Is ChatGPT HIPAA Compliant?What a Practice Can and Cannot Do

ChatGPT is HIPAA compliant only on specific OpenAI plans that come with a signed Business Associate Agreement (BAA). Free and Plus accounts are not on OpenAI's HIPAA-eligible list. This guide shows which plans qualify and what a practice can do today. We checked OpenAI's help pages on October 9, 2026.

ChatGPT and HIPAA at a glance

• Verdict: only on an eligible plan with a signed BAA.
• Eligible plans: ChatGPT for Healthcare, ChatGPT for Clinicians, ChatGPT Enterprise with Regulated Workspace, and the API with Modified Retention.
• Free and Plus: not on OpenAI's eligible list.
• Health in ChatGPT: the consumer feature "does not offer a Business Associate Agreement."
• Training: OpenAI says content shared with ChatGPT for Healthcare is not used to train its models.
• Safe on any plan: work that contains no patient information.

Which ChatGPT plans are HIPAA eligible?

Four products matter for a medical practice. OpenAI's list of HIPAA-eligible products names them, along with two FedRAMP versions for government use.

OpenAI adds one rule that applies to the whole list: "Features not listed here are not automatically covered under the BAA." If a plan or feature is not named, treat it as not covered.

Can a doctor use free ChatGPT or ChatGPT Plus with patient information?

No. Neither plan is on OpenAI's eligible list, so there is no BAA covering what you type. HHS guidance on cloud services says a provider that uses a cloud service to hold electronic protected health information (PHI) without a BAA "is in violation of the HIPAA Rules."

This applies to staff too. A front-desk employee who pastes a patient message into a personal ChatGPT account creates the same problem as a doctor who does it.

Is Health in ChatGPT covered by HIPAA?

No. Health in ChatGPT is a consumer feature that lets a person connect their own records. OpenAI's help article says it "does not offer a Business Associate Agreement" and is "not intended for clinical or covered-entity use."

OpenAI directs covered entities and their business associates to ChatGPT for Healthcare and ChatGPT for Clinicians. Your patients may use Health in ChatGPT for themselves. Your practice should not use it for them.

What can a practice do with ChatGPT without a BAA?

A practice can use any plan for work that contains no patient information. HIPAA governs PHI, not the tool. Examples:

• Drafting a patient education handout on a general topic
• Rewriting an office policy in plain language
• Summarizing a published clinical guideline
• Writing a job advert or a website page

Removing the patient's name is not enough to make a prompt safe. HHS's Safe Harbor method lists 18 types of identifiers that must be removed. They include dates other than the year, phone numbers, email addresses, and any location smaller than a state.

Which ChatGPT features does the BAA not cover?

Some features stay outside the BAA even on an eligible plan. OpenAI's list names these exclusions, among others:

• Improved memory. It is off by default in covered products. OpenAI says PHI should not be entered when it is in use.
• Sites. Listed as excluded.
• Browser use and network access in the cloud. Both are excluded.
• Event-triggered scheduled tasks. Excluded, and off by default in covered products.

The list changes as OpenAI adds features. Read the current version before you turn on anything new.

How should a practice set up ChatGPT for HIPAA?

1. 1

   Choose an eligible plan

   Pick a product from OpenAI's HIPAA-eligible list. For most practices that means ChatGPT for Healthcare or ChatGPT for Clinicians.

2. 2

   Sign the BAA first

   Have the BAA executed before anyone enters patient information. An eligible plan without a signed BAA is not covered.

3. 3

   Leave excluded features off

   Keep improved memory and the other excluded features off for staff who handle PHI.

4. 4

   Set a staff rule

   Put it in writing: no patient information in personal ChatGPT accounts. Train new staff on it.

5. 5

   Add it to your risk analysis

   Record which plan you use, who has access, and which features are on.

How Webpatch helps

Webpatch is a technology company that works with healthcare practices. We build websites and manage their security, HIPAA compliance, SEO, and AEO. When a practice adds an AI tool to its website or workflow, we check that patient information only reaches vendors with a BAA. Contact us to review your setup. For email and files, see whether Google Workspace is HIPAA compliant.

We are not a law firm. We handle the technical side and work alongside your privacy officer or attorney.

This article is for education only. It is not legal advice and has no legal standing. Have a qualified professional review your situation before you act.