Is Claude HIPAA Compliant? A 2026 Guide for Healthcare Providers

Short answer: Claude is not "HIPAA compliant" out of the box, but Anthropic offers a Business Associate Agreement (BAA) covering what it calls HIPAA-ready services: its first-party API and Claude Enterprise plans, subject to configuration requirements and a list of features that are not covered. Anthropic's BAA article is explicit that a standard Claude Enterprise plan has no BAA coverage until the organization's Primary Owner activates HIPAA compliance and accepts the BAA. The consumer plans (Free, Pro, and Max) are not among the HIPAA-ready services, so protected health information (PHI) does not belong in them. This guide explains, in 2026, what HIPAA actually requires of an AI tool, which Anthropic products can be made compliant, and what a clinical or health-tech team has to do to keep PHI from leaking — including when staff use unsanctioned accounts.

Last reviewed October 1, 2026 against the regulations and vendor documentation listed under Sources and primary references.

What HIPAA requires of any AI tool

The Health Insurance Portability and Accountability Act (HIPAA) is implemented through three rules that all apply when an AI vendor handles PHI on your behalf:

• Privacy Rule — defines PHI and the conditions under which it may be used or disclosed.
• Security Rule — defines administrative, physical, and technical safeguards for electronic PHI (ePHI).
• Breach Notification Rule — defines what counts as a breach and the timelines for reporting it.

For Anthropic (or any other AI provider) to lawfully process PHI for a covered entity, three conditions must be true:

1. The provider qualifies as a business associate because it creates, receives, maintains, or transmits PHI on the covered entity's behalf for a regulated function or activity.
2. A signed Business Associate Agreement (BAA) contractually extends HIPAA obligations to the provider and meets the content requirements of 45 CFR 164.504(e).
3. The product, in the configuration you actually use, supports the Security Rule's technical safeguards: access control, audit controls, integrity, authentication, and transmission security, with encryption an addressable specification.

A covered entity may disclose PHI to a business associate only after obtaining satisfactory assurance that it will safeguard the information, documented in a written contract (45 CFR 164.502(e)). Without that, sending PHI to Claude is an impermissible disclosure, regardless of how secure Anthropic's infrastructure is.

Where Anthropic stands on HIPAA in 2026

As of October 1, 2026, Anthropic's BAA article for commercial customers describes the following.

• Claude Enterprise. Coverage is not automatic. The Primary Owner must activate HIPAA compliance in the HIPAA-ready Claude Enterprise organization settings under "Data and privacy" and accept the BAA. Covered features include chat, Projects, Artifacts, file creation and code execution (excluding network access and external websites), voice, web search, research, and skills. Connectors, enterprise search, and Claude in Chrome are available, but data sent to third parties through them is not covered. Cowork is available but not covered, and several beta features, including Claude Design, Slides, and Docs, are not available for HIPAA-ready organizations.
• The first-party Anthropic API. The Primary Owner signs the BAA and then contacts Anthropic to have it turned on. The Messages API is covered, along with listed features such as prompt caching, structured outputs, memory, web search, and the bash and text editor tools. The Batch API, Files API, Skills API, code execution, computer use, and web fetch are not covered and are not accessible to HIPAA-ready API users.
• Claude Code. Covered under the BAA only when ZDR is enabled, and ZDR is for qualified accounts only. Claude Code on the web, Code Review, Computer Use, and Remote Control are not covered.
• Retention. Anthropic's BAA article says its Covered Models require 30-day retention and are not available with ZDR enabled. Its retention article says prompts and outputs for those models are retained for 30 days to support safety work, on every platform where they are offered, and deleted after that unless flagged or legally required to be kept. Which models are Covered Models is defined in Anthropic's own documentation, so check it before choosing a model for PHI workloads.
• Version dates matter. Some features are covered only under BAA versions accepted after a specific date: December 2, 2025 for the Enterprise features and April 1, 2026 for the Messages API features. The BAA also covers only the single organization that accepted it.

