Is There a HIPAA-Compliant ChatGPT in 2026? What B2B Healthcare Teams Need to Know

Which ChatGPT Products Are Actually HIPAA-Eligible in 2026

"Is ChatGPT HIPAA compliant" is really two separate questions: which specific OpenAI product are you talking about, and has your organization actually signed the paperwork. OpenAI splits its lineup into eligible and non-eligible products, and the split is stricter than most teams assume — plain ChatGPT Enterprise, on its own, does not qualify.

The detail that trips up most B2B buyers: a company that has been on plain ChatGPT Enterprise for a year does not automatically have PHI coverage. OpenAI's own eligibility documentation is explicit that the workspace has to be provisioned as a "Regulated Workspace" specifically, and that a BAA request has to be raised with the sales team by name — it is not a checkbox an admin flips on their own. Skipping that step and assuming a paid Enterprise seat is "the compliant one" is the single most common mistake we found researching this question.

A Signed BAA Doesn't Mean What Most Teams Assume

A Business Associate Agreement is a specific legal instrument: it's the contract that lets a "business associate" (OpenAI, in this case) lawfully create, receive, maintain, or transmit protected health information on behalf of a HIPAA-covered entity or another business associate. Without one, putting PHI into a vendor's tool is a HIPAA violation regardless of how secure that vendor's infrastructure actually is — the encryption doesn't matter if there's no contract.

That cuts the other way too. De-identified data that meets the Privacy Rule's Safe Harbor or Expert Determination standard is no longer PHI at all, and can technically be used with any AI tool, BAA or not. Some teams handle this by scrubbing the 18 HIPAA identifiers — names, dates, medical record numbers, and so on — out of a prompt before it ever reaches a general-purpose model. It's a legitimate workaround for narrow use cases, but it depends entirely on the de-identification actually being complete, and free-text clinical notes are notoriously easy to under-scrub.

How to Actually Get a BAA With OpenAI

There isn't one path — there are three, and they lead to different products depending on who you are.

1. Enterprise teams: ask sales for a Regulated Workspace

   OpenAI does not publish per-seat pricing or a minimum seat count for ChatGPT Enterprise — both are quote-specific. If you're already evaluating or running Enterprise, you have to explicitly raise the BAA request during the sales conversation and confirm the workspace will be provisioned in its Regulated configuration. A generic Enterprise contract signed without that step does not include PHI coverage.

2. Hospitals and health systems: go straight to ChatGPT for Healthcare

   Launched in January 2026, this is OpenAI's purpose-built product for hospitals, clinicians, and regulated healthcare environments, sold through a sales-managed enterprise agreement with BAA eligibility built into the offering rather than bolted on afterward.

3. Individual clinicians: verify identity for ChatGPT for Clinicians

   OpenAI launched this free tier on April 23, 2026, for individually verified US physicians, nurse practitioners, physician assistants, and pharmacists. It adds an optional BAA path once identity is confirmed — a meaningfully lighter-weight process than a hospital-wide enterprise deal, but scoped to one clinician at a time rather than an organization.

4. Developers and SaaS teams: email baa@openai.com for the API

   If you're building a product on top of GPT models rather than issuing ChatGPT seats, the API path with Modified Retention is the relevant one. Email OpenAI's dedicated BAA address with your company and use-case details; OpenAI states a 1–2 business day response time, and no enterprise agreement is required to start the conversation.

What the BAA Still Doesn't Cover

Signing a BAA is the beginning of compliant use, not the end of it. Two things catch teams off guard here.

Coverage is an allow-list, not a blanket

OpenAI's BAA covers a defined set of features — chat with uploaded files, voice, web search, Deep Research restricted to OpenAI's own index rather than third-party providers, Canvas, image generation, Projects, custom GPTs, and the desktop and mobile clients. Anything outside that list, including most third-party connectors, is switched off by default. An admin can turn additional features on for convenience, but doing so pulls that functionality outside the BAA's protection — it becomes the organization's risk to manage, not OpenAI's contractual obligation. Improved memory is a specific example worth flagging: it's disabled by default under ChatGPT for Healthcare, and OpenAI's own guidance says PHI should not be entered through it even if an admin re-enables it.

Your organization still does most of the work

Beyond ChatGPT: How the Alternatives Compare

ChatGPT isn't the only option, and for some B2B teams it isn't the fastest one. Here's how the main alternatives handle the same BAA question, based on each vendor's own documentation and published comparison pages as of September 2026.

Treat the pricing column as a planning signal, not a quote — none of these vendors, including OpenAI, publish a single fixed rate card for their BAA-eligible tiers, and the figures above come from each vendor's own comparison pages rather than a neutral third party. Confirm current numbers directly with sales before you budget.

Which Path Actually Fits Your Team

Whichever path you pick, the AI vendor's BAA is only one leg of the stool. If your team is also trying to formalize the broader HIPAA program — the Security Risk Analysis, policy documentation, and audit trail an OCR investigator would actually ask for — that's a separate purchase from the AI tool itself; our comparison of HIPAA compliance software covers that category specifically. And if HIPAA is only one of several frameworks you're tracking, our decision framework for choosing a compliance automation platform walks through how to evaluate that purchase separately from any single vendor's BAA.

The Regulatory Backdrop: HIPAA Security Rule Changes Still Pending

Two threads worth watching heading into 2027 change how strict "compliant" will need to be, even though neither is final law yet. First, the HIPAA Security Rule update proposed by the Office for Civil Rights would make multifactor authentication and encryption — both at rest and in transit — mandatory rather than the current "addressable" (effectively optional) standard, alongside a 72-hour incident-reporting window and annual penetration testing. As of September 2026, this remains a proposed rule: after pushback from over 100 hospital systems and provider groups, OMB pushed final action from the original 2026 target to around July 2027. Second, the same update would expand what covered entities are required to demand from every business associate — including AI vendors — which means today's BAAs, ChatGPT's included, are likely to need updating once the rule lands rather than being a one-time signature you never revisit.

Neither change is enforceable yet, so nothing above requires immediate action. But if you're negotiating a multi-year AI vendor contract right now, it's worth asking the vendor how they plan to handle mandatory encryption and MFA requirements before you're locked into a BAA that doesn't anticipate them — a topic we expect to cover in a dedicated head-to-head comparison of ChatGPT for Healthcare and Claude Enterprise for hospital deployments once both products' 2027-readiness postures are clearer.

Frequently Asked Questions

Methodology

This article was compiled from OpenAI's own HIPAA-eligibility and ChatGPT for Healthcare documentation, third-party analyses that quote and interpret that documentation in detail (IntuitionLabs, Witness AI, HIPAA Journal), vendor-published comparison and pricing pages for the alternative platforms named above, and primary reporting on the proposed 2026 HIPAA Security Rule update and its delay to 2027. Because OpenAI and most alternative vendors quote custom, account-specific pricing rather than a public rate card, every dollar figure above should be treated as a directional planning signal — confirm current terms directly with each vendor's sales team before budgeting or signing.

Ken Hayashi

Technology consultant with 10+ years in the Japanese tech industry. Specializing in SaaS evaluation, workflow automation, and B2B tool integration.