Is ChatGPT HIPAA compliant? AI tools, BAAs and patient data in a medical practice

The short answer

Practice managers ask this about each AI tool by name, from ChatGPT to Microsoft Copilot, and the answer is the same for each. HIPAA has no product certification. HHS's guidance on cloud computing says the Office for Civil Rights does not endorse or certify specific technology or products. Microsoft says the same on its own HIPAA page: there is currently no certification standard that HHS approves.

Four facts about your account decide whether a use is permitted: whether the vendor covers your plan, whether it has signed a business associate agreement with your practice, whether the features your staff use fall inside that agreement, and whether the tool is set up the way the agreement assumes. Personal and free chat accounts fall outside the agreements these vendors describe, so staff should never paste patient information into one.

Who counts as a business associate

Under 45 CFR 160.103, a business associate is a person or company that creates, receives, maintains or transmits protected health information on behalf of a covered entity, outside its workforce, for a regulated function. The definition names claims processing, data analysis, utilization review, billing, benefit management and practice management, and it also covers consulting, management and administrative services that involve PHI. Subcontractors of a business associate that handle the PHI are business associates too.

HHS's guidance on cloud computing shows how far that reaches. A cloud provider that creates, receives, maintains or transmits electronic PHI is a business associate even if it stores only encrypted data and has no key to it. Using such a provider without a business associate agreement is a HIPAA violation, and OCR cites a settlement over the records of more than 3,000 people stored that way. By the same definition, an AI model service that receives patient information in its prompts is a business associate, and so is any outside firm that builds or runs an AI workflow on your PHI.

Two limits on the definition matter for AI pilots. The conduit exception covers services that only transmit data, so a service that stores your documents falls outside it. HHS also says a cloud provider is not a business associate if it receives and maintains only information de-identified under the Privacy Rule, because de-identified information is not PHI.

What a business associate agreement must say

A signed agreement is a requirement, and it still leaves work for the practice. Microsoft makes the point on its own HIPAA page: a business associate agreement does not on its own achieve HIPAA compliance. The practice still has to set the tool up correctly and add it to its risk analysis.

The contract itself has required contents. Section 164.504(e) of the Privacy Rule lists them, and 164.314(a) adds Security Rule terms for electronic PHI. A privacy officer reviewing a vendor agreement will usually check for each of these:

• The uses and disclosures the vendor may make, and a ban on any others.
• Appropriate safeguards, including Security Rule compliance for electronic PHI.
• Reporting of any use or disclosure the contract does not allow, including breaches and security incidents.
• The same restrictions passed down to every subcontractor that handles the PHI.
• Support for patients' rights to access, amend and get an accounting of disclosures.
• Internal practices, books and records made available to HHS when it checks compliance.
• Return or destruction of the PHI when the contract ends, where feasible, and a right to end it for a material breach.

Which AI vendors offer one, and what they leave out

Vendor terms change, so read each vendor's current page on the day you sign. The terms below were last checked on October 21, 2026.

Microsoft says a cloud provider is a business associate and includes its HIPAA business associate agreement by default in the Data Protection Addendum for its online services. Its list of in-scope services includes Microsoft Copilot and Copilot Chat. AWS lists Amazon Bedrock, Amazon Textract and Amazon Comprehend Medical among its HIPAA eligible services.

Anthropic offers a business associate agreement for what it calls HIPAA-ready services, such as its first-party API, Claude in Microsoft Foundry and Enterprise plans. On Enterprise, the primary owner has to turn on the HIPAA settings and accept the agreement, and consumer plans and beta features are excluded. OpenAI says an organization must enter a business associate agreement before it uses the OpenAI API with PHI.

Across the four, coverage turns on the plan, a signed agreement, the specific features and the configuration. The questions below are worth asking any vendor before patient data goes in.

Put every AI tool in your risk analysis

The Security Rule already requires an accurate and thorough assessment of the potential risks and vulnerabilities to electronic PHI, under 45 CFR 164.308. That duty covers AI tools today. In a proposed update to the Security Rule published on January 6, 2025, HHS wrote that ePHI in AI training data, prediction models and algorithm data maintained for covered functions is protected by the HIPAA Rules. It said it expects an entity using AI to include those tools in its risk analysis, considering the type and amount of ePHI the tool accesses, to whom the data is disclosed and to whom the output is provided. The proposal also points to the NIST AI Risk Management Framework.

