2026-10-25
Can my business use ChatGPT, Claude, or Grok with patient data?
Before your office puts client or patient data into ChatGPT, Claude, or Grok, you need the right plan and, for health data, a signed BAA. Here is what each one offers.
A lot of offices I talk to already use ChatGPT, Claude, or Grok. Someone pastes in an email to clean it up. Someone drops in a spreadsheet to sort it. That's fine for a lot of work. It's not fine when that email or spreadsheet has a patient's name, a diagnosis, or an insurance ID in it.
The tools aren't the problem. The setup is. The same AI can be safe on one plan and a real risk on another.
Why the plan you're on matters
If you run a medical practice, a therapy office, or a billing company, or you handle health information for one, HIPAA applies to you. Any outside company that stores or processes that information for you has to sign a Business Associate Agreement with you. People call it a BAA. That includes the company behind the AI tool.
Free and personal plans don't come with a BAA. Some business plans don't either. So before anyone pastes in patient details, you need to know which plan you're on and what it covers.
What each company offers right now
I checked each company's own help pages in October 2026. These rules change often, so check again before you sign anything.
OpenAI (ChatGPT). OpenAI offers a BAA for its API. Eligible companies can accept the standard BAA in their API settings, and the account needs what OpenAI calls Modified Retention. For ChatGPT itself, OpenAI offers a BAA on ChatGPT for Healthcare, on ChatGPT Enterprise or Edu accounts that are managed through its sales team, and to individual clinicians through ChatGPT for Clinicians. OpenAI says it does not offer a BAA for ChatGPT Business. Its HIPAA guide also lists Free, Plus, and Pro as not covered.
Even with a BAA, not every ChatGPT feature is covered. OpenAI's list of covered features says improved memory, event-triggered scheduled tasks, and browser use in cloud Work aren't covered. Its HIPAA guide also warns that connectors to other apps can send data to companies that don't offer HIPAA coverage.
Anthropic (Claude). Anthropic offers a BAA for its API and for its HIPAA-ready Enterprise plans. On Enterprise, the account owner has to switch on HIPAA in the settings and accept the BAA. A regular Enterprise plan isn't covered until they do. The BAA is for Anthropic's business products. Its consumer plans, Free, Pro, and Max, aren't part of it.
Claude Code has its own rules. On a HIPAA-ready Enterprise plan it's covered once an extra HIPAA setting is applied, and Anthropic says that setting is only available to companies working with its account team. Without that setting, it's covered only with zero data retention, which Anthropic offers to qualified accounts. Connectors and tools that send data to other companies aren't covered either.
xAI (Grok). xAI has a BAA questionnaire for companies that want to use its API with health data. Its team reviews the answers and follows up. xAI also lets an API team turn on zero data retention, so prompts and answers aren't saved. I couldn't find a public xAI page that says the Grok apps or Grok for Business are covered by a BAA. Until xAI tells you otherwise in writing, I'd treat them as not covered.
Google, Microsoft, and Amazon. If your office runs on Google Workspace, Google's BAA lists the Gemini app and Gemini in Workspace as covered. It does not cover Gemini in Chrome or Gemini Notebook, which used to be called NotebookLM. Microsoft includes a BAA in its standard terms for Azure services that are in scope, and that can include Azure OpenAI. Amazon offers a BAA for AWS accounts and lists Amazon Bedrock, where you can run Claude and other models, as HIPAA eligible.
A BAA is only the start
Every one of these companies says the same thing. Signing a BAA doesn't make you compliant by itself. You still have to set it up the right way.
That usually means turning off the features the BAA doesn't cover, like connectors, memory, or web tools, for anyone who works with health data. It means using company accounts, not personal ones, and deciding who on the team gets access.
It also means keeping health data out of places people forget about. OpenAI's guide names file names, workspace names, and custom GPT instructions. And it means writing down which tool is approved for what, so nobody has to guess.
Not in healthcare?
The same idea still applies. Client financials, legal files, and employee records don't belong in someone's personal ChatGPT account. Use a business plan with real data controls, and read what it says about training and how long data is kept.
Where I come in
This is something I set up for businesses. I look at what your team already uses AI for and where client or patient data shows up. Then I help you pick the right plan and get the BAA in place where you need one.
I set up the accounts, the settings, and who has access, so the safe way is also the easy way for your staff. If you want, I'll also teach your team to use these tools well. There's more on my AI training and agent setup page.
I'm not a lawyer, and this isn't legal advice. I don't certify anyone as HIPAA compliant. Have your compliance person or attorney look over the final setup. I handle the technical side, so that conversation is a short one.
Is your office already using AI with client or patient details, and nobody's sure what plan it's on? Send me a quick note and I'll help you figure out what's fine to keep and what to change.
Sources
OpenAI: Getting a BAA for the OpenAI API
OpenAI: HIPAA eligible products and functionality
Anthropic: BAAs for commercial customers
Anthropic: HIPAA-ready Enterprise plans
Google Workspace: HIPAA included functionality
Google Workspace: Generative AI privacy hub