A standard ChatGPT account, the one a colleague might use for emails, is not a HIPAA-eligible workspace for PHI. ChatGPT Business is not eligible for a BAA. If you need to enter patient information, use an eligible OpenAI product only after the applicable BAA and covered functionality are confirmed.
OpenAI has built healthcare-specific products in 2026, and the picture is more nuanced than “ChatGPT bad.” But the nuances do not change the situation for most individual physicians. Here is what is actually true.
Key takeaways
- Standard consumer accounts and ChatGPT Business are not HIPAA eligible for PHI use.
- OpenAI’s eligible list includes ChatGPT for Healthcare, Enterprise with Regulated Workspace, FedRAMP, Clinicians, and modified-retention API products.
- Eligible individual clinicians use a separate in-product BAA flow for ChatGPT for Clinicians.
- A signed BAA is necessary but not sufficient: data residency, audit logs, and access controls are also part of a HIPAA-compliant implementation.
- Purpose-built AI scribes can provide a narrower documentation workflow with explicit retention controls and a BAA.
What OpenAI actually offers by tier
OpenAI’s current HIPAA-eligible list spans several products. The account name alone is not enough; eligibility, the BAA, and covered functionality all matter.
Standard consumer accounts and ChatGPT Business: These are not HIPAA eligible for PHI use. OpenAI’s BAA guidance explicitly excludes ChatGPT Business.
ChatGPT for Healthcare (enterprise, launched January 8, 2026): OpenAI’s hospital-grade product. Includes a BAA, customer-managed encryption keys, data residency options, and audit logs. Deployed at Stanford Medicine Children’s Health, UCSF, HCA Healthcare, Cedars-Sinai, Memorial Sloan Kettering, and others. Getting access means going through enterprise sales. It is not available via standard account signup.
ChatGPT for Clinicians (individual, launched April 2026): Free for verified US physicians, NPs, PAs, and pharmacists. It supports clinical literature search, prior authorization drafts, CME tracking, and documentation support. OpenAI lists it as HIPAA eligible and directs eligible individual clinicians to a separate in-product BAA flow.
Enterprise, Edu, and FedRAMP: OpenAI’s current eligible-product list includes Enterprise with Regulated Workspace and ChatGPT FedRAMP. Sales-managed Enterprise and Edu customers contact OpenAI about a BAA. Administrators must keep PHI within covered functionality.
OpenAI API: Developers can request a BAA at baa@openai.com. HIPAA eligibility generally requires the organization to be provisioned with Modified Retention, and only covered endpoints and services may process PHI.
| Product or account | HIPAA eligibility | BAA path |
|---|---|---|
| Standard consumer account | No | None |
| ChatGPT Business | No | None |
| ChatGPT for Clinicians | Yes, for eligible clinicians | Separate in-product flow |
| ChatGPT for Healthcare | Yes | Enterprise agreement |
| Enterprise / Edu | Qualifying sales-managed customers | Contact OpenAI sales |
| API with Modified Retention | Yes, for covered services | Request at baa@openai.com |
ChatGPT for Clinicians: what it is, what it is not
OpenAI announced ChatGPT for Clinicians on April 22–23, 2026. The clinical validation involved physician advisors testing the system across nearly 7,000 conversations on clinical care, documentation, and research. The advisors rated 99.6% of responses as safe and accurate. That figure comes from OpenAI’s own testing process, not an independent clinical trial.
It covers research queries against peer-reviewed literature with real-time citations, prior authorization drafts, patient instruction suggestions, and documentation assistance. Eligible individual clinicians can use the separate in-product BAA flow. That does not turn every feature into a PHI workflow: the account must be eligible, the BAA must apply, and the functionality must be covered.
That distinction matters. A tool can be designed for clinicians and still not be ready to handle patient records in the way a HIPAA audit would require.
Why a BAA alone is not enough
Even on the tiers where OpenAI does offer a BAA, the agreement covers OpenAI’s handling of the data. It does not automatically make your implementation compliant. A ReframePractice analysis of the enterprise tier put it clearly: a compliant setup also requires the right account configuration, audit logging, documented workflows that limit PHI exposure, and workforce training.
The audit question is not just “did you sign a BAA?” It is: Where does the data physically sit? Who can access the conversation logs? How do you prove no PHI leaves your environment? These are engineering and governance questions that a signed agreement does not answer by itself.
What makes a documentation tool actually HIPAA-appropriate
Clinicians who tried ChatGPT for notes usually landed there because they needed a faster way to document, not because they needed a general-purpose AI assistant. Those are different problems.
A purpose-built AI scribe handles PHI differently by design. Audio is processed in memory, never written to disk, and discarded once the note is generated. There is nothing stored to breach after the visit ends. A BAA is standard for every customer, regardless of practice size, not something you have to negotiate your way into. The workflow is closed: the scribe runs during the visit, the draft appears about two minutes after the patient leaves, and you review and sign. Nothing passes through a general-purpose chat interface.
The AI Medical Scribe by Patient Square is the ambient scribe module inside Practice Copilot: it listens during the visit and hands back a structured SOAP note, ICD-10 suggestions, and a prescription draft, ready to review and sign minutes after the visit. Audio is processed in memory and never stored. Safeguards are HIPAA compliant, and a BAA is available for every customer. SOC 2 Type II audit is underway. You can read the specifics at our security page.
When ChatGPT for Healthcare actually makes sense
This is the honest part. OpenAI’s enterprise product is not a toy.
If you work inside a hospital system that has signed an enterprise agreement with OpenAI, that institution has already done the governance work: BAA, data residency, audit logs, workforce policy. In that context, ChatGPT for Healthcare is a real tool with real compliance scaffolding. Stanford Medicine and UCSF are not naive about data security.
If you are a physician at one of those institutions, using ChatGPT through the institutional deployment with PHI can be appropriate. The institutional IT and compliance teams have made that call.
If you are an independent practitioner in a small or mid-size practice, a standard ChatGPT login is still the wrong place for PHI. Eligible clinicians can evaluate ChatGPT for Clinicians and its in-product BAA flow, then verify that the specific functionality they plan to use is covered.
The practical question
The physician who tried ChatGPT for notes usually did it late on a Tuesday, with a stack of charts and no documentation tool that actually helped. That impulse is understandable. The gap is real.
You can close that gap with a general-purpose chat interface or with a tool built for the specific problem. The risk profiles, workflows, and HIPAA postures are different.
If you want to see what a purpose-built documentation workflow looks like against your specific visit type, our HIPAA BAA and consent guide walks through what a compliant AI scribe relationship requires, and our security checklist for AI scribes gives you the twelve questions to ask any vendor before signing. We offer a 7-day trial — run it on a real clinic week, look at the note quality, and check it against what you were doing before.