HIPAA
HIPAA compliant chatbot: what it takes
A BAA on your plan, plus access controls, audit logs, and careful data handling.
A chatbot is HIPAA compliant only when its vendor signs a Business Associate Agreement (BAA) for the plan you use, and the setup limits access by role, logs every access to patient data, encrypts it, and keeps it out of model training. The brand name alone settles none of that.
What makes a chatbot HIPAA compliant
| Requirement | What the HIPAA rule says | Ask the vendor | Rivvi |
|---|---|---|---|
| Business Associate Agreement | A covered entity may permit a business associate to create, receive, maintain, or transmit electronic protected health information on the covered entity's behalf only if the covered entity obtains satisfactory assurances, in accordance with § 164.314(a), that the business associate will appropriately safeguard the information.45 CFR 164.308(b) | Which plan signs a BAA, who signs it, and which features does it cover? | A HIPAA BAA, e-signed in the app before any patient data moves. |
| Access controls | Implement technical policies and procedures for electronic information systems that maintain electronic protected health information to allow access only to those persons or software programs that have been granted access rights as specified in § 164.308(a)(4).45 CFR 164.312(a) | Does every user get a unique login, and can you limit who sees patient data by role? | Access follows the role: Admin, Full access, Read only, or No patient data. |
| Audit logs | Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.45 CFR 164.312(b) | Is every access to patient data logged, and can an admin read or export that log? | Consent and policy changes kept seven years. Every agent action on PHI logged with who, what, and when. |
| Encryption | Implement a mechanism to encrypt and decrypt electronic protected health information.45 CFR 164.312(a)(2)(iv) and (e)(2)(ii) | Is data encrypted at rest and in transit, and who holds the keys? | Encrypted at rest with AWS KMS. |
| Data handling and minimum necessary | a covered entity or business associate must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.45 CFR 164.502(b) | Is our data used to train models? How long is it kept, and can we delete it? | Your data never trains anyone else's model. |
How to evaluate a chatbot
- Get the BAA in writing for the exact plan every user logs into, not a parent product.
- Check which features the BAA covers. Uploads, voice, browsing, and plugins are often listed separately.
- Confirm each user has a unique login and that roles can block patient data.
- Ask to see the access log an admin can read.
- Read the data-use terms: training, retention, and deletion.
- If patients talk to it on your website, check that the website chat is on the BAA plan too.
The AI vendor BAA checklist turns these into a fill-in review.
AI chatbots: which plans sign a BAA
From each vendor's own pages, checked October 23, 2026. Open a tool for the quote behind each plan.
| Chatbot | Plans with a BAA | Plans without |
|---|---|---|
| Otter | Enterprise | Business, Pro, Basic (free) |
| Grammarly | Grammarly for Business Enterprise | Pro, Free |
| Perplexity | Enterprise Pro and Enterprise Max | Pro and Max (Perplexity Health) |
| Fireflies | Enterprise | Business, Pro, Free |
| Zoom AI Companion | Paid Zoom plans with a signed BAA (Pro, Business, Business Plus, Enterprise) | Basic (free) |
| DeepSeek | None | DeepSeek apps, website, and related services |
| Grok | xAI API | None listed |
| BastionGPT | Every plan | None listed |
| CompliantChatGPT | Any paid plan, Enterprise | None listed |
| ChatGPT | Enterprise, Edu, ChatGPT for Healthcare, ChatGPT for Clinicians, API | Free, Go, Plus, Pro, Business, ChatGPT Health |
| Claude | Enterprise, API | Free, Pro, Max, Team |
| Gemini | Gemini in Google Workspace, Gemini app with a Google Workspace work or school account, Gemini Enterprise (Google Cloud) | Gemini in Chrome |
| Microsoft Copilot | Microsoft Copilot and Microsoft Copilot Chat (organizational use) | None listed |
Where Rivvi fits
- BAA
- The free organization plan (you and 2 colleagues) includes a HIPAA BAA, e-signed in the app before any patient data moves. The free personal plan is public information only.
- SOC 2
- Rivvi is SOC 2 Type II.
- Website chat
- Calls, texts, the website widget, and a phone number are on Team.
Rivvi security has the details.
Questions
Is there a HIPAA compliant chatbot?
Yes, on the right plan. Vendors that say they sign a BAA on at least one plan include Otter, Grammarly, Perplexity, Fireflies, Zoom AI Companion, Grok. Free and personal plans usually do not.
Is ChatGPT a HIPAA compliant chatbot?
Only on plans OpenAI lists as HIPAA eligible, after a BAA is in place. Free, Plus, and the other personal plans do not include one. The ChatGPT guide lists every plan.
Does a HIPAA compliant chatbot need a BAA?
Yes, when the chatbot vendor creates, receives, keeps, or sends protected health information for you. 45 CFR 164.308(b) requires satisfactory assurances, which 164.314(a) sets out as a business associate contract.
Can a website chatbot for patients be HIPAA compliant?
Yes, if the vendor signs a BAA that covers the website chat itself and the messages are encrypted, logged, and kept out of model training. Check that the widget is on the BAA plan, not only the staff app.
Does Rivvi sign a BAA?
Yes. Rivvi's free organization plan (you and 2 colleagues) includes a HIPAA BAA, e-signed in the app before any patient data moves. Rivvi is SOC 2 Type II.
Related
Source: 45 CFR Part 164 on eCFR and each vendor's own pages. Checked . Last updated . How Rivvi sources data. Spot an error? hello@rivvi.ai.
Free to start. Most teams are using it the same day.
Get started for free