Checked October 21, 2026

HIPAA compliant AI: which tools sign a BAA?

A BAA is a contract on a plan. A logo is not a BAA.

No AI tool is HIPAA compliant on its own. It has to sign a BAA on the plan your team uses, keep your data out of training, and log access. ChatGPT and Claude sign a BAA only on plans set up for it, such as ChatGPT for Healthcare, ChatGPT Enterprise with a Regulated Workspace, and Claude Enterprise. Their free and personal plans do not.

Ask Rivvi

Ask about a BAA.

Opens a workspace. Rivvi explains the public record. It does not decide coding or eligibility.

What makes an AI tool HIPAA compliant

HIPAA does not certify software. An AI tool is usable with protected health information when the vendor signs a Business Associate Agreement for the plan your team uses, and that plan covers the features you use. The same product can be covered on its enterprise plan and not on the personal one.

That is why this page goes plan by plan. Every row below links the vendor page it came from and quotes it, so you can check the source yourself. What HIPAA-compliant AI means and what a BAA covers are in the glossary.

Which AI tools sign a BAA, plan by plan

Rivvi read each vendor's own pages on October 21, 2026. Open a tool for the quote behind every row, plus training, retention, and access logs where the vendor states them. Check one tool and plan at a time.

BastionGPT

Checked
  • Every planBAA availableBastionGPT's help center says every plan, including API access, includes its BAA, which you agree to electronically when you accept the terms at signup. A countersigned DocuSign copy is available on request, and Enterprise customers can ask for a custom BAA. support.bastiongpt.com

ChatGPT

Checked
  • FreeNo BAANot on OpenAI's list of HIPAA eligible products, which names ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT FedRAMP, ChatGPT for Clinicians, and the API with Modified Retention. help.openai.com
  • GoNo BAANot on OpenAI's list of HIPAA eligible products, which names ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT FedRAMP, ChatGPT for Clinicians, and the API with Modified Retention. help.openai.com
  • PlusNo BAANot on OpenAI's list of HIPAA eligible products, which names ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT FedRAMP, ChatGPT for Clinicians, and the API with Modified Retention. help.openai.com
  • ProNo BAANot on OpenAI's list of HIPAA eligible products, which names ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT FedRAMP, ChatGPT for Clinicians, and the API with Modified Retention. help.openai.com
  • BusinessNo BAAhelp.openai.com
  • EnterpriseConditionalOnly with a Regulated Workspace. help.openai.com
  • EduConditionalOnly for a sales-managed Edu account, with the BAA arranged through OpenAI sales. help.openai.com
  • ChatGPT for HealthcareBAA availablehelp.openai.com
  • ChatGPT for CliniciansConditionalOnly for individual verified U.S. clinicians (physicians, nurse practitioners, physician assistants, and pharmacists), who sign the BAA themselves in Settings > Agreements. help.openai.com
  • ChatGPT HealthNo BAAHealth is a consumer feature for Free, Go, Plus, and Pro users and is not on OpenAI's list of HIPAA eligible products. help.openai.com
  • APIConditionalRequires an executed OpenAI BAA and an organization provisioned with Modified Retention. help.openai.com

CompliantChatGPT

Checked
  • Any paid planBAA availableThe product page says you request the BAA from Settings on any paid plan, and that signing it is required to use the platform in a fully HIPAA-compliant way. The pricing page lists a standard BAA on every plan. compliantchatgpt.com
  • EnterpriseBAA availableThe BAA page says Enterprise customers get a custom BAA negotiated to their organization's specifications. compliantchatgpt.com

DeepSeek

Checked
  • DeepSeek apps, website, and related servicesNo BAADeepSeek's privacy policy says its services are not designed to process sensitive data such as health information and asks users not to provide it. It also says personal data is stored in the People's Republic of China. No BAA offer appears on the pages checked. cdn.deepseek.com

Dropbox

Checked
  • StandardConditionalDropbox lists HIPAA compliance as included on this team plan, and a team admin signs the BAA electronically from the Account page in the admin console before any PHI is uploaded. dropbox.com
  • AdvancedConditionalDropbox lists HIPAA compliance as included on this team plan, and a team admin signs the BAA electronically from the Account page in the admin console before any PHI is uploaded. dropbox.com
  • EnterpriseConditionalDropbox lists HIPAA compliance as included on this team plan, and a team admin signs the BAA electronically from the Account page in the admin console before any PHI is uploaded. dropbox.com
  • PlusNo BAADropbox's plan comparison marks Enable HIPAA compliance as not included on Plus. dropbox.com
  • Basic (free)No BAADropbox ties the BAA to Dropbox team plans, which the free Basic plan is not. help.dropbox.com

Fireflies

Checked
  • EnterpriseConditionalFireflies says its healthcare BAA is available on Enterprise with Private Storage. fireflies.ai
  • BusinessNo BAAFireflies says the BAA is available on Enterprise with Private Storage. fireflies.ai
  • ProNo BAAFireflies says the BAA is available on Enterprise with Private Storage. fireflies.ai
  • FreeNo BAAFireflies says the BAA is available on Enterprise with Private Storage. fireflies.ai

