ChatGPT Enterprise customers can now sign a Business Associate Agreement (BAA) to handle protected health information, but OpenAI's coverage is narrower than many assume. The company publishes an explicit allow list of features covered under HIPAA compliance, meaning not every ChatGPT capability is safe for healthcare use, even after signing the agreement.

What Does ChatGPT's HIPAA Coverage Actually Include?

OpenAI's BAA eligibility guidance has evolved significantly since ChatGPT Enterprise launched in August 2023. At that time, the company made no mention of HIPAA or compliance agreements at all. Today, sales-managed ChatGPT Enterprise customers can request a BAA, but the coverage comes with strict limitations.

The allowed features under HIPAA protection include:

• Chat with Files: Users can upload and analyze documents containing patient information within the chat interface.
• Voice Input: Clinicians and staff can interact with ChatGPT using voice commands for hands-free operation.
• Web Search and Deep Research: ChatGPT can search OpenAI's own index for current medical information, though not third-party sources like Bing.
• Canvas: A collaborative editing workspace for drafting clinical notes and documentation.
• Image Generation: Creating medical illustrations or educational diagrams.
• Projects and Custom GPTs: Building organization-specific AI workflows tailored to healthcare workflows.
• Desktop and Mobile Clients: Secure access across devices.

Any feature an administrator enables outside this list is, by OpenAI's own language, "intended only for uses that do not involve transmission, storage, or processing of protected health information". This distinction matters enormously for healthcare organizations evaluating ChatGPT as a clinical tool.

Why Are Healthcare Organizations Rushing to Adopt AI Like ChatGPT?

The demand for AI in healthcare is accelerating rapidly. OpenAI's own December 2025 enterprise survey identified healthcare as one of the fastest-growing adoption sectors, alongside technology and manufacturing. The numbers tell a striking story about physician adoption.

According to the American Medical Association's 2026 survey of 1,692 physicians, more than 80 percent of physicians now use AI professionally. This represents roughly double the share from 2023, a dramatic shift in just three years. The global AI-in-healthcare market was valued at $36.7 billion in 2025 and is projected to grow to $50.7 billion in 2026, expanding at a compound annual growth rate of 38.9 percent through 2033.

This explosive growth reflects real clinical needs. Healthcare organizations are using ChatGPT to draft clinical documentation, summarize patient records, generate educational materials for patients, and assist with research literature reviews. The speed and accessibility of AI assistance can reduce administrative burden on clinicians, freeing time for direct patient care.

How to Evaluate ChatGPT for Your Healthcare Organization

• Verify BAA Eligibility: Confirm that your organization qualifies for a sales-managed ChatGPT Enterprise BAA. Free, Go, Plus, Pro, and Business tiers are not eligible for HIPAA coverage, so enterprise-level agreements are mandatory for any protected health information use.
• Map Your Intended Use Cases: Document exactly which ChatGPT features your organization plans to use. Cross-reference each intended use against OpenAI's published allow list to ensure coverage. If a needed feature is not on the list, it cannot be used with patient data.
• Review Competitive Options: Microsoft has offered HIPAA BAA coverage for Microsoft 365 services, including Copilot Chat, for years. Google's Workspace and Cloud Identity administrators can accept a BAA before using Gemini with protected health information. Anthropic added HIPAA-ready coverage to Claude Enterprise in 2026 through a self-serve activation flow. Evaluate all vendors' coverage tables before committing.
• Plan for Feature Changes: OpenAI's allow list is changeable and updated with each new feature rollout. Establish a process to re-check coverage whenever ChatGPT releases new capabilities to ensure ongoing compliance.
• Contact Sales for Pricing: OpenAI does not publish ChatGPT Enterprise per-seat pricing or minimum seat commitments. Organizations must contact sales directly for a quote based on their estimated seat count and specific requirements.

The Broader Trend: AI Compliance Is Becoming Standard Practice

OpenAI is not alone in offering HIPAA-compliant AI tools. The fact that Microsoft, Google, and Anthropic all now provide BAA coverage signals that healthcare organizations expect AI vendors to meet regulatory requirements as a baseline offering. However, none of the four vendors treats "signing a BAA" as equivalent to "every feature is HIPAA-safe." All four publish granular, changeable coverage tables that buyers must re-check before every new feature rollout.

This fragmentation creates a practical challenge for healthcare IT teams. The task is not simply asking "does this vendor sign a BAA," but rather mapping which specific product tier, feature set, and price band actually covers the intended use case. Organizations that skip this step risk deploying AI tools in ways that violate HIPAA, even after signing an agreement.

For life sciences and healthcare organizations navigating this decision, the key takeaway is clear: ChatGPT Enterprise can support HIPAA-compliant workflows, but only if you verify coverage feature-by-feature and maintain that verification as the product evolves. The rapid adoption of AI in healthcare reflects genuine clinical value, but that value only materializes when compliance is built in from the start.