Is ChatGPT HIPAA Compliant?

The short answer

Standard ChatGPT, including the Free, Plus, and Team plans, is not HIPAA compliant. OpenAI does not offer a Business Associate Agreement on those plans, and using Protected Health Information with them is a HIPAA violation. There is no configuration, prompt, or workflow that changes this.

Two OpenAI tiers can support HIPAA-regulated workloads: ChatGPT Enterprise and ChatGPT for Healthcare, launched in January 2026. Both require a signed BAA with OpenAI and internal policies and training on the customer side before PHI can be used.

That is the answer most guides stop at. The harder question, the one a compliance officer will ask after legal signs the BAA, is what actually happens to the data when the model processes it.

What a BAA covers and what it does not

A Business Associate Agreement is a legal contract. It obligates the vendor to safeguard PHI, report breaches, and limit use to what the agreement permits. It is necessary for any vendor that will receive PHI. It is not a statement about the vendor's architecture.

Under a BAA with OpenAI's eligible tiers, PHI submitted in a prompt is processed on OpenAI's infrastructure. OpenAI commits not to train on that data and offers retention controls. The data is encrypted in transit and at rest in their environment. These are real protections, and they matter.

What the BAA does not change is that PHI arrives at OpenAI's systems in readable form during inference. The provider processes plaintext. The commitment is about what they do with it afterward: they promise not to retain it beyond the agreed window, not to train on it, and not to use it outside the contracted purpose.

That commitment is enforceable and auditable through SOC 2 and HITRUST attestations. It is also, by its nature, a promise about behavior rather than a property of the system. You are trusting that the vendor, their infrastructure, their subprocessors, and their operational practices all behave as documented, and that any failure to do so will be disclosed. The general form of that distinction — a promise not to look versus an inability to look — is the subject of The Two Perils of AI Risk.

For many healthcare organizations, that is an acceptable risk, and reasonable people can reach that conclusion. The question is whether your specific obligation and your specific data require something different.

Where the BAA answer falls short

Three situations where a signed BAA may not resolve the compliance question.

Cross-organizational data. A health system sharing patient data with a research partner, a payer, or a pharmaceutical company for joint analysis. Both parties may have BAAs with the AI vendor, but the data still reaches a third party's infrastructure in readable form. In multi-party scenarios, the question is whether either party's data should exist in plaintext outside their own environment at all.

State privacy laws beyond HIPAA. Texas, Illinois, California, and Maine now have laws requiring disclosure or restricting autonomous AI decision-making in care settings, with additional legislation advancing in 2026. A BAA addresses federal HIPAA requirements. State obligations may impose additional restrictions on where and how health data is processed by AI.

The "minimum necessary" standard. HIPAA requires that only the minimum necessary PHI be used for a given purpose. A natural-language prompt to an AI model often includes more context than the minimum necessary for the question being asked, and enforcing minimum-necessary discipline in a conversational interface is harder than in a structured query.

For the full map of what HIPAA permits and prohibits for AI, see HIPAA and AI: What Healthcare Organizations Can and Cannot Do.

The distinction that matters for architecture

There are two ways to let AI work with sensitive health data.

The first is to send the data to the model under contractual protections. The BAA governs what the vendor may do with it. The data is processed in plaintext, and the protection rests on the vendor's commitments and controls. This is what ChatGPT Enterprise and ChatGPT for Healthcare offer.

The second is to keep the data encrypted throughout, so the model never receives the values in readable form. The AI receives the question and the structure of the data. Computation runs on encrypted values. Results return encrypted and are decrypted only by the customer, using keys the customer holds. No plaintext copy of PHI exists anywhere outside the customer's environment. This is the approach we define in What Is Confidential AI.

In the first model, a compromise or operational failure at the vendor could expose PHI. In the second, PHI is not present at the vendor in a form that could be exposed.

Both models can support HIPAA compliance. They carry different residual risk, and they answer the "what could go wrong" question differently. The choice depends on the sensitivity of the data, the organization's risk tolerance, and whether the obligation extends beyond HIPAA to state law, institutional policy, or cross-organizational agreements.

What healthcare organizations should ask

Before adopting any AI tool for work involving PHI, five questions that go beyond "do they offer a BAA."

Does the vendor process PHI in plaintext? A BAA is a legal control. Whether the vendor's systems hold readable patient data during processing is an architectural fact, and the two are independent of each other.

Where does inference run, and in which region? "US company" and "US-region processing" are different answers. Healthcare organizations operating under state data-residency requirements or institutional policies should confirm the specific regions in which AI inference executes, not just where the vendor is headquartered.

What happens to prompts and outputs? Retention defaults vary by tier and by vendor. Some tiers retain conversation history for the customer's use; others delete after a defined window. Confirm whether prompts containing PHI are logged, how long they are retained, and whether the customer controls deletion.

Who are the subprocessors? The vendor's BAA covers the vendor. The cloud infrastructure provider, the model hosting service, and any downstream services that touch the data may introduce additional parties. Each link in that chain is a potential point of exposure and should be covered.

Can you demonstrate compliance at execution, or only at contract signing? Regulators and insurers are moving from asking whether policies exist to asking what AI systems could access at the time of a specific event. An architecture that produces a verifiable record of what the system could and could not reach is a different compliance posture from one that relies on attestation of controls.

Nera Systems builds confidential AI infrastructure for regulated industries, including healthcare. The platform keeps data encrypted throughout processing so that PHI never exists in readable form outside the customer's environment. Learn more or try it on your own data.