Is There a HIPAA-Compliant ChatGPT? Private LLM Options for Patient Communications

No AI product is "HIPAA compliant" by itself, because HHS runs no certification program for software 11. What exists is a business associate agreement (BAA) that names specific products. OpenAI offers one for ChatGPT for Healthcare, ChatGPT for Clinicians, ChatGPT Enterprise or Education with a Regulated Workspace, and API endpoints under modified retention. Consumer ChatGPT and ChatGPT Business are excluded 6. A BAA covers the vendor's side only.

Who this is for: privacy officers, CISOs and heads of digital or marketing operations deciding how generative AI may touch patient data. You get a vendor-by-vendor reading of published BAA terms — Checked on 2026-10-17, a decision table, guardrails and a checklist. Wider context: the healthcare hub.

What "HIPAA compliant" means for an AI tool

HIPAA applies to covered entities (providers, health plans, clearinghouses) and their business associates. A vendor that creates, receives, maintains or transmits protected health information (PHI) for you is a business associate 1. Before you disclose PHI to one, you need satisfactory assurance in a written contract that meets 45 CFR 164.504(e) 23. That contract is the BAA. Three consequences matter for AI:

• No BAA, no PHI. OpenAI's own guide says that without a BAA you may not use its services with PHI 6.
• "The vendor can't see it" is not an exemption. The 2013 Omnibus Rule treats an entity that maintains PHI for a covered entity as a business associate even if it never views the data; the conduit exception covers only transmission with transient access 4. OCR's 2016 cloud guidance, as summarised by Mintz, applies the same logic to encrypted data when the provider holds no key 5.
• A BAA is not a certification. Microsoft, Google and OpenAI each say responsibility is shared and that their services do not by themselves make your use compliant 6811.

Is ChatGPT HIPAA compliant? What OpenAI publishes

OpenAI's HIPAA Implementation and Configuration Guide, posted 9 July 2026, is part of its Business Associate and Healthcare Addendum and states scope most clearly 6.

The guide also puts duties on you 6: no accounts for patients or plan members; no PHI in profile fields, workspace names or support tickets; no use of the eligible services to maintain PHI as part of a designated record set; and SSO, device security, monitoring and backup are yours. ChatGPT content is kept for the term of the agreement unless deleted.

Azure OpenAI, Google, AWS and Anthropic: what each publishes

| AWS | Sign an AWS BAA first 14 | Bedrock and AgentCore, SageMaker AI (with exclusions), Comprehend Medical, Transcribe including HealthScribe; page dated 15 Oct 2026 14 | Model providers cannot access Bedrock deployment accounts, logs, prompts or completions 15 | You still configure for HIPAA; unlisted services only for data that is not ePHI 14 | | Anthropic | Enterprise: Primary Owner accepts the BAA. API: sign, then ask Sales to enable 16 | First-party API core features, Claude in Microsoft Foundry, Enterprise chat 16 | Covered Models need 30-day retention and are unavailable under zero data retention unless Anthropic authorises it 16 | Excluded: Console, beta features, Batch, Files, Code Execution, Computer Use, Web Fetch, connectors, MCP servers, mobile app, IDE extensions 16. Consumer plans: training is opt-in, retention up to five years 17 |

What a BAA covers, and what it leaves to you

A BAA fixes permitted uses, safeguards, incident reporting, subcontractor flow-down, access to records, and return or destruction of PHI at termination 3. It does not settle the following.

• Training. Business products generally say prompts are not used for training 7913, but the BAA text is what binds the vendor.
• Retention. Abuse-monitoring logs, caches and stateful features create extra copies to secure, delete and count in a breach.
• Sub-processors. A business associate may pass PHI to a subcontractor only with satisfactory assurances, and subcontractors accept the same restrictions 23. Ask for the current list and flow-down language; a link is not an assurance.
• Breach timing. The regulatory outer limit for a business associate to notify you is 60 calendar days from discovery 20, too slow for your own clock. Negotiate hours or days using the BAA checklist for martech and customer data vendors.
• Consumer tools. An impermissible disclosure is presumed a breach unless you show a low probability of compromise across four factors 20. An employee pasting PHI into a consumer chatbot starts that analysis.

