What a BAA does, and does not do
A business associate agreement is the contract HIPAA requires before a vendor handles protected health information for you; its required terms are in 45 CFR 164.504(e). As OpenAI puts it, "Accepting a BAA and enabling HIPAA compliance support do not, by themselves, make your application HIPAA compliant."
Sources: 45 CFR 164.504(e); OpenAI BAA article. This page is a summary, not legal advice.
LLM API vendors and BAAs (checked Oct 27, 2026)
Vendor terms change often. Every row was checked on the vendor's own page on Oct 27, 2026; recheck before you rely on it, and confirm the specific endpoints and features you use are covered.
| Vendor | What the vendor page says | Source |
|---|---|---|
| OpenAI API | BAA required before PHI; "An enterprise agreement is not required to sign a BAA for API services"; self-serve needs "an established history of API usage"; eligibility also requires Modified Retention. "Features not listed here are not automatically covered." No BAA for ChatGPT Business. | OpenAI BAA article; OpenAI HIPAA eligible products |
| Anthropic | BAA covers "HIPAA-ready services, such as use of our first-party API, Claude in Microsoft Foundry, or Enterprise plans"; the organization's Primary Owner signs. Some features are excluded; read the exclusion table. | Anthropic BAA article |
| AWS (Amazon Bedrock) | Amazon Bedrock appears on AWS's HIPAA eligible services reference page (last updated Oct 15, 2026); confirm the listing for your service. | AWS HIPAA Eligible Services Reference |
| Microsoft Azure | Microsoft offers a HIPAA BAA through the Product Terms for in-scope Azure services; check that the model service you use is in the audit-scope list. | Microsoft Azure HIPAA offering |
| Google Cloud | The covered-products list includes generative AI entries on its Agent Platform; Google AI Studio and the Gemini API do not appear on the page. Read the footnotes. | Google Cloud HIPAA compliance |
For the main ways to deploy an LLM with PHI, see healthcare AI consulting.
What it means for startups
Our reading (editorial, not from a source):
- Sign before sending PHI, and get the BAA from the entity you actually contract with, whether the model maker or a cloud.
- Check feature-level coverage. Vendors list eligible endpoints and exclusions; anything not listed may not be covered.
- Note irreversible settings. OpenAI says that once HIPAA support is enabled, "you cannot disable it."
Related resources
Frequently asked questions
Can I send PHI to the OpenAI API?
OpenAI says your organization must first enter into a BAA, and HIPAA eligibility also requires Modified Retention unless OpenAI specifies otherwise. Only listed features are covered.
Does Anthropic sign a BAA?
Anthropic says it provides a BAA covering its HIPAA-ready services, such as its first-party API, Claude in Microsoft Foundry and Enterprise plans, with some feature exclusions.
Does a BAA make my app HIPAA compliant?
No. OpenAI states that accepting a BAA and enabling HIPAA support do not, by themselves, make an application HIPAA compliant.
Scope it in 30 minutes
Book a scoping call and we'll name the smallest engagement that moves you forward. Most teams start with the fixed-scope Initial Audit.
Book a 30-min scoping callPrefer to write? Send a short note.