HIPAA-compliant AI: which tools sign a BAA, and what else you need

Searches for “HIPAA-compliant AI” have grown more than twentyfold in the past year, mostly from practices and health businesses whose staff are already using AI. The honest answer to “is this AI tool HIPAA compliant?” is always “it depends on the plan, the agreement and how you use it.” This guide covers which major tools sign a Business Associate Agreement (BAA) as of November 2026, what the agreement leaves to you, and the three realistic ways to use AI with patient data.

What “HIPAA compliant” means for an AI tool

HIPAA has no certification for software. What it has is a rule about vendors. Under 45 CFR 160.103, any company that “creates, receives, maintains, or transmits” protected health information (PHI) on your behalf is a business associate, and you need a signed BAA with it before it touches PHI. HHS applies this even to cloud providers that only store encrypted data they can’t read. An AI service reading your prompts is clearly a business associate.

So “HIPAA-compliant AI” really means three things:

1. The vendor signs a BAA for the product and plan you use.
2. You stay inside what the BAA covers. Vendors cover listed services and features, not everything in the app.
3. You meet the Security Rule around it: risk analysis, access control, staff training, audit logs and breach response.

Every major vendor says the same thing in its own documents. OpenAI’s HIPAA guide says following it “does not ensure compliance.” Microsoft says “using Microsoft services doesn’t on its own achieve HIPAA compliance.” Google calls it “a shared responsibility.”

Which AI tools sign a BAA

Microsoft Copilot

Microsoft includes its HIPAA BAA automatically: signing a commercial volume licensing agreement includes the BAA through Microsoft’s Data Protection Addendum. Its HIPAA scope for Office 365 commercial lists Microsoft Copilot and Copilot Chat. That means a work account on a Microsoft 365 business plan. Consumer Copilot, Copilot Pro and Microsoft 365 Personal or Family use consumer terms with no BAA.

For small practices already on Microsoft 365, this is often the easiest starting point. Check two things: that everyone is signed in with a work account, and whether web-grounded answers send queries outside the covered service. Some reports say Bing web grounding sits outside the BAA, which we couldn’t confirm from Microsoft’s own pages.

Google Gemini

Google Workspace admins accept the HIPAA BAA in the Admin console. Google’s covered-services list (updated October 2026) includes Gemini in Google Workspace and the Gemini app, excluding Gemini in Google Chrome. NotebookLM isn’t on the Workspace list. Consumer Gemini on a personal Gmail account has no BAA. On Google Cloud, Gemini Enterprise and Google’s generative AI platform are covered under the Cloud BAA.

Three ways to use AI with patient data

1. A covered plan of a general assistant. ChatGPT Enterprise or for Healthcare, Claude Enterprise, Gemini in Workspace or Microsoft 365 Copilot with the BAA in place. Best for staff writing, summarizing and drafting. The catch: these plans are priced and built for organizations, and most of the useful extras (connectors, plugins, beta features) are often excluded from the BAA.

2. A healthcare-specific tool that signs a BAA. AI scribes, AI receptionists and patient messaging tools built for healthcare. Read the BAA itself, not the marketing page. Some vendors reserve the right to use de-identified data (Freed’s BAA does, for example), some only sign on higher tiers, and voice platforms like Vapi require every downstream model and voice provider to be HIPAA covered too. For phone answering, see our AI receptionist comparison; for therapy practices, see best AI for therapists.

3. A private model in your own cloud account. Run a model through Amazon Bedrock, Google’s AI platform or Azure inside an account your business owns, under that provider’s BAA. If you run an open model like Llama or Mistral in your account, the model’s publisher never sees your data at all. AWS says Bedrock data “is not shared with model providers.” This is the most control you can get. It also means you (or your integrator) own more of the security work: access, logging, encryption, backups, and making sure prompt logs don’t flow to a third-party tool without a BAA.

The third option is what we build for clients: private AI in a cloud account the business owns, connected to its EHR, intake forms, scheduling and document storage, so the AI can do real work without patient data leaving the business’s control. See AI consulting and AI implementation.

What the BAA leaves to you

Even with a signed BAA, you’re responsible for:

• A risk analysis that includes each AI tool (45 CFR 164.308).
• Access control: single sign-on, removing departed staff quickly, limiting who can reach the PHI workspace.
• Minimum necessary: staff enter only what the task needs.
• Feature discipline: connectors, plugins and beta features are commonly excluded. Turn off what isn’t covered.
• No PHI in account metadata: workspace names, profile fields and support tickets are excluded by every vendor we reviewed.
• Training so staff know which tool is approved for PHI and which isn’t.
• Breach response when someone uses the wrong tool.

When staff paste PHI into the wrong tool

This is the most likely HIPAA problem with AI today. Under 45 CFR 164.402, an impermissible disclosure is presumed to be a breach unless a documented risk assessment shows a low probability that the information was compromised. If it happens: record what was entered, by whom and when; delete the conversation; run the four-factor risk assessment; and follow your breach notification policy if it doesn’t clear.

The fix that works is an approved tool. Banning AI without offering an alternative mostly pushes use onto personal phones.

