Is ChatGPT HIPAA compliant? Which AI tools sign a BAA

Start with the office suite you already pay for, not a new AI subscription. If the practice runs on Microsoft 365 or Google Workspace and has signed that vendor's BAA, Copilot Chat or Gemini may already be covered for the whole staff (Microsoft; Google). Check that before anyone signs up for anything.

ChatGPT for Clinicians is a good tool for the doctor and the wrong answer for the office. It is free and comes with an individual BAA, but only verified physicians, NPs, PAs and pharmacists can join, and it is designed for one person (OpenAI). Your front desk and billing staff, who write most of the letters, are not covered by the doctor's account. Dentists are not on OpenAI's current eligibility list.

The bigger risk is the personal account, not the vendor. A practice can sign every BAA on this page and still leak patient information the first time someone pastes a note into ChatGPT on their phone. A one-page rule that names the approved tools, plus the checklist below, does more than any contract.

A Business Associate Agreement is the written contract HIPAA requires before a vendor may create, receive, maintain or transmit patient information for your practice (45 CFR 164.502(e)). It must limit what the vendor may do with the information, require safeguards and Security Rule compliance, require the vendor to report improper disclosures and breaches, bind its own subcontractors, and require return or destruction of the information at the end where feasible (45 CFR 164.504(e)).

What it does not cover:

• Features outside the covered list. OpenAI excludes improved memory and event-triggered scheduled tasks (OpenAI). Anthropic excludes connectors, skills and beta features (Anthropic). Google excludes Gemini in Chrome (Google).
• Third parties you connect. Plugins, connectors, custom GPTs from outside your workspace and browser extensions send data to other companies. OpenAI tells clinicians not to share PHI with third-party GPTs or connected apps without the right agreements (OpenAI).
• Anyone outside the signing organization. Anthropic's BAA "only covers the single organization that accepted it" (Anthropic). A staff member's personal account on the same product is not covered.
• Your practice's own duties. Minimum necessary, access control and training stay with you. Microsoft: "using Microsoft services doesn't on its own achieve HIPAA compliance" (Microsoft).
• Whether the answer is right. A BAA is about privacy, not accuracy. OpenAI says ChatGPT for Clinicians is "intended to support, not replace, professional judgment" (OpenAI).

An AI vendor that handles patient information is a business associate. HIPAA defines a business associate as anyone who creates, receives, maintains or transmits protected health information on a covered entity's behalf (45 CFR 160.103). HHS's own examples include a third-party vendor chatbot on a provider's patient portal that handles symptom assessment, medical reminders and appointment scheduling. The conduit exception does not help: it is limited to transmission-only services, and anyone who accesses the information regularly to perform a service is not a conduit (HHS business associate guidance).

Minimum necessary applies to what you send. A practice must make reasonable efforts to limit protected health information to the minimum necessary for the purpose (45 CFR 164.502(b)), and must decide which staff need which information (45 CFR 164.514(d)). The rule's exception for disclosures to a health care provider for treatment doesn't fit an AI vendor, which is not treating anyone. Even with a BAA, paste the paragraph the task needs, not the chart.

De-identified data is outside HIPAA, but de-identifying is harder than deleting a name. HIPAA allows two methods (45 CFR 164.514(b)). Expert Determination needs a qualified expert to find, and document, a very small risk of re-identification. Safe Harbor needs 18 kinds of identifiers removed, for the patient and their relatives, employer and household, and no actual knowledge that what remains could identify them. The 18 include names; any place smaller than a state, including street, city and most of the ZIP code; every date element except the year, and ages over 89; phone and fax numbers; email; Social Security, medical record, health plan and account numbers; license, vehicle and device identifiers; web addresses and IP addresses; biometrics such as voiceprints; full-face photos; and any other unique number, characteristic or code. HHS says identifiers must come out of free text too, and that clinical narratives "are information rich and may provide context that readily allows for patient identification." Once data truly is de-identified, the Privacy Rule no longer restricts it (HHS de-identification guidance).

A slip is presumed to be a breach. A use or disclosure the Privacy Rule doesn't permit is presumed to be a breach unless the practice shows a low probability that the information was compromised, weighing what was disclosed, to whom, whether it was actually viewed, and how the risk was mitigated (45 CFR 164.402).