Society GUIDE
Is ChatGPT HIPAA Compliant?
Consumer ChatGPT, meaning the Free, Plus, Pro and other individual plans, is not suitable for protected health information under HIPAA, because OpenAI does not sign a business associate agreement (BAA) for those plans.
On this page4 min read
Overview
A HIPAA-covered organization can use an AI service with patient data only if the vendor signs a BAA and the service is set up to meet HIPAA's safeguards. OpenAI says it can offer BAAs for certain API and sales-managed business products after review, and several cloud AI services offer them too.
Deep Dive
HIPAA applies to covered entities and their business associates. Covered entities are health plans, health care clearinghouses, and providers who conduct certain standard transactions electronically, such as billing. A business associate is a vendor that creates, receives, stores or transmits protected health information on a covered entity's behalf. Protected health information (PHI) is individually identifiable health information: anything linking a person to their health, their care or payment for it.
Three rules matter most. The Privacy Rule limits how PHI can be used and disclosed. The Security Rule requires administrative, physical and technical safeguards for electronic PHI. The Breach Notification Rule requires notice when unsecured PHI is compromised. Before a covered entity shares PHI with a vendor, it needs a signed BAA in which the vendor agrees to protect the data and report incidents.
So the honest answer to whether ChatGPT is HIPAA compliant is: it depends on which product, under what contract, configured how. Consumer ChatGPT plans come without a BAA, so clinicians and staff should never put PHI into them. OpenAI states that it can sign BAAs for some API and business customers after review. Large cloud platforms include certain AI model services in their HIPAA programs, and other AI vendors offer BAAs on business plans. Always check the vendor's current list of covered services, because coverage often excludes some features.
Several misconceptions are common. There is no official government HIPAA certification, so a "HIPAA certified" badge is marketing. Turning off model training or deleting a chat does not create a BAA. Removing a name alone does not de-identify data. Under the Safe Harbor method, 18 kinds of identifiers must be removed, including dates more specific than the year and most geographic detail smaller than a state. The alternative is formal Expert Determination. Clinical free text often hides identifiers in dates, rare diagnoses or small-town references. Never paste names, dates of birth, medical record numbers, addresses, phone numbers, dates of service, full notes or identifiable images into an unapproved chatbot.
Strategic Impact
Risk and safety
Catastrophic and everyday AI harms both depend on who understands the risks and who can act.
Clearer decisions
Public and professional literacy shapes whether strong safety policy is politically possible.
Cutting through hype
Clear explanations reduce capture by hype, lab PR, and vague ethics theater.
The Future of Is ChatGPT HIPAA Compliant?
HHS proposed updates to the HIPAA Security Rule in early 2025, and organizations should check the rule's current status before relying on any particular requirement. AI vendors are adding health-specific offerings, and the list of services covered by BAAs changes often, so compliance teams need to re-check vendor documentation regularly. Staff using personal chatbots at work without approval remains a practical risk. Many organizations respond by offering an approved, BAA-covered tool so staff are not tempted to use personal accounts. Consumer health apps that fall outside HIPAA may instead be covered by FTC rules and state privacy laws.
Real-World Implementation
A clinic manager pastes a patient's name, date of birth and diagnosis into a personal ChatGPT account to draft a referral letter. That discloses protected health information to a vendor without a BAA and is a potential HIPAA violation.
A hospital builds a discharge-summary drafting tool on a cloud AI service covered by its cloud provider's BAA, with access controls and logging configured. Set up that way, it can be a compliant arrangement.
A therapist asks a chatbot for general wording to explain sleep hygiene to anxious teenagers and includes no patient details. No protected health information is involved, so HIPAA is not implicated.
A patient pastes their own lab results into ChatGPT to get an explanation. HIPAA does not restrict what patients do with their own information, but the data is then governed by OpenAI's privacy terms, not by HIPAA.
Risks & Guardrails
Treating existential risk as sci-fi while capability compounds.
Confusing surface product safety with alignment under high autonomy.
Leaving non-English and non-expert audiences with only low-quality sources.
Implementation Roadmap
Separate product harms, misuse, and loss-of-control / misalignment risks.
Ask what evidence would change your view on timelines and severity.
Prefer primary sources and concrete evals over marketing claims.
Identify one action path: career, policy, funding, or skills — not only awareness.
Keep Exploring
Free newsletter
Keep up with AI in 3 minutes a day
One short email each weekday with the three AI stories that actually matter. Free forever, no ads.
One email each weekday. Unsubscribe in one click. We never sell or share your address.
Test yourself
Take the Is ChatGPT HIPAA Compliant? quiz
Instant feedback on every answer, and a shareable certificate with a verifiable ID once you pass a course.
Support free AI education. AI Understanding is a 501(c)(3) nonprofit — no ads, no paywall, ever. Make a donation
Frequently asked questions
Is ChatGPT HIPAA Compliant?
Consumer ChatGPT, meaning the Free, Plus, Pro and other individual plans, is not suitable for protected health information under HIPAA, because OpenAI does not sign a business associate agreement (BAA) for those plans. A HIPAA-covered organization can use an AI service with patient data only if the vendor signs a BAA and the service is set up to meet HIPAA's safeguards. OpenAI says it can offer BAAs for certain API and sales-managed business products after review, and several cloud AI services offer them too.
Why are consumer ChatGPT plans such as Free or Plus unsuitable for protected health information?
Without a BAA, sharing PHI with the vendor is not permitted for a covered entity, whatever the product's other features.
Under HIPAA, which of these is a business associate?
Business associates handle PHI for covered entities and must sign BAAs. A health plan is itself a covered entity.
A vendor advertises its chatbot as 'HIPAA certified.' What does the guide say about that claim?
HHS does not certify products. Compliance depends on contracts, configuration and practices.
A patient pastes their own lab results into ChatGPT. How does HIPAA apply?
HIPAA binds covered entities and business associates, not individuals handling their own records.
What does the Safe Harbor method of de-identification require?
Safe Harbor lists 18 kinds of identifiers that must be removed. Removing a name alone is not enough.
Keep learning
Related guides
More guides picked for this topic