Cloud providers' BAAs cover their own listed services. AWS lists Amazon Bedrock as a HIPAA Eligible Service and requires an AWS BAA before ePHI is involved. Google's HIPAA guide did not name Anthropic models when we reviewed it, so if you reach Claude through a cloud platform, confirm with that provider that the specific model and region are in scope under your agreement with them.

The consumer plans (Free, Pro, and Max) are not HIPAA-ready services. Anthropic's data-use article for consumer plans says chats and coding sessions may be used to improve its models if you choose to allow it, and that conversations flagged for safety review may be used as well. A training opt-out is a privacy setting, not HIPAA coverage: PHI sent to a consumer Claude plan is still an impermissible disclosure for a covered entity.

This distinction matters because the user interface is the same. A clinician at claude.ai cannot tell from the chat window whether they are signed into a personal Pro account or the BAA-covered enterprise tenant their employer manages. Operationally, "is Claude HIPAA compliant?" is really "which Claude account am I in right now, and is it under a BAA?" Schools and EdTech vendors face the same structure under a different statute — see Is Claude FERPA Compliant?.

What a HIPAA-aligned Claude deployment looks like

A health system, payer, digital-health vendor, or research org that wants to use Claude on PHI typically needs to:

1. Sign and activate a BAA. For Claude Enterprise, the organization's Primary Owner accepts it in the HIPAA settings. For the first-party API, the Primary Owner signs it and then contacts Anthropic to have it turned on. If you reach Claude through AWS or Google Cloud, your BAA is with that provider. The BAA must cover the specific product and features your workforce uses.
2. Choose models and retention deliberately. Zero data retention (ZDR) is available to qualified accounts, and Claude Code is covered under the BAA only with ZDR enabled. But Anthropic's Covered Models require 30-day retention and are not available with ZDR (BAA article, retention article), so a model's retention terms can decide whether it may be used for PHI. Cloud deployments add their own controls, such as encryption and key management; check what the cloud provider's BAA covers.
3. Restrict workforce access to the BAA-covered tenancy. Block Claude.ai consumer endpoints at the network or identity layer so a staff member cannot accidentally sign into a personal Pro account on a work device.
4. Enforce least privilege in any agentic, MCP-tool-using, or Projects-style configuration, limiting the data sources Claude can read and the tools it can call. Anthropic's BAA article says data sent to third parties through connectors is not covered, so every connector needs its own BAA analysis.
5. Log access in a way that satisfies the Security Rule's audit-control standard. Anthropic lists its Compliance API among the covered API features; on the API you must still instrument logging on your side.
6. Train the workforce on what may and may not be sent (workforce training is required). A signed BAA does not authorize pasting any PHI, only PHI the workforce member is otherwise permitted to disclose for the specific task at hand.
7. Document everything (risk assessment, BAA, configuration, training records), because the Security Rule requires written policies and records of required actions and assessments, retained for six years (45 CFR 164.316(b)).

This is a real project, not a checkbox. Steps 3 and 6 are the easiest to underestimate.

The "shadow Claude" problem

Even with an enterprise contract, a common HIPAA exposure in 2026 is workforce members using consumer Claude.ai (or ChatGPT Plus, or Gemini, or Grok) for clinical or administrative tasks because the personal account is faster and feels less monitored than the sanctioned tool. A Wolters Kluwer Health survey of 518 providers and administrators, fielded by CITE Research in December 2025, found that 40 percent had encountered an unauthorized AI tool at work and nearly 20 percent admitted to using one. One in 10 said they had used an unauthorized tool for a direct patient-care use case, and half pointed to a need for faster workflows.

Two technical controls help materially:

• Device-level redaction. Locke 1.0 detects PHI categories — names, dates, MRNs, diagnoses, drug names, payer IDs — locally and replaces them with one-way placeholders before the prompt leaves the device. Even when staff use a non-sanctioned Claude.ai account, the unmasked PHI never crosses the wire. Reversible tokenization is planned shortly after 1.0.
• Egress controls for AI domains. Add claude.ai, chat.openai.com, gemini.google.com, copilot.microsoft.com, and similar destinations to your DLP and CASB rules. Treat them the same way you treat traffic to a personal cloud-storage provider.