That update is still a proposal. Comments closed on March 7, 2025, and the Federal Register showed no final rule when we last checked on October 21, 2026. The risk analysis duty is in the current rule, so treat the proposal's AI language as a useful checklist rather than a new obligation.

A short entry per tool is enough to start: the tool, the ePHI it reads, where the data goes, who sees the output, how long it is kept, the agreement that covers it and who reviewed it.

Minimum necessary and de-identified pilots

The minimum necessary standard in 45 CFR 164.502(b) asks for reasonable efforts to limit PHI to what a purpose needs. It does not apply to disclosures to a provider for treatment or to the patient. For an AI workflow that prepares a prior authorization packet, it means giving the agent the chart sections the packet needs and nothing more.

For a pilot, de-identification removes the question. Under 45 CFR 164.514(b), information is de-identified either by an expert determination or by the Safe Harbor method, which removes 18 types of identifiers and requires no actual knowledge that what remains could identify the person. The 18 types include names, most geography smaller than a state, every date element except the year, phone and fax numbers, email addresses, Social Security numbers, medical record numbers, health plan beneficiary numbers, account numbers and full-face photos, along with any other unique code. Ages over 89, and any date element that would reveal them, including the year, must be grouped into a single category of 90 or older. Removing the patient's name is not enough.

The state layer: Texas and California

Texas practices have two newer rules. The Texas Responsible Artificial Intelligence Governance Act, HB 149, took effect on January 1, 2026. When an AI system is used in relation to a health care service or treatment, the provider must disclose that to the patient or their representative no later than the date the service or treatment is first provided, or as soon as reasonably possible in an emergency. The disclosure must be clear and conspicuous, in plain language, and it may be a hyperlink. The text does not settle whether paperwork such as a prior authorization packet counts. The cautious step is a short plain-language notice on intake forms and your website, reviewed by your counsel.

Texas SB 1188 requires covered entities to keep electronic health records physically in the United States or a US territory, including records held by cloud and other third-party providers, for storage on or after January 1, 2026. For an AI workflow, that argues for keeping the processing and storage of anything that becomes part of the record in US regions.

California's AB 3030 applies when a health facility, clinic, physician's office or group practice uses generative AI to write patient communications about patient clinical information. Those messages need a disclaimer and instructions for reaching a person, unless a human provider with a health care license or certification reads and reviews them first. The law excludes administrative matters such as appointment scheduling, billing and other clerical or business matters, so a billing or scheduling message falls outside it.

Worked example: mapping where PHI goes

This is an illustrative example with an assumed setup, not a client result. A 40-person primary care group wants an agent to read referral faxes and draft the index entry for each one. Before any patient data goes in, the privacy officer lists every service in the chain and what each one needs.

For the pilot, the group has two paths. It can put agreements in place with each service before the pilot starts, or it can de-identify a sample set and test on that. Assume 50 sample faxes at 6 minutes each to remove all 18 identifier types by hand, including the rule for ages over 89. That is 300 minutes, or 5 hours of staff time once. If the result meets Safe Harbor, the pilot data is no longer PHI.

The first path suits a practice that already has agreements with most of the services involved. The second suits a short test. Either way, the live workflow gets a risk analysis entry: fax images and demographics read, processed in the practice's Microsoft 365 tenant and the model service's US region, output seen by the referral coordinator, agreements on file, reviewed by the privacy officer.

A one-page staff policy to start with

A long AI policy can wait. Start with one page staff will read. A useful first version says that no patient information goes into a personal or free AI account, that only tools on an approved list may be used with PHI, that one named person decides which features are switched on, and that any new tool goes through the privacy officer and into the risk analysis before anyone uses it.

If you want to see what an agent could do with your paperwork while that is settled, our five-day AI Workflow Sprint costs $2,500. Your team replaces the patient details in sample documents with made-up values and keeps the real layouts, and live patient data is used only after your practice and QueryNow agree the terms that apply. The sprint ends with the staff hours each workflow costs you and a fixed quote for a build, with a full refund if we do not find 10 staff hours a week.

This guide is general information drawn from HHS guidance, the regulations and vendor pages. It is not legal advice, and your counsel should review any agreement before you sign it.

Common questions