Gemini

Checked
  • Gemini in Google WorkspaceConditionalOnly for a Google Workspace organization whose administrator has reviewed and accepted the Google Workspace BAA. docs.cloud.google.com
  • Gemini app with a Google Workspace work or school accountConditionalOnly for a Google Workspace organization whose administrator has accepted the Google Workspace BAA, and Gemini in Google Chrome is excluded. docs.cloud.google.com
  • Gemini in ChromeNo BAAsupport.google.com
  • Gemini Enterprise (Google Cloud)ConditionalOnly after the customer reviews and accepts a Google Cloud BAA. docs.cloud.google.com

Gmail

Checked
  • Gmail in Google WorkspaceConditionalOnly for a Google Workspace organization whose administrator has reviewed and accepted the Google Workspace BAA. docs.cloud.google.com
  • Gemini features in Gmail (Help me write, contextual smart replies, side panel)ConditionalOnly for a Google Workspace organization whose administrator has reviewed and accepted the Google Workspace BAA. knowledge.workspace.google.com

Google Drive

Checked
  • Google Drive in Google Workspace (including Docs, Sheets, Slides, Forms, and Vids)ConditionalOnly for a Google Workspace organization whose administrator has reviewed and accepted the Google Workspace BAA. docs.cloud.google.com

Grammarly

Checked
  • Grammarly for Business EnterpriseConditionalGrammarly says BAAs are available only on Grammarly for Business Enterprise plans, which you arrange through its Sales team. support.grammarly.com
  • ProNo BAAGrammarly says it enters into BAAs only for Grammarly for Business Enterprise plans. support.grammarly.com
  • FreeNo BAAGrammarly says it enters into BAAs only for Grammarly for Business Enterprise plans. support.grammarly.com

Grok

Checked
  • API (business and enterprise customers)ConditionalThe Enterprise FAQ on x.ai says it can support HIPAA compliance under some circumstances and asks customers to inquire through a BAA Questionnaire, which it describes as for customers using its APIs. The team reviews each request. x.ai

Microsoft 365

Checked
  • Microsoft 365 and Office 365 commercial cloudBAA availableThe BAA is included by default in the Data Protection Addendum for customers who are covered entities or business associates, and it covers only the in-scope services Microsoft lists, such as Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams. learn.microsoft.com
  • Office 365 U.S. Government (GCC)BAA availableCovers only the in-scope GCC services Microsoft lists. learn.microsoft.com

Microsoft Copilot

Checked
  • Microsoft Copilot and Microsoft Copilot Chat (organizational use)ConditionalCovered under the Microsoft BAA only for properly configured implementations, and web search queries sent to Bing are not covered. learn.microsoft.com

Microsoft Teams

Checked
  • Microsoft Teams in Microsoft 365 and Office 365 commercial cloudBAA availableCovered under the Microsoft BAA that is included by default in the Data Protection Addendum for customers who are covered entities or business associates. learn.microsoft.com
  • Microsoft Teams in Office 365 U.S. Government (GCC)BAA availableCovered under the same Microsoft BAA for GCC customers. learn.microsoft.com

Notion

Checked
  • EnterpriseConditionalA workspace owner must activate HIPAA compliance in workspace settings and accept the BAA, and Beta Services are not covered. notion.com
  • BusinessNo BAANotion says BAA eligibility requires the Enterprise plan. notion.com
  • PlusNo BAANotion says BAA eligibility requires the Enterprise plan. notion.com
  • FreeNo BAANotion says BAA eligibility requires the Enterprise plan. notion.com

Otter

Checked
  • EnterpriseConditionalOtter lists HIPAA compliance as an Enterprise add-on, and you start the BAA process through your account manager or Otter's Sales team. help.otter.ai
  • BusinessNo BAAOtter says HIPAA compliance is only available on the Enterprise plan. help.otter.ai
  • ProNo BAAOtter says HIPAA compliance is only available on the Enterprise plan. help.otter.ai
  • Basic (free)No BAAOtter says HIPAA compliance is only available on the Enterprise plan. help.otter.ai

Perplexity

Checked
  • Enterprise Pro and Enterprise MaxConditionalPerplexity's Enterprise terms bar protected health information unless the customer and Perplexity have executed a Business Associate Agreement. The pages checked do not say how to request one or which plans qualify. perplexity.ai
  • Pro and Max (Perplexity Health)No BAAPerplexity's help center says Perplexity Health, included with Pro and Max, is designed for personal wellness and that HIPAA does not apply to it. No BAA offer for consumer plans appears on the pages checked. perplexity.ai

Slack

Checked
  • Enterprise+ and Enterprise GridConditionalSlack says you must buy Slack HIPAA Enabled with a covered enterprise plan, sign a BAA, and follow the Slack Guide for HIPAA Entities. salesforce.com
  • Business+No BAASlack says HIPAA support requires a Slack Enterprise plan. slack.com
  • ProNo BAASlack says HIPAA support requires a Slack Enterprise plan. slack.com
  • FreeNo BAASlack says HIPAA support requires a Slack Enterprise plan. slack.com

