Is Claude HIPAA Compliant?Which Claude plans come with a BAA, which features it covers, and what a practice must configure first.

Only if your practice uses a HIPAA-ready Claude service, such as a Claude Enterprise plan or the Anthropic API, with Anthropic's Business Associate Agreement (BAA) in place and the required configuration applied. Claude Free, Pro, Max and Team plans cannot enable HIPAA. We read Anthropic's help pages on October 9, 2026. Anthropic makes Claude.

Claude and HIPAA at a glance

• BAA: Anthropic says it "provides a BAA covering our HIPAA-ready services."
• Plans: "Team plans and individual plans (Free, Pro, and Max) can't enable HIPAA."
• Who accepts it: "Only the Primary Owner of the organization can accept the BAA and enable HIPAA."
• Features: some are covered, some are available but not covered, and some are switched off.
• Ahrefs shows 600 US searches a month for "is claude hipaa compliant" (checked October 9, 2026).

What makes an AI tool HIPAA compliant?

Two things: a BAA with the vendor and the right setup by the practice. An AI vendor that receives patient information for a practice acts as a business associate. HHS guidance on cloud services says "the CSP is a business associate." The same guidance says a practice may use the service only if it "enters into a HIPAA-compliant business associate contract or agreement (BAA) with the CSP."

No software is compliant by itself. Anthropic says the same about its own service: "Your organization is responsible for ensuring its use of these services complies with applicable legal obligations."

Does Anthropic sign a BAA for Claude?

Yes, for its HIPAA-ready services. Anthropic's help article names examples: "use of our first-party API, Claude in Microsoft Foundry, or Enterprise plans." The BAA is not automatic. Anthropic states: "Standard Claude Enterprise plans do not include BAA coverage without action from a Primary Owner."

On an Enterprise plan the Primary Owner accepts the BAA inside the organization settings. Anthropic says: "Clicking “Accept and Enable HIPAA” constitutes acceptance of the BAA." The agreement is fixed. Anthropic says the self-serve BAA "is a standard agreement and can't be modified." For the API, the Primary Owner signs a BAA. The organization then asks its Anthropic contact or the Sales team to turn the service on.

The BAA has a narrow reach. Anthropic says "the BAA only covers the single organization that accepted it."

Is Claude Pro HIPAA compliant?

No. Anthropic's page on HIPAA-ready Enterprise plans says: "Team plans and individual plans (Free, Pro, and Max) can't enable HIPAA." A staff member who pastes patient details into a personal Claude account works outside any BAA.

Which Claude features does the BAA cover?

Not all of them. Anthropic says: "Features fall into three categories: covered by your BAA, available but not covered, and disabled." Its rule for staff is short: "PHI should only be processed through covered features." The table shows what Anthropic's pages listed on October 9, 2026.

This list changes. Anthropic calls the Implementation Guide on its Trust Center "the authoritative source" for each feature. We did not read that guide today. Check it before you rely on the table.

Is Claude Code or Claude Cowork HIPAA compliant?

Only after a second configuration step. Anthropic warns: "Enabling HIPAA alone doesn't bring Claude Code or Cowork under your BAA." The Primary Owner must apply a separate HIPAA configuration to both products. Anthropic adds: "Without the HIPAA configuration, Cowork isn't an Eligible Service under the BAA."

The configuration has a cost. Anthropic says cloud features "aren't available" after it is applied. API customers face a different limit: "Claude Code isn't an Eligible Service on a HIPAA-ready API organization."

Is Claude covered when you buy it through a cloud provider?

Not by Anthropic's BAA in most cases. Anthropic says: "Anthropic's BAA doesn't apply to services purchased through a third-party cloud provider." A practice that reaches Claude through a cloud platform needs to check that platform's own BAA. We did not check any cloud provider's terms today. Anthropic's BAA article lists Claude in Microsoft Foundry as "Eligible under BAA." Ask Anthropic which agreement covers your setup.

How do you make Claude HIPAA compliant?

Follow five steps. Plan before you start. Anthropic says of enabling HIPAA: "This is a one-way decision." Enabling it also resets some organization settings to their defaults.

1. 1

   Choose a HIPAA-ready service

   Pick a Claude Enterprise plan or the Anthropic API. Free, Pro, Max and Team plans cannot enable HIPAA.

2. 2

   Have the Primary Owner accept the BAA

   On Enterprise, the Primary Owner accepts the BAA in the organization settings. For the API, the Primary Owner signs the BAA and asks Anthropic to turn the service on.

3. 3

   Apply the HIPAA configuration

   If staff use Claude Code or Cowork, the Primary Owner applies the HIPAA configuration to both. Expect cloud features to stop working.

4. 4

   Tell staff which features are covered

   Give staff a one-page list. Patient information goes only into covered features. Personal accounts stay off limits.

5. 5

   Confirm and recheck

   Look for the checkmark in the HIPAA Compliance section of the organization settings. Recheck Anthropic's feature list when you add a new tool.

How Webpatch helps

AI tools often reach patients through the website first. Webpatch builds and manages websites for healthcare practices. We list each chat widget, AI assistant and form on a practice site. We map each one to the vendor that receives its data. We check whether a BAA covers that vendor. Two related guides go deeper: Which AI Tools Are HIPAA Compliant? and Can a Medical Website Use a Chatbot?

We are not a law firm. We work alongside your compliance adviser. Contact Webpatch to review the AI tools connected to your website.

This article is for education only. It is not legal advice and has no legal standing. Have a qualified professional review your situation before you act.