Both controls are additive, not substitutes for a BAA. They reduce the size and severity of a leak when policy slips.

Examples: what is and is not allowed

The lines below assume a covered entity has a signed BAA covering Claude Enterprise or the Anthropic API. Without that BAA, the answer to every "yes" example is "no, this is an unpermitted disclosure."

The pattern: keep PHI inside the BAA boundary, or remove PHI before the request leaves the device.

How Claude for Work compares to ChatGPT Enterprise for healthcare

Both products can be configured for HIPAA workloads under a BAA. The relevant differences in 2026 are:

• Training posture. For consumer plans, Anthropic says it uses chats to improve its models if you choose to allow it, and it may also use conversations flagged for safety review (data-use article). OpenAI says API data is not used for training unless you opt in (API data controls) and that it does not train on ChatGPT Enterprise data (HIPAA guide).
• Retention. OpenAI offers Zero Data Retention and Modified Abuse Monitoring by approval. Anthropic offers ZDR to qualified accounts, but its Covered Models require 30-day retention and are not available with ZDR. Read each vendor's current retention terms for the specific model you plan to use.
• Cloud presence. Anthropic's retention article lists AWS Bedrock, Google Cloud, and Microsoft Foundry as platforms where Claude is offered. AWS lists Amazon Bedrock as a HIPAA Eligible Service once you have signed an AWS BAA. If your organization already holds a BAA with one of those clouds, confirm that the specific model is in scope under it.
• Audit logging. Both expose admin audit logs on enterprise plans. The richness varies by feature; verify the specific events your compliance program needs are captured.

The product-level "which is more HIPAA-friendly" question matters less than the organizational question: which BAA do you already have, and how well can you keep your workforce inside the covered tenancy?

Frequently asked questions

Does signing a BAA make Claude HIPAA compliant?

A BAA is necessary but not sufficient. Compliance requires the BAA plus the Security Rule's administrative, physical, and technical safeguards in your configuration and operation. Anthropic's BAA covers their part; the rest — workforce access controls, audit logs, training, incident response — is yours.

Is Claude.ai Pro HIPAA compliant if I only use it for de-identified data?

If the data is genuinely de-identified under HIPAA's Safe Harbor or Expert Determination methods, it is no longer PHI and HIPAA does not apply. The risk is that "de-identified" is harder than it looks. Safe Harbor requires removing 18 categories of identifiers and that you have no actual knowledge that what remains could identify the person. Expert Determination requires a qualified expert to determine, and document, that the risk of identification is very small. If you cannot document one of the two methods, treat the data as PHI.

What about Claude Projects, memory, and Computer Use?

Anthropic's BAA article lists coverage feature by feature. Projects are covered for Claude Enterprise under BAA versions accepted after December 2, 2025, and memory is covered on the Messages API under versions accepted after April 1, 2026, so check which version you signed. Computer use on the API is not covered. Cowork is available but not covered, and data sent to third parties through connectors or Claude in Chrome is not covered. Keep those off for clinical workflows unless you have confirmed otherwise.

Can a doctor use Claude.ai Pro with PHI if they "don't share the chats"?

No. The Privacy Rule regulates the act of disclosure to a non-BAA third party, not the visibility of the chat in the user's history. Pasting PHI into Claude.ai Pro is the disclosure, regardless of whether the conversation is later deleted or shared.

What if my staff already pasted PHI into a personal Claude account?

