ on x.ai says it does not use business data, including prompts and outputs, to train its models, unless a customer agrees to allow it in exchange for free credits. Rivvi is an AI workspace for healthcare teams. Rivvi's free organization plan (you and 2 colleagues) includes a HIPAA BAA.
Free to start. Most teams are using it the same day.
Get started for free