Is ChatGPT HIPAA compliant? What to know before pasting patient information
No AI tool is HIPAA compliant on its own: compliance depends on how your practice uses it, the agreements in place and your own safeguards. Here's what to know first.
Last updated October 2026
Why "HIPAA compliant" is the wrong question
HIPAA applies to covered entities such as practices, and to the business associates that handle protected health information for them. A tool can't make you compliant; what matters is whether you have the right agreement with the vendor, and whether your risk analysis, access policies and training cover how staff use it.
What a BAA is
A Business Associate Agreement (BAA) is a contract in which a vendor that handles protected health information for you agrees to protect it. Without one, sending patient information to a vendor is generally a problem. Having one is necessary but not enough: you still need your own safeguards.
What OpenAI says about BAAs
OpenAI's enterprise privacy page says it can sign BAAs for its API platform, and describes ChatGPT for Healthcare as designed to support HIPAA compliance. Consumer ChatGPT plans aren't described that way. Check the current terms for the exact product you'd use.
Keep patient information out of public AI tools
Until you've approved a tool for that use, with the right agreement in place, make it a clear rule: no patient information in public AI tools.
Questions to ask any AI vendor
- Will you sign a BAA for the exact product we'd use?
- Where are prompts and documents processed and stored?
- Who at the vendor can access what we enter?
- How do we control retention and deletion?
- How does the tool fit our risk analysis, access policies and staff training?
Start with paperwork, not clinical decisions
Good first uses are drafting letters from notes, summarizing long referral packets and answering questions from your own policies. AI doesn't replace clinical judgment, and every draft is for a person to review.
Where private AI fits
Running AI on hardware your practice owns means prompts and documents are processed in your office rather than by a public AI service. It can be part of your privacy approach; it isn't a substitute for it, and it doesn't make anything compliant by itself. See private AI for healthcare.