Is Claude HIPAA Compliant? What Anthropic's BAA Actually Covers (Current July 2026)

Short answer: not by default. Claude on the Free, Pro, Max, or Team plans does not include a Business Associate Agreement (BAA), and entering protected health information (PHI) into those plans is a HIPAA violation — no matter how careful you are. Claude can be used compliantly, but only through specific paths: Anthropic's HIPAA-ready Enterprise offering, a HIPAA-enabled API agreement, Claude through AWS Bedrock — or a purpose-built platform like Hathr.AI that runs Claude models inside AWS GovCloud with a BAA included on every plan.

This guide breaks down exactly which Claude surfaces are covered, which aren't, and what each path realistically requires. We review it monthly against Anthropic's published documentation. Also see the companion guide: Is ChatGPT HIPAA Compliant?

Which Claude plans include a BAA?

HIPAA requires a signed BAA with any vendor that creates, receives, maintains, or transmits PHI on your behalf. Here's where each Anthropic product stands as of July 2026:

Claude surfaceBAA available?What it takesClaude Free / Pro / MaxNoNever use with PHIClaude TeamNoNever use with PHIClaude Enterprise (HIPAA-ready)YesSales-assisted Enterprise plan; the org's Primary Owner enables HIPAA in admin settings and accepts the BAA; one-way decision with feature restrictionsClaude APIYesBAA for eligible organizations; requires a HIPAA-enabled org configuration; you build and secure everything around the modelClaude Console / WorkbenchNoExplicitly excluded from the BAAClaude Cowork & beta featuresNoNot coveredClaude CodeConditionalCovered only in specific configurations with zero data retention enabled — scope carefullyClaude via AWS BedrockYes (via AWS)AWS BAA covers the infrastructure; you're responsible for the application layerHathr.AI (Claude in AWS GovCloud)Yes — every planBAA signed within 24 hours, included at $45/month, hosted in a FedRAMP High environment

What changed in late 2025 — and why old advice is wrong

Until December 2025, the common guidance was simply "Claude can't be used with PHI." That's outdated. Anthropic now offers a HIPAA-ready Enterprise configuration with a click-to-accept BAA for eligible sales-assisted Enterprise customers, and its API BAA program has expanded.

But "a BAA exists" is not the same as "you're compliant." Three gaps trip up healthcare teams:

1. The BAA covers Anthropic's handling of data — not yours. Access controls, audit logging, workforce training, minimum-necessary enforcement, and six-year log retention remain your responsibility.
2. Coverage is surface-specific. A clinician with an Enterprise seat is covered in the chat interface, but a colleague pasting the same chart into Claude Pro on their personal account is a reportable violation. Claude Console, Workbench, Cowork, and beta features stay out of scope even inside a covered org.
3. Enablement has real friction. The Enterprise path runs through a sales-assisted plan, admin-level enablement by the org's Primary Owner, an irreversible configuration change, and ongoing monitoring as Anthropic ships new features that each need a compliance review.

Is the Claude API HIPAA compliant?

The API can be operated compliantly under a BAA within a HIPAA-enabled organization, but the burden shifts to your engineering team: encryption in transit and at rest, key management, scoped API credentials, application-level audit trails, and making sure PHI never leaks into logging pipelines, analytics tools, or observability stacks outside your BAA chain. For most clinics, practices, and legal teams, building that infrastructure costs far more than the API calls. If you want Claude's API capabilities without building that stack, Hathr's HIPAA compliant AI API ships with the BAA and GovCloud boundary already in place.

Is Claude Enterprise HIPAA compliant?

It can be, once HIPAA is enabled and the BAA is accepted by the organization's Primary Owner. Plan for the sales cycle, configuration requirements, and feature restrictions — and note that individual, Team, and self-serve Enterprise accounts can't enable it. For a solo practitioner or a 10-person practice, this path usually isn't accessible.

How Hathr.AI is different

Every path above shares the same trade-off: to use Claude compliantly, you either take on an enterprise procurement cycle or take on the engineering burden yourself. Hathr.AI was built to remove that trade-off entirely.

Same Claude models, stricter environment. Hathr runs Anthropic's Claude models inside AWS GovCloud — a FedRAMP High environment used by federal health agencies, and a stricter hosting standard than the commercial cloud behind Claude Enterprise or the standard API.

The BAA is the starting point, not the finish line. Every Hathr plan includes a signed BAA within 24 hours of signup — no sales call, no seat minimums, no admin-enablement maze, no surfaces that quietly fall outside coverage. The whole platform sits inside the compliance boundary.

Built for the work, not just the model. Instead of a blank chat box, Hathr ships the workflows regulated teams actually run: chart and documentation review on records over 500,000 words, prior authorization and Medicare appeal drafting, legal medical-record analysis, and secure document summarization and Q&A with cited answers.

Priced for real teams. $45 per user per month. A solo therapist, a 12-person law firm, and a government program office all get the same coverage a health system negotiates for months to obtain.

Your data stays yours. Documents are never used to train any AI model and never leave the GovCloud boundary.

In short: if your organization has the scale and patience for Anthropic's Enterprise path, it's a legitimate option. If you need Claude-quality AI that's compliant today, Hathr is the fastest defensible route.

Start your free 7-day trial →  Learn more about why teams choose Hathr →

Frequently asked questions

Is Claude AI HIPAA compliant by default?

No. No Claude plan is HIPAA compliant out of the box. Compliance requires a covered surface, a signed BAA, correct configuration, and your own administrative safeguards.

Does Anthropic sign a BAA?

Yes, for specific products: the HIPAA-ready Enterprise plan (enabled by the org's Primary Owner) and eligible API organizations. Free, Pro, Max, Team, Console, Workbench, and Cowork are not covered.

Can I use Claude Pro or Team with patient data if I de-identify it?

Only if the data meets HIPAA's Safe Harbor or expert-determination standards — all 18 identifiers removed. Partial redaction doesn't qualify, and subtle identifiers frequently survive manual cleanup. The safe rule: no PHI on non-BAA plans, period.

Is Claude on AWS Bedrock HIPAA compliant?

Bedrock can be HIPAA-eligible under AWS's BAA, which covers the infrastructure layer. Your application, access controls, and logging remain your responsibility, and even then, commercial Amazon Web Services still pass information to Anthropic.

What's the difference between Hathr.AI and Claude Enterprise for HIPAA?

Both provide BAA-covered access to Claude models. Claude Enterprise requires a sales-assisted enterprise plan and admin-level HIPAA enablement; Hathr includes the BAA on every plan starting at $47/month, hosts in AWS GovCloud (FedRAMP High), and ships healthcare-specific document workflows out of the box. Start a free trial or learn more.

Is ChatGPT HIPAA compliant?

Consumer ChatGPT is not. OpenAI now offers BAA-supported healthcare and enterprise paths, which — like Anthropic's — are enterprise-oriented and require large seat counts, hard to sign BAAs, and other hurdles. Read the full guide: Is ChatGPT HIPAA Compliant?

‍

Last updated: July 2026 — reviewed against Anthropic's current BAA documentation.