A question that CISOs and compliance officers in healthcare often ask is whether ChatGPT Enterprise is HIPAA-compliant. OpenAI offers BAA-eligible products and will sign a Business Associate Agreement (BAA).
But a signed BAA covers OpenAI’s obligations, not yours. What happens on your side, what employees type into prompts, which product tiers they use, and how your safeguards are configured is entirely outside the BAA’s scope.
This article explains why healthcare organizations want ChatGPT Enterprise, what OpenAI actually provides, what HIPAA still requires from you after the BAA is signed, where PHI leaks in practice, and what it takes to prevent those leaks.
Key Takeaways
- OpenAI’s ChatGPT Enterprise, the API Platform, and ChatGPT Health support BAAs, but consumer tiers like Free, Plus, Pro, and Team do not.
- A signed BAA covers OpenAI’s obligations, not yours. Risk analysis, workforce training, minimum necessary enforcement, access controls, and audit trails all remain your responsibility as the covered entity.
- PHI leaks occur across the entire AI interaction lifecycle—before prompts reach the model, during model processing, and in generated outputs. The most common exposure points include shadow AI usage, embedded AI tools, and employees unintentionally sharing sensitive data in conversational workflows.
- Defensible HIPAA compliance requires real-time, in-flow controls that analyze prompts and responses based on user intent, enforce policy before data reaches external models, and generate complete audit trails across all AI interactions.
Healthcare Is Racing Toward ChatGPT Enterprise: Why That Creates a HIPAA Problem
Reducing the clinical documentation burden is one of the biggest EHR-related workflow challenges, and 54% of healthcare CIOs say AI could help solve it.
Tools like ChatGPT help with ambient listening, dictation, and automated notes to capture real-time patient-clinician conversations for clinical documentation, including diagnoses and treatment plans. About 79% of healthcare organizations now use ambient speech technology to support clinical documentation.
But the use cases driving this adoption involve Protected Health Information (PHI) by definition. Medical coding automation and claims adjudication require clinical records, insurance data, and medical-necessity documentation. Chart summarization pulls from medical histories.
Even clinical meeting transcription captures PHI when care teams discuss specific patients. And PHI isn’t limited to clinical records — billing data, payment information, and claims history all qualify, as does electronic PHI (ePHI) maintained or transmitted digitally.
The tension is clear: the healthcare use cases that make generative AI valuable are also the ones most likely to involve protected health information. That makes the compliance question unavoidable, and the answer can’t stop at “we signed a BAA.” The real challenge is enabling teams to use AI safely in production workflows — without introducing compliance risk or slowing down innovation.
How Far OpenAI’s HIPAA Support Actually Goes
OpenAI has built a strong security foundation for model hosting. You get data controls that, by default, prohibit training on your data, keep inputs and outputs customer-owned, and let you set your own retention periods. OpenAI will also sign a BAA, a necessary first step under HIPAA.
But buying ChatGPT Enterprise doesn’t flip a “HIPAA compliant” switch. Here’s what to know about which products qualify, what the BAA commits OpenAI to, and where the vendor’s responsibility ends.
Not All OpenAI Products Are BAA-Eligible
Currently, OpenAI only provides BAAs on its API Platform and for ChatGPT Enterprise for sales-managed customers. OpenAI has also launched ChatGPT Health and OpenAI for Healthcare as purpose-built offerings for hospitals and clinicians.
Consumer tiers (Free, Plus, Pro, and Team) are not eligible for HIPAA BAAs. If anyone at your organization is using those tiers for patient data, that activity has zero BAA protection, and no amount of enterprise-level compliance work can fix it.
OpenAI’s own Services Agreement makes this explicit in all caps: “NOT ALL SERVICES OFFERED BY OPENAI ARE DESIGNED FOR PROCESSING PROTECTED HEALTH INFORMATION.” Even for the products that do qualify, OpenAI handles BAAs on a case-by-case basis.
What the BAA Commits OpenAI To
The BAA legally binds OpenAI to restrict how it uses and discloses your PHI, implement Security Rule safeguards, report breaches, hold subcontractors to the same standards, and return or destroy PHI when the relationship ends.
OpenAI also provides the security building blocks you’ll need: SSO, MFA, role-based access controls, data residency controls, IP allowlisting, and security controls backed by SOC 2 Type 2 certification. But every one of these must be actively configured by your team.
Where OpenAI’s Responsibility Stops
The BAA governs how OpenAI handles data after it receives it. It says nothing about what happens on your side before data ever reaches OpenAI. Not what employees type into prompts, not which tiers they use, not whether they paste a patient’s full medical history into a chat window.
The controls that determine whether your deployment is actually defensible — risk analysis, workforce training, minimum necessary enforcement, access configuration, and monitoring — all live on your side of that line.
Your HIPAA Obligations Beyond the BAA
When your organization uses a cloud service like ChatGPT to create, receive, maintain, or transmit ePHI, the provider becomes a business associate under HIPAA, but you remain the covered entity with primary compliance responsibility.
Under HIPAA’s administrative safeguard requirements, the covered entity is responsible for obtaining satisfactory assurances from its business associates. But the regulation doesn’t let you stop there. Several categories of obligations remain squarely with your organization, grouped below by when they matter most.
Before Data Reaches OpenAI
Your organization must have two things in place before any PHI enters ChatGPT:
- An independent risk analysis. Risk analyses are required for both covered entities and business associates to identify threats and vulnerabilities to all ePHI they create, receive, maintain, or transmit. OpenAI’s SOC 2 report is not a substitute for your own assessment of how your organization uses ChatGPT.
