Which AI Tools Are HIPAA Compliant? ChatGPT, Claude, Copilot and Gemini ComparedThe exact version of each AI tool that comes with a BAA, and the versions that do not.

ChatGPT, Claude, Microsoft Copilot, and Google Gemini each have a business version that comes with a Business Associate Agreement (BAA). None of the free or personal versions do. A practice may enter patient information only into the covered version. We checked each vendor's own documentation on October 9, 2026.

HIPAA compliant AI tools at a glance

What makes an AI tool HIPAA compliant?

No AI tool is HIPAA compliant by itself. A practice's use of it is compliant when three conditions hold.

1. A BAA is in place. The vendor has agreed in writing to protect patient information.
2. The product is on the covered list. Each vendor's BAA covers named products and features only.
3. The practice does its part. Microsoft's documentation says it plainly: "using Microsoft services doesn't on its own achieve HIPAA compliance."

Is ChatGPT HIPAA compliant?

Only the products on OpenAI's HIPAA-eligible list are covered. The list names ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT FedRAMP, ChatGPT for Clinicians, and the API with Modified Retention. OpenAI adds: "Features not listed here are not automatically covered under the BAA." OpenAI also states that the consumer Health in ChatGPT feature does not offer a BAA. Our ChatGPT HIPAA guide covers each product.

Is Claude HIPAA compliant?

Claude is covered on two configurations: a Claude Enterprise plan with HIPAA activated, and a HIPAA-ready API organization. Anthropic's privacy center states: "Anthropic provides a BAA covering our HIPAA-ready services." It also warns: "Standard Claude Enterprise plans do not include BAA coverage without action from a Primary Owner."

Three limits matter for a practice:

• Anthropic's BAA article does not list the Free, Pro, Max, or Team plans as covered.
• Connectors, MCP servers, Skills, and Claude in Chrome are available but not covered by the BAA.
• Anthropic's BAA does not cover Claude bought through a third-party cloud provider. That provider's own BAA applies.

Is Microsoft Copilot HIPAA compliant?

Copilot is covered inside Microsoft's commercial cloud. Microsoft's HIPAA page lists "Microsoft Copilot" and "Microsoft Copilot Chat" as in-scope services for commercial Office 365. Microsoft states that its BAA "is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA."

Microsoft's in-scope list names no consumer plan. Do not treat Copilot under a Microsoft 365 Personal or Family subscription, or the free Copilot app, as covered. Ask Microsoft or your licensing partner to confirm your exact Copilot license in writing.

Is Google Gemini HIPAA compliant?

Gemini is covered inside a Google Workspace account that has accepted Google's BAA. Google's HIPAA Included Functionality list, dated August 31, 2026, names the Gemini app and Gemini in Workspace. The list excludes Gemini in Chrome. Gemini used with a personal Google account has no BAA. Our Google Workspace HIPAA guide explains how an administrator accepts the BAA.

How should a practice roll out an AI tool?

1. 1

   Pick one covered tool

   Choose the tool that matches software the practice already licenses. One tool is easier to police than four.

2. 2

   Put the BAA in place

   Accept or sign the BAA before any patient data is entered. Save a copy with the date.

3. 3

   Turn on the required settings

   Follow the vendor's HIPAA configuration steps. Turn off features the vendor marks as not covered.

4. 4

   Give staff work accounts

   Issue each staff member a login on the covered plan. Forbid personal AI accounts for any patient information in a written policy.

5. 5

   Recheck the covered list

   Vendors change their lists. Check the vendor's page each quarter and after each new feature launch.

How Webpatch helps

Webpatch is a technology company that works with healthcare practices. We build websites and manage their security, HIPAA compliance, SEO, and AEO. We are not a law firm, and this is not legal advice. If you want help choosing and configuring tools for patient data, contact Webpatch.

This article is for education only. It is not legal advice and has no legal standing. Have a qualified professional review your situation before you act.