Do You Need a BAA to Use ChatGPT in a Medical Practice?

Key takeaways

• Only ChatGPT Enterprise (sales-managed) and ChatGPT for Healthcare (launched Jan 2026) offer BAA coverage. Entering PHI into any non-BAA product is a HIPAA violation, regardless of how secure the vendor's infrastructure is.

TL;DR

• Direct answer: No, standard ChatGPT (Free, Plus, Pro) does not offer a BAA and cannot be used with patient data under HIPAA.
• Enterprise option: ChatGPT Enterprise and ChatGPT for Healthcare can include a BAA, but only for sales-managed accounts with explicit execution.
• Penalty exposure: Using ChatGPT without a BAA to handle PHI creates a presumptive breach under the HIPAA Breach Notification Rule, with OCR penalties ranging from $100 to $50,000 per violation.
• Compliant alternatives: Purpose-built healthcare AI platforms and major cloud AI providers sign BAAs and provide HIPAA-ready environments.

Do You Need a BAA to Use ChatGPT in a Medical Practice?

Yes, if you are entering patient data into ChatGPT, you need a Business Associate Agreement. Standard ChatGPT does not offer a BAA for Free, Plus, Pro, or Team plans. Using any of these tiers with protected health information (PHI) constitutes an unauthorized disclosure under 45 CFR 164.502(e) and is a reportable HIPAA breach.

If you want a broader foundation before diving into the specifics of ChatGPT, the HIPAA-Compliant AI for Healthcare Providers: The Complete 2026 Guide covers the full compliance landscape across AI tools, infrastructure requirements, and vendor evaluation frameworks.

This article focuses on the BAA requirement specifically: what OpenAI offers, the real enforcement risks, and which AI tools do sign BAAs for healthcare use.

What Is a BAA and Why Does It Matter for AI Tools?

A Business Associate Agreement is a legally binding contract between a covered entity (your medical practice) and a vendor that handles PHI on your behalf. Under 45 CFR 164.502(e), a covered entity cannot disclose PHI to any vendor unless that vendor has signed a BAA specifying permitted uses, safeguarding obligations, and breach notification requirements.

HHS guidance on cloud computing explicitly states that any cloud service provider that "creates, receives, maintains, or transmits" PHI on behalf of a covered entity is a Business Associate, even if the provider cannot decrypt or view the data. When you paste a patient's name, date of birth, and diagnosis into ChatGPT, you are transmitting PHI to OpenAI's servers. Without a BAA, that transmission itself is the violation.

A BAA is not optional compliance theater. HIPAA compliance is not a property of software, it is a property of a signed contract.

Does OpenAI Offer a BAA to Use ChatGPT in a Medical Practice?

No, not for consumer or self-serve plans. OpenAI explicitly states it does not offer a BAA for ChatGPT Free, Plus, Pro, Team, or self-serve Business.

ChatGPT Enterprise (sales-managed only): Only customers with a sales-managed account are eligible for a BAA. You cannot purchase Enterprise through ChatGPT.com's standard interface, you must contact OpenAI's sales team and have the BAA explicitly executed.

ChatGPT for Healthcare (launched Jan 2026): Designed for hospitals and clinicians, this product includes data isolation, no training on inputs, and BAA availability. Like Enterprise, it requires a sales-managed account and explicit BAA execution.

OpenAI API: Eligible for a Data Processing Agreement that includes BAA terms, but this requires separate negotiation and is not universally available.

One critical point: signing a BAA does not automatically make ChatGPT HIPAA compliant. Your practice must also implement the HIPAA Security Rule's administrative, physical, and technical safeguards, aligned with frameworks such as NIST SP 800-53, document the tool in your Risk Analysis, and establish acceptable use policies.

What Are the Real HIPAA Risks of Using ChatGPT Without a BAA?

Using ChatGPT to draft clinical notes, summarize patient records, or compose referral letters without a BAA creates immediate legal exposure.

• Clinical documentation: Copying a patient's name, date of birth, diagnosis, and medications into ChatGPT is PHI transmission to a non-BAA vendor. Under 45 CFR 164.402, this is presumed to be a breach unless the practice can demonstrate a low probability of compromise, nearly impossible when data has been sent to a third-party AI vendor.
• Referral letters: Even if the practice later de-identifies the output, the input itself was a breach. Contextual clues (rare diagnosis, specific provider, geographic details) often enable re-identification even without a patient name.
• Billing and coding: Pasting a patient's name and clinical history into a prompt to map diagnosis codes is a PHI disclosure without a BAA.

OCR penalties range from $100 to $50,000 per violation category per year. Willful neglect carries a minimum of $12,794 per incident. If a breach affects 500 or more individuals in a single jurisdiction, the practice must also notify HHS and local media, within 60 calendar days of discovery.

Can You Use ChatGPT Safely Without Entering PHI to Use ChatGPT in a Medical Practice?

Yes, but only for tasks that categorically exclude patient data. Safe uses include drafting general patient education templates, creating staff training scenarios, and writing administrative frameworks, none referencing specific patients.

Prohibited uses include entering any patient name, medical record number, diagnosis, lab result, or clinical note, even with names removed. Many practices believe they can "scrub" PHI before entering data. This is insufficient. HIPAA's Safe Harbor standard requires removal of all 18 identifiers, and contextual clues in prompts can still enable re-identification in small populations.

Which AI Tools Do Sign BAAs for Healthcare Use?

Several vendors offer HIPAA-compliant environments with signed BAAs:

Hathr.AI is HIPAA-Compliant, built on FedRAMP High Infrastructure, and follows NIST 800-53 controls. It is powered by a Government-Approved Claude, trusted by 3,000+ organizations including the U.S. Dept of Health & Human Services, and can upload up to 100,000 pages per workspace, letting you read full case files, chart histories, and payer packs. The FedRAMP Marketplace lists federally authorized cloud services for reference when evaluating infrastructure credentials.

For medical practices that need a purpose-built, immediately deployable solution, Hathr.AI removes the procurement friction that makes enterprise cloud AI difficult for smaller practices.

Frequently Asked Questions

Does OpenAI sign a BAA for ChatGPT Enterprise or the API?

Yes, but only for sales-managed accounts with explicit contract execution. Consumer and self-serve plans have no BAA pathway.

What happens if a practice uses ChatGPT with patient data and no BAA?

The disclosure itself is the HIPAA violation. The practice must notify affected patients within 60 days, report to HHS, and may face OCR penalties of $100 to $50,000 per violation. Willful neglect carries a minimum of $12,794 per incident.

Is a BAA alone enough to make an AI tool HIPAA compliant?

No. A BAA is necessary but not sufficient. Your practice must also document the tool in your Risk Analysis, establish acceptable use policies, train staff, and maintain audit logs.

Can you use ChatGPT for medical billing without violating HIPAA?

Only if you never enter patient identifiers, diagnosis codes, or claim details. General billing process questions are safe; patient-specific billing is not.

What should a BAA with an AI vendor include?

Permitted uses of PHI, safeguarding obligations, breach reporting requirements, subcontractor compliance terms, and data retention and deletion procedures. Review the HHS sample BAA provisions as a baseline before signing.

Try Hathr.AI free. HIPAA-Compliant, built on FedRAMP High Infrastructure. BAA provided on signup. Zero data retention by default. No usage limits, no seat minimums. Start a free trial ->