Free tool
Can I use this AI tool with patient data?
Pick a tool and the plan your team uses. The checker shows whether the vendor signs a HIPAA Business Associate Agreement (BAA) for that plan, what's excluded, and the vendor page we checked. A BAA covers specific plans and features, so a tool that is eligible on its enterprise plan is not covered on a personal or small-business account.
This tool runs in your browser. Nothing you enter is sent to Rivvi or stored.
No BAA
ChatGPT, Free, Plus, Pro
OpenAI's HIPAA guide (July 9, 2026) says consumer plans are not eligible services
Source: OpenAI HIPAA guide
Last verified October 1, 2026
| Plan | Notes | Source | ||
|---|---|---|---|---|
| ChatGPT | Free, Plus, Pro | No BAA | OpenAI's HIPAA guide (July 9, 2026) says consumer plans are not eligible services | OpenAI HIPAA guide |
| ChatGPT | Business (formerly Team) | No BAA | OpenAI: "we don't offer a BAA for ChatGPT Business" | OpenAI BAA help |
| ChatGPT | Enterprise / Edu (sales-managed) | BAA available | Sales-managed accounts only; Regulated Workspace turns off features that don't support HIPAA. Some features are excluded under the BAA | OpenAI HIPAA-eligible products |
| ChatGPT | ChatGPT for Healthcare | BAA available | Launched January 8, 2026 | OpenAI for healthcare |
| ChatGPT | ChatGPT for Clinicians | BAA available | Free for verified US physicians, NPs, PAs, pharmacists; in-product BAA flow (April 2026) | ChatGPT for clinicians |
| Claude | Free, Pro, Max, Team | No BAA | Anthropic: these plans can't enable HIPAA | Claude HIPAA-ready plans |
| Claude | Enterprise (HIPAA enabled) | BAA available | Only after the Primary Owner enables HIPAA; one-way. Cowork, beta features, Claude in Chrome and several API features excluded | Anthropic BAA |
| Claude | Anthropic API | BAA available | Some API features excluded (Batch, Files, Skills, code execution, computer use, web fetch) | Anthropic BAA |
| Google Gemini | Gemini in Workspace and Gemini app (Workspace) | BAA available | Under the Workspace BAA; Gemini in Chrome excluded | Google Workspace HIPAA |
| Google Gemini | Consumer Gemini | No BAA | Google warns not to enter confidential information | Gemini Apps Privacy Hub |
| Grammarly | Business Enterprise | BAA available | BAAs only for Enterprise | Grammarly HIPAA |
| Grammarly | Other plans | No BAA | Grammarly HIPAA | |
| Microsoft Copilot | Copilot and Copilot Chat (work Entra sign-in) | BAA available | Covered through Microsoft's DPA when properly configured; web search queries not covered | Microsoft enterprise data protection |
| Microsoft Copilot | Consumer (personal Microsoft account) | No BAA | For personal use | Copilot FAQ |
| OpenAI API | API with Modified Retention | BAA available | Request via baa@openai.com; web search not HIPAA eligible | OpenAI API data controls |
| Otter.ai | Enterprise | BAA available | HIPAA only on Enterprise | Otter HIPAA |
| Otter.ai | Other plans | No BAA | Otter HIPAA | |
| Perplexity | Enterprise | Unclear, check with vendor | Enterprise terms bar PHI unless a BAA is executed; plan not specified | Perplexity enterprise terms |
| Rivvi | Free and all paid plans | BAA available | HIPAA BAA included on the free plan; SOC 2 Type II | Rivvi security |
| Zoom | Paid plans | BAA available | Some AI features may be unavailable to healthcare customers with BAAs | Zoom BAA |
Vendors change plans and terms often. We check each source on the date shown. A BAA is necessary but not sufficient: your organization still needs policies, access controls, and minimum-necessary use.
How it's calculated
Each row is a vendor plan we checked against the source linked in the table, last verified October 1, 2026. Vendors change plans and terms often. A BAA is necessary but not sufficient: your organization still needs policies, access controls, and minimum-necessary use.