Zoom AI Companion

Checked
  • Paid Zoom plans with a signed BAA (Pro, Business, Business Plus, Enterprise)ConditionalZoom says AI features are available to customers with a BAA in place, but certain AI features may not be available for healthcare customers with BAAs. support.zoom.com
  • Basic (free)No BAAZoom describes BAAs for its healthcare plans and other paid plans, which leaves out the free Basic plan. support.zoom.com

Zoom

Checked
  • ProConditionalZoom says you accept the BAA yourself at checkout on the healthcare pricing page, or enable it later in Plan Management. support.zoom.com
  • BusinessConditionalZoom says to contact Sales to sign a BAA when purchasing this plan. support.zoom.com
  • Business PlusConditionalZoom says to contact Sales to sign a BAA when purchasing this plan. support.zoom.com
  • EnterpriseConditionalZoom says to contact Sales to sign a BAA when purchasing this plan. support.zoom.com
  • Basic (free)No BAAZoom describes BAAs for its healthcare plans and other paid plans, which leaves out the free Basic plan. support.zoom.com

HIPAA compliant ChatGPT, GPT, and LLMs

ChatGPT is covered only on the plans OpenAI lists as HIPAA eligible. Is ChatGPT HIPAA compliant has every plan, and ChatGPT for healthcare covers ChatGPT for Healthcare, ChatGPT for Clinicians, and ChatGPT Health.

A custom GPT, a chatbot, or an AI assistant built on a large language model inherits the BAA of the product it runs in. If the plan underneath does not sign one, neither does the assistant. The OpenAI and Anthropic APIs offer a BAA under the conditions in the table above.

Free HIPAA compliant AI

Most free AI plans do not include a BAA. Rivvi's free plan does, for you and two colleagues. Best free HIPAA-compliant AI for healthcare, compared puts the free options side by side.

Five questions to ask the vendor

  1. Which plan signs a BAA?
  2. Which roles does that plan cover?
  3. Is customer data used for model training?
  4. How long is data kept?
  5. Does the vendor log access?

The AI vendor BAA checklist turns these into a printable review.

Who is left out

A plan for clinicians covers the clinicians on it. ChatGPT for Clinicians is for individual verified U.S. physicians, nurse practitioners, physician assistants, and pharmacists, who each sign the BAA themselves. The front desk, MAs, billers, coders, and the rest of the team need a plan that covers their own logins.

Unapproved AI

Wolters Kluwer Health reported that nearly 17% of healthcare professionals in its survey had used an AI tool their employer did not approve. Wolters Kluwer Health, 2026. The published finding is unapproved use. It does not say those workers entered identifiable patient data.

Rivvi

HIPAA BAA included

A HIPAA BAA is included on every plan, Free included.

Ask it like ChatGPT, with patient data allowed.

Questions

Is any AI tool HIPAA compliant on its own?
No AI tool is HIPAA compliant on its own. It has to sign a BAA on the plan your team uses, keep your data out of training, and log access. ChatGPT and Claude sign a BAA only on plans set up for it, such as ChatGPT for Healthcare, ChatGPT Enterprise with a Regulated Workspace, and Claude Enterprise. Their free and personal plans do not.
Which ChatGPT plan signs a BAA?
Free, Go, Plus, and Pro: no BAA. Not on OpenAI's list of HIPAA eligible products, which names ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT FedRAMP, ChatGPT for Clinicians, and the API with Modified Retention. Business: no BAA. Enterprise: Only with a Regulated Workspace. Edu: Only for a sales-managed Edu account, with the BAA arranged through OpenAI sales. ChatGPT for Healthcare: BAA available. ChatGPT for Clinicians: Only for individual verified U.S. clinicians (physicians, nurse practitioners, physician assistants, and pharmacists), who sign the BAA themselves in Settings > Agreements. ChatGPT Health: no BAA. Health is a consumer feature for Free, Go, Plus, and Pro users and is not on OpenAI's list of HIPAA eligible products. API: Requires an executed OpenAI BAA and an organization provisioned with Modified Retention.
Which Claude plan signs a BAA?
Free, Pro, and Max: no BAA. Team: no BAA. Team plans cannot enable HIPAA. Enterprise: Only after the organization's Primary Owner accepts the BAA and enables HIPAA in organization settings. API: Covers a HIPAA-ready API organization, and only the API features Anthropic lists as covered.
Is there a HIPAA compliant LLM or AI assistant?
A large language model is HIPAA compliant only inside a product or API whose vendor signs a BAA for it. OpenAI and Anthropic offer a BAA on their APIs under conditions listed above. An AI assistant or chatbot for a healthcare team needs the same thing: a BAA on the plan every user logs into.
Is there a free HIPAA compliant AI?
Most free AI plans do not include a BAA. Rivvi's free plan does: a HIPAA BAA is included for you and two colleagues. The comparison of free options is on the best free healthcare AI page.
Does Rivvi sign a BAA?
Yes. A HIPAA BAA is included on every plan, Free included.

Try it on your own data today.

Free to start. Most teams are using it the same day.

Get started for freeSee pricing