The private-inference alternative

Private inference means the model runs on hardware you control: on-premise GPUs, or a virtual private cloud (VPC) in your own AWS, Azure, GCP or OCI account. Prompts never reach a model vendor, so no model-vendor BAA is needed; a third-party host of the hardware is a business associate 4. HIPAA duties stay with you: access control, audit controls, encryption and risk analysis 21.

The market signal is mixed. Broadcom's Private Cloud Outlook 2026 (9 June 2026, n=1,800) found 56 % run or plan production AI inference on private cloud, with public cloud as the primary inference environment down from 56 % to 41 % 23. Menlo Ventures (December 2025, n=495 US enterprises) put open-weight models at about 11 % of enterprise LLM usage, down from 19 % 24. Both can hold: inference is moving private while closed models stay popular.

Private inference is a poor choice when volume is low, nobody can run GPUs and patch an inference stack, or the task needs frontier-level reasoning. A sensible path is an API under BAA or a hyperscaler private endpoint first, then self-hosting when volume, residency or payer contracts justify it. Models, hardware and latency are covered in on-premise LLM deployment for personalization.

Decision table: which option fits which job

Use cases and guardrails

Drafting patient communications

Summarising patient forms and referrals

Strip direct identifiers before the prompt where you can. Safe Harbor lists 18 identifier types, including names, dates, contact details and IP addresses, and free text defeats automated removal more often than teams expect 26. Keep summaries in the clinical record, not the AI tool; OpenAI's guide bars using its eligible services to maintain PHI in a designated record set 6.

Call-centre assist

Suggest answers to agents in real time. Verify caller identity before PHI enters a prompt, treat caller speech as untrusted input (prompt injection), and keep the agent accountable.

Preference-aware reminders

The model needs channel, language, time window and consent state, not diagnoses. Write reminders that reveal no clinical detail. Consent and suppression are enforced by the platform, not the model: deterministic rules decide whether to send and the model only drafts. See consent withdrawal and suppression architecture.

Guardrails for all four

• Minimum necessary: make reasonable efforts to limit PHI to what the task needs 2.
• Audit trail: record who prompted, which data class, which model version and what came back 21.
• Human review before anything patient-facing; no autonomous sending or clinical advice.
• Allowlist the tools an agent may call (AI agents on customer data inside your boundary).

A customer data platform (CDP) holds the identity, consent and preference state these use cases need. When it runs inside your boundary, as PrivyCDP does in customer-owned deployments, only a small context object reaches a prompt. See HIPAA-ready for PrivyCDP's scope and the HIPAA-compliant customer data platform guide for vendor comparisons.

Implementation checklist

• Decide whether PHI must enter the prompt at all; if not, design it out.
• Inventory every AI tool in use, including shadow use of consumer chatbots.
• Get the BAA and the product-by-product coverage list in writing; match it to the exact plans, endpoints and features you will use.
• Activate the retention controls the vendor requires and confirm them in the admin console.
• Disable features outside the BAA: beta features, connectors, web search, file stores.
• Keep PHI out of vendor-prohibited fields: user profiles, workspace names, tags, support tickets.
• Add the AI data flow to your Security Rule risk analysis and activity review 21.
• Log prompts, outputs and model versions, and protect the logs as PHI.
• Put a human gate before patient-facing output and document reviewer roles.
• Test prompt injection and leakage with synthetic patients.
• Write the incident path: an impermissible disclosure is presumed a breach and the 60-day clock runs from discovery 20.
• Re-review quarterly; scope lists change (Salesforce updated its covered-services list on 30 September 2026 18).

Track proposed rule changes on the HIPAA Security Rule update tracker.

Checked 2026-10-17 unless noted. Regulatory text read on the eCFR.

If you are weighing private inference together with a customer-owned customer data platform (CDP) for HIPAA-regulated workloads, HIPAA-ready sets out what PrivyCDP does and does not claim. Return to the healthcare hub for related guides.