Is ChatGPT HIPAA Compliant?

HIPAA applies to covered entities and their business associates. Covered entities are health plans, health care clearinghouses, and providers who conduct certain standard transactions electronically, such as billing. A business associate is a vendor that creates, receives, stores or transmits protected health information on a covered entity's behalf. Protected health information (PHI) is individually identifiable health information: anything linking a person to their health, their care or payment for it. Three rules matter most. The Privacy Rule limits how PHI can be used and disclosed. The Security Rule requires administrative, physical and technical safeguards for electronic PHI. The Breach Notification Rule requires notice when unsecured PHI is compromised. Before a covered entity shares PHI with a vendor, it needs a signed BAA in which the vendor agrees to protect the data and report incidents. So the honest answer to whether ChatGPT is HIPAA compliant is: it depends on which product, under what contract, configured how. Consumer ChatGPT plans come without a BAA, so clinicians and staff should never put PHI into them. OpenAI states that it can sign BAAs for some API and business customers after review. Large cloud platforms include certain AI model services in their HIPAA programs, and other AI vendors offer BAAs on business plans. Always check the vendor's current list of covered services, because coverage often excludes some features. Several misconceptions are common. There is no official government HIPAA certification, so a "HIPAA certified" badge is marketing. Turning off model training or deleting a chat does not create a BAA. Removing a name alone does not de-identify data. Under the Safe Harbor method, 18 kinds of identifiers must be removed, including dates more specific than the year and most geographic detail smaller than a state. The alternative is formal Expert Determination. Clinical free text often hides identifiers in dates, rare diagnoses or small-town references. Never paste names, dates of birth, medical record numbers, addresses, phone numbers, dates of service, full notes or identifiable images into an unapproved chatbot.