The Three Requirements for HIPAA-Compliant AI
Every AI tool used with protected health information must meet three requirements: a signed Business Associate Agreement establishing the vendor's responsibilities, data handling protections including encryption in transit and at rest, and appropriate use policies governing how staff interact with the tool.
Without all three, you are exposed.
Tools With BAA Availability
ChatGPT Enterprise and Team Plans: OpenAI offers BAA coverage on Enterprise and Team plans. The free and Plus plans do not qualify. If your practice uses ChatGPT, it must be on the Enterprise or Team plan with a BAA executed before any PHI is processed.
Claude Enterprise API: Anthropic provides BAA-covered access through enterprise agreements. The consumer product does not include BAA coverage for healthcare use.
BastionGPT: Built specifically for healthcare with BAA included in every plan. Clinical documentation, patient communication, and practice management features designed from the ground up for compliance.
CompliantChatGPT: A HIPAA-compliant AI medical copilot with BAA included. Designed specifically for clinical workflows and secure PHI handling.
GoHighLevel Healthcare Plan: BAA available for healthcare clients. CRM, marketing automation, and AI conversational features purpose-built for medical practices.
Hathr.AI: Healthcare-specific platform with built-in compliance. AI scribe functionality and clinical decision support with BAA.
Tools Without BAA — Do Not Use With PHI
The standard free, Plus, and Pro versions of ChatGPT, Claude, Google Gemini, and Microsoft Copilot do not offer BAA coverage. Using any of these consumer products with patient information — even names and appointment details — is a HIPAA violation.
This is the mistake most practices make. A staff member asks ChatGPT to draft a follow-up message mentioning a patient's name and condition. That single prompt contains PHI processed by a non-compliant system.
How to Verify Any AI Tool's Compliance
Request the BAA document directly from the vendor. Ask specifically whether your data will be used to train their AI models. Verify encryption standards for data in transit and at rest. Confirm the vendor's breach notification procedures. Add the tool to your practice's HIPAA security risk assessment. Review the vendor's compliance status quarterly — policies change.
Start by auditing every AI tool your practice currently uses. Identify which ones handle PHI. Verify BAA status for each. Replace non-compliant tools with compliant alternatives. Train all staff on appropriate use policies. Document everything for potential audits.