De-identified data: the 18 Safe Harbor identifiers

If data is properly de-identified, HIPAA no longer applies to it, and any AI tool can be used. Under the Safe Harbor method (45 CFR 164.514(b)(2)), you must remove these identifiers for the patient and their relatives, employers and household members:

1. Names
2. Geographic units smaller than a state, including street, city, county and ZIP code (the first three ZIP digits can stay if that area has more than 20,000 people)
3. All date elements except the year (birth, admission, discharge, death), and ages over 89
4. Phone numbers
5. Fax numbers
6. Email addresses
7. Social Security numbers
8. Medical record numbers
9. Health plan beneficiary numbers
10. Account numbers
11. Certificate and license numbers
12. Vehicle identifiers, including license plates
13. Device identifiers and serial numbers
14. Web URLs
15. IP addresses
16. Biometric identifiers, including finger and voice prints
17. Full-face photos and comparable images
18. Any other unique identifying number, characteristic or code

You also must have no actual knowledge that what’s left could identify the person. In practice, staff stripping names out of a note before pasting it into ChatGPT almost never meets this standard. Dates, locations and rare conditions remain.

Penalties

HHS’s current civil penalty amounts (set in January 2026 and confirmed in October 2026 as unchanged for 2026):

Under a 2019 enforcement discretion notice, OCR applies lower annual caps for the less serious tiers (for example, $36,505.50 for violations the organization didn’t know about).

As of October 2026, we found no OCR enforcement action specifically about staff using ChatGPT or another chatbot. The AI-related cases so far are about vendors and consent: an agentic-AI IT vendor exposed records of 483,126 Catholic Health patients through an unsecured database, and a proposed class action against Sharp HealthCare alleges ambient AI recorded exam-room conversations without consent under California law.

What’s coming

HHS proposed a major rewrite of the HIPAA Security Rule in January 2025. It would make encryption and multi-factor authentication mandatory, require a technology asset inventory and annual risk analysis, and require business associates to verify their safeguards in writing every year. Commentators expect it would pull AI tools that touch ePHI into the asset inventory and risk analysis explicitly. It isn’t final; the latest federal regulatory agenda projects final action in July 2027. Building those habits now is cheaper than catching up later.

A setup checklist

• List every AI tool staff use, including personal accounts.
• Pick the approved tool for PHI work and get the BAA signed.
• Turn off uncovered features (connectors, plugins, beta features).
• Set up single sign-on and remove personal-account access to PHI.
• Add each AI tool to your risk analysis.
• Write a one-page AI use policy and train staff on it.
• Check the BAA chain: every vendor that touches the data, including logging and voice providers, needs one.

If you’d rather have this mapped for you, the AI audit covers which tools you have, where patient data flows, and what a compliant setup would look like.

This guide is general information, not legal advice.

Sources

• 45 CFR 160.103 (business associate definition): https://www.law.cornell.edu/cfr/text/45/160.103
• 45 CFR 164.402 (breach and risk assessment): https://www.law.cornell.edu/cfr/text/45/164.402
• 45 CFR 164.514 (de-identification): https://www.law.cornell.edu/cfr/text/45/164.514
• HHS guidance on HIPAA and cloud computing: https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html
• OpenAI HIPAA Implementation and Configuration Guide: https://cdn.openai.com/osa/baa-hipaa-guide.pdf
• Anthropic privacy center, BAAs for commercial customers: https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers
• Claude support, HIPAA-ready Enterprise plans: https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans
• Google Workspace HIPAA compliance: https://knowledge.workspace.google.com/admin/compliance/hipaa-compliance-with-google-workspace-and-cloud-identity
• Google Cloud and Workspace HIPAA covered services: https://docs.cloud.google.com/docs/security/compliance/hipaa
• Microsoft HIPAA/HITECH offering (Office 365 scope): https://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech
• Microsoft Azure HIPAA offering: https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-hipaa-us
• AWS HIPAA eligible services reference: https://aws.amazon.com/compliance/hipaa-eligible-services-reference/
• Amazon Bedrock security and compliance: https://aws.amazon.com/bedrock/security-compliance/
• Freed platform terms (BAA): https://help.getfreed.ai/en/articles/9879697-platform-terms-of-use
• Vapi HIPAA documentation: https://docs.vapi.ai/security-and-privacy/hipaa
• HHS civil monetary penalty adjustment, January 2026: https://public-inspection.federalregister.gov/2026-01688.pdf
• HHS notice of no 2026 penalty adjustment: https://www.federalregister.gov/d/2026-21524
• HIPAA Journal on the 2019 enforcement discretion caps: https://www.hipaajournal.com/hhs-applies-inflation-increase-penalties-for-hipaa-violations/
• HIPAA Security Rule final action projected for July 2027 (McDermott): https://www.mcdermottlaw.com/insights/final-action-on-hipaa-security-rule-modifications-now-projected-for-july-2027/
• Serviceaide / Catholic Health breach (HIPAA Journal): https://www.hipaajournal.com/serviceaide-data-breach/
• Sharp HealthCare ambient AI lawsuit (Becker’s): https://www.beckershospitalreview.com/legal-regulatory-issues/patient-sues-sharp-healthcare-over-ambient-ai-use