- Minimum necessary enforcement at the point of employee interaction. This means controlling what goes into prompts before PHI reaches OpenAI’s systems, not just what OpenAI does with the output.
These controls set the boundary for what your employees can and can’t send to OpenAI. But controls are only as good as the workforce using them.
Your Workforce
HIPAA’s Security Rule requires your organization to implement a security awareness and training program for all members of its workforce. Specifically, staff need training on:
- PHI identification in AI contexts
- Which product tiers are prohibited for PHI use
- How to apply the minimum necessary principles when prompting
- How to report incidents involving AI tools and patient data
The BAA doesn’t govern what employees type into prompts, but the training program helps them make informed decisions.
Ongoing Governance
Beyond training, your organization must ensure that every disclosure to a business associate has a legitimate purpose, and enforce that standard through policy and supervision. After deployment, several governance obligations require continuous attention:
- PHI access. HHS states that a business associate may not block or terminate a covered entity’s access to PHI, and that doing so would violate HIPAA requirements related to permissible uses of PHI and the availability of ePHI.
- Breach awareness. Active monitoring isn’t explicitly required under the HIPAA Privacy Rule, but a covered entity may be held liable if it knew of a pattern of activity or practice by a business associate that constituted a material breach and failed to take reasonable steps to cure the breach or end the violation.
- Safeguard configuration. ChatGPT for Healthcare supports SSO, MFA, and role-based access controls, but each must be integrated with your organization’s identity provider and configured to align with minimum necessary principles.
- Audit trail review. Audit trails should be regularly reviewed and are often retained for up to six years as a best practice aligned with HIPAA’s documentation requirements, but HIPAA does not explicitly require audit logs themselves to be kept for six years or integrated with a SIEM.
None of these obligations transfer to OpenAI through the BAA; they’re yours to implement, document, and maintain.
Two Ways PHI Leaks Before the BAA Can Help
The obligations outlined above are clear on paper. But in practice, PHI leaks through gaps that no BAA was designed to cover, all of them upstream, in the space between an employee and a prompt window.
- Staff using unapproved AI tools. Shadow AI is the most pervasive vector, and a survey of healthcare professionals found that 17% admitted to using unauthorized AI tools. Consumer ChatGPT tiers do not support BAAs, so when clinical staff use them with patient data, that data enters systems outside the organization’s HIPAA-controlled framework entirely.
- PHI pasted into approved AI tools. Even with a valid BAA in place, employees routinely type or paste PHI directly into prompts: clinical notes, patient names, diagnosis codes, and treatment details. Without technical controls enforcing the minimum necessary at runtime, there’s no mechanism to stop it.
None of this activity, shadow AI, personal accounts, or unfiltered prompts, is visible to the BAA or to OpenAI. That makes it a runtime defense problem, one that requires a unified AI governance approach rather than contractual protections alone.
WitnessAI enforces your AI policy through network-level runtime defense, analyzing prompts and responses in context, based on user intent and data sensitivity before they reach the model. Its intent-based policies and bidirectional defense protect PHI before it leaves the organization, while generating auditable trails and providing visibility into AI use across the workforce. No endpoint clients or browser extensions are required.
HIPAA Compliance Checklist for ChatGPT Enterprise Deployments
The following checklist outlines the organizational controls that must be in place before and continuously after deploying any OpenAI product in a HIPAA-regulated environment.
Before deployment:
- Assess how any use of AI affects ePHI across your organization
- Ensure a signed BAA is in place before any PHI is processed through OpenAI’s systems
- Confirm that the specific OpenAI product tier selected is eligible for HIPAA use
- Establish and distribute clear acceptable use policies for AI tools that address PHI handling
- Complete an independent risk analysis specific to your organization’s use of ChatGPT
Technical controls (available but not enabled by default; each must be actively configured):
- Integrate SSO with your enterprise identity provider and align role-based access to the minimum necessary, with periodic access reviews and documented results
- Configure automatic session timeouts and emergency access procedures per the Security Rule’s technical safeguard requirements
- Maintain audit trails with regular review procedures and retention aligned to applicable legal and organizational requirements
- Configure and document data residency settings, with processing locations aligned to organizational policy and any state-level privacy requirements
- Deploy runtime controls that detect PHI in outbound prompts before data reaches the model, with auditable evidence of enforcement
Ongoing obligations:
- Monitor your business associate relationship with OpenAI on a documented review cadence
- Deliver and document AI-specific workforce training on PHI handling, prohibited tiers, and minimum necessary prompting
- Develop AI-specific incident response procedures, including breach scenarios where PHI enters unauthorized tools, with documented response protocols
- Maintain a technology asset inventory that includes all AI systems used to create, receive, maintain, or transmit ePHI, in preparation for the proposed Security Rule modernization
These controls are what turn vendor capabilities into a defensible deployment model. Without them, a signed BAA still leaves the hardest operational problems unresolved.
The Bottom Line
OpenAI’s BAA-eligible products, ChatGPT for Healthcare and the API Platform with zero data retention configured, can be part of a HIPAA-compliant deployment. But the BAA is a necessary starting point, not a finish line. The hardest compliance problems live on your side: what employees do before data ever reaches OpenAI.
As healthcare AI evolves from interactive tools to agentic systems that act autonomously, runtime defense and governance become even more critical. Addressing the compliance blind spot at the moment an employee types a prompt requires independent risk analysis, workforce training, minimum necessary enforcement, access controls, audit trails, and active vendor monitoring.
For healthcare organizations facing this reality, WitnessAI provides unified AI security and governance to help teams adopt AI with confidence
Discover how WitnessAI helps you move beyond the BAA and deploy ChatGPT Enterprise with HIPAA-compliant defenses you can defend.