What makes AI HIPAA-compliant
HIPAA-compliant AI is software that can legally handle protected health information. The non-negotiable requirement is a signed Business Associate Agreement between the organization (the covered entity) and the AI vendor (the business associate), plus administrative, physical, and technical safeguards under the HIPAA Security Rule.
The catch is scope. A BAA usually covers specific plans and features, not a whole brand. OpenAI lists ChatGPT Free, Go, Plus, Pro, and Business as outside its HIPAA eligible products. Anthropic says Claude Free, Pro, Max, and Team can't enable HIPAA. Staff using a personal account are outside every vendor's agreement. The vendor guides below list each plan, with sources and the date we checked.
Rivvi is a HIPAA-compliant AI workspace: staff chat with it, upload patient lists and payer files, and analyze them inside an AI that learns the organization. Rivvi's free organization plan is you and two colleagues, with a HIPAA BAA included. The free personal plan is public information only. No card to start. Rivvi is SOC 2 Type II, patient data is not used to train third-party models, and every agent action that touches PHI is logged with who, what, and when.