LLM vendor BAA & zero-retention matrix

Which LLM providers will sign a HIPAA business associate agreement (BAA), what it covers, what it excludes, and how retention works, summarized from each vendor's own documentation.

Last verified: October 18, 2026. Vendors change these pages often, and the BAA and the vendor's implementation guide are what actually control. This page summarizes public documentation; it isn't legal advice, and a BAA alone doesn't make your application HIPAA compliant. Found something out of date? Tell me.

At a glance

Provider / surface	BAA?	How you get it	Watch out for	Training on your data
Anthropic API (Claude, first-party)	Yes	Self-serve in the Claude Console (standard BAA) or via sales for a custom BAA. HIPAA mode is permanent for that org.	Batch, Files, Skills, code execution and web fetch aren't covered. Non-eligible features return an error in a HIPAA org. Don't put PHI in JSON schemas.	No (commercial default)
Claude Enterprise	Yes, once activated	The Primary Owner activates HIPAA and accepts the BAA in org settings.	Connectors/MCP, Enterprise Search and Claude in Chrome aren't covered. Claude Code is covered only in specific configurations.	No
Claude Free / Pro / Max	No	—	Consumer plans aren't covered.	—
OpenAI API	Yes	Self-serve in API Platform settings (requires API usage history), otherwise by email request. Must also be provisioned with Modified Retention. Can't be disabled once on.	Live web search isn't eligible. Stateful features (assistants, threads, vector stores, files) keep data until you delete it.	No (API default)
ChatGPT for Healthcare / Enterprise (Regulated Workspace)	Yes	Through OpenAI sales.	Several features are excluded (e.g., Codex cloud, some memory, scheduled-task and browsing features). Standard Enterprise coverage without Regulated Workspace isn't clearly stated: confirm with OpenAI.	No (by default)
ChatGPT Business	No	—	OpenAI states it does not offer a BAA for ChatGPT Business.	—
Google Cloud: Gemini Enterprise Agent Platform (formerly Vertex AI)	Yes	Accept the Google Cloud BAA (via Google Cloud's privacy compliance flow).	Pre-GA features excluded. Search/Maps grounding and Deep Research keep data for set periods that can't be disabled. The Interactions API stores by default. Partner-model coverage isn't stated.	No, without permission
Gemini API / Google AI Studio	Not listed	—	Not on Google's BAA product list. On unpaid tiers, data may be used to improve products, with human review.	Unpaid: yes. Paid: no.
AWS Bedrock	Yes	Accept the AWS BAA in AWS Artifact (self-serve). Bedrock and Bedrock AgentCore are HIPAA-eligible.	Some models have their own retention rules (some newer models retain traffic up to 30 days). Cross-region inference stores retained data in the destination region. Keep PHI out of tags and names.	No (AWS or model providers)
Azure OpenAI (Microsoft Foundry)	Likely, but confirm	Microsoft's HIPAA BAA is included in its Product Terms/DPA for in-scope services, with no separate signature.	We couldn't confirm Azure OpenAI is on the public in-scope list (it sits in an appendix behind sign-in). Preview features may lack protections. Global/DataZone deployments can process outside your geography.	No, without permission

Claude through Bedrock or Google's platform falls under the cloud provider's terms, not Anthropic's HIPAA program. Anthropic's own pages currently conflict about Claude in Microsoft Foundry, so confirm with Anthropic and Microsoft before relying on it.

Anthropic

BAA for commercial services such as the first-party API; enable in the Console with the standard BAA, or work with sales for a custom one. The HIPAA-ready configuration can't be turned off, so use a separate org for non-HIPAA work. The BAA covers only the org that accepted it. (API data retention, BAA article)
Covered: the Messages API and supporting APIs. Not covered: Batch, Files, Skills, code execution, web fetch, and several agent and connector features. In a HIPAA org, non-eligible features return an error.
Retention: API inputs and outputs are deleted within 30 days by default. Zero data retention is approved per organization through sales, and isn't required for the API BAA. Flagged content may be retained longer even with ZDR. Some newer models require 30-day retention. (retention, ZDR scope)
Training: commercial inputs and outputs aren't used for training by default; feedback you submit can be. (training)

OpenAI

API BAA: self-serve in API Platform settings once you have usage history; otherwise request by email. An enterprise agreement isn't required. Once enabled, it can't be disabled. (BAA for the API)
HIPAA eligibility also requires Modified Retention provisioning. Eligible products include ChatGPT for Healthcare, ChatGPT Enterprise with Regulated Workspace, and the API with Modified Retention; specific ChatGPT features are excluded. (eligible products)
Retention: abuse-monitoring data is retained up to 30 days by default. ZDR requires approval, and stateful endpoints store application state until deleted even under ZDR. Live web search isn't HIPAA-eligible. (API data controls)
ChatGPT Business: no BAA. Training: API data isn't used to train by default.

Google

Google Cloud's BAA covers listed products, including Generative AI on Gemini Enterprise Agent Platform (the new name for Vertex AI), Gemini Enterprise and Gemini Code Assist. It isn't region-restricted. Don't use pre-GA offerings for PHI. (Google Cloud HIPAA)
Data governance: no training without permission. Implicit caching is on by default and deleted within 24 hours (it can be disabled). Google Search grounding logs (about 3 days), Maps grounding (30 days) and Deep Research sessions (7 days) can't be disabled. The Interactions API stores by default; set store to false. (zero data retention)
Gemini API / AI Studio isn't on the BAA list. Unpaid usage may be reviewed by humans and used to improve products. (Gemini API terms)

AWS Bedrock

Accept the AWS BAA in AWS Artifact. Amazon Bedrock and Bedrock AgentCore are on the HIPAA-eligible services list, and PHI should only go into eligible services. (eligible services, AWS HIPAA)
Neither AWS nor model providers train on your Bedrock inputs and outputs, and providers can't see your prompts or logs. Retention is a per-Region setting, and models that require retention are blocked in zero-retention mode. Some models retain traffic for abuse review. (data retention, abuse detection)
Keep sensitive data out of tags and free-text name fields, which flow into billing and diagnostic logs. (data protection)

Microsoft Azure

Microsoft's HIPAA BAA comes with its Product Terms/DPA for in-scope services; there's no separate contract to sign. The in-scope list is in an appendix we couldn't access publicly, so confirm Azure OpenAI's status with Microsoft. (Azure HIPAA)
Prompts and completions aren't used to train foundation models without permission and aren't available to OpenAI. Stateful features store data in your resource. Preview features may not have the same protections. Modified abuse monitoring is available on application. (data privacy, abuse monitoring)

Traps that show up across vendors

Beta and preview features are usually excluded from the BAA.
Stateful features (files, threads, vector stores, batch, agents) often keep data or fall outside zero retention.
Web search and grounding tools may be ineligible, or retain logs you can't disable.
Connectors, MCP and third-party tools: the LLM vendor's BAA doesn't cover the other vendor.
Logging and telemetry: request logging, observability exports and free-text fields can carry PHI.
Model-specific retention: some newer models require retention even when your account has zero retention.
Consumer and low tiers (Claude Free/Pro/Max, ChatGPT Business, the unpaid Gemini API) don't come with a BAA.

What HHS says about cloud providers

HHS guidance is clear that a cloud provider storing or processing ePHI is a business associate, even if it can't view the data, and that using one without a BAA violates the HIPAA Rules. (HHS cloud computing guidance, business associates, 45 CFR 164.504(e))

Next: the HIPAA checklist for AI startups, or book a 30-min triage to check your own setup.