Treat it as a presumed breach. Investigate the account's data settings and any retention windows that apply, and document the disclosure. Under 45 CFR 164.402, an impermissible disclosure is presumed to be a breach unless you can demonstrate a low probability that the PHI has been compromised, based on a risk assessment of at least four factors: the nature and extent of the PHI involved and the likelihood of re-identification; who received it; whether it was actually acquired or viewed; and how far the risk has been mitigated. Document that assessment. If you cannot show low probability, notify affected individuals without unreasonable delay and no later than 60 days after discovery (45 CFR 164.404), and notify HHS (45 CFR 164.408): at the same time for breaches of 500 or more individuals, otherwise in an annual submission within 60 days after the end of the calendar year.

Your exposure does not depend on leadership knowing. A covered entity is liable for violations by workforce members acting within the scope of their agency, and a breach is treated as discovered when any workforce member other than the person who caused it knows of it, or would have with reasonable diligence.

Is Claude on Amazon Bedrock the same as Claude.ai for HIPAA purposes?

No. AWS lists Amazon Bedrock as a HIPAA Eligible Service, and using it for PHI requires an AWS BAA. Claude.ai is governed by Anthropic's consumer or commercial terms. The contractual, retention, and infrastructure posture is different, and Anthropic's Covered Model retention rules apply on cloud platforms too. Pick the path your security and procurement teams can support.

How does Locke relate to HIPAA when staff use Claude?

Locke is not a covered entity or business associate. It is a privacy layer that runs entirely on the user's device and never receives PHI or any other data. By detecting PHI categories on-device and replacing them with one-way placeholders before the prompt leaves the device, Locke materially reduces the surface where PHI can leak — including to non-BAA accounts. It is complementary to a properly executed BAA program, not a substitute for one.

A short HIPAA + Claude checklist

• Decide which Anthropic products your workforce may use for PHI, and which are blocked.
• Sign a BAA with Anthropic, AWS, or Google Cloud covering the specific Claude path you use.
• Check the retention terms for the specific model you plan to use. Anthropic's Covered Models require 30-day retention and are not available with ZDR.
• Block or proxy Claude.ai consumer endpoints at the network and identity layers.
• Deploy a local-first redaction tool to every browser used by clinical and administrative staff.
• Add AI-bound traffic to your DLP, CASB, and audit-log review.
• Train staff specifically on what may and may not be sent — verify with periodic walk-throughs, not just attestations.
• Re-assess annually; vendor product lines and HIPAA-eligible feature sets change frequently.

The bottom line

In 2026, "Is Claude HIPAA compliant?" is the wrong question. The right questions are: which Anthropic product am I using, do I have a BAA covering that product, is the configuration aligned with the Security Rule, am I sure my workforce is in the BAA-covered tenancy, and what happens when they aren't? Get those right and Claude is a useful tool inside a HIPAA program. Skip any one of them and you are running on luck.

Sources and primary references

Reviewed October 1, 2026. Regulations are cited to the eCFR. Vendor statements are cited to the vendor's own documentation as it read on that date; vendors revise these pages, so confirm before relying on them.

• 45 CFR 160.103, definition of business associate — who counts as a business associate, including subcontractors.
• 45 CFR 164.502(e), disclosures to business associates — satisfactory assurance, documented in a written contract.
• 45 CFR 164.504(e), business associate contracts — what the contract must contain.
• 45 CFR 164.312, technical safeguards — access control, audit controls, integrity, authentication, transmission security.
• 45 CFR 164.316, documentation — written policies and six-year retention.
• 45 CFR 164.514, de-identification — Safe Harbor and Expert Determination.
• 45 CFR 164.402 to 164.410, breach notification — the presumption of breach, the four-factor assessment, and notification deadlines.
• 45 CFR 160.402(c), agency liability — liability for workforce members and business associates acting within the scope of agency.
• Wolters Kluwer Health survey press release, January 22, 2026 — 518 healthcare professionals, fielded December 2025.
• Anthropic, Business Associate Agreements for commercial customers — HIPAA-ready services, feature-by-feature coverage, Covered Models, version dates.
• Anthropic, Data retention practices for Covered Models — 30-day retention requirement, effective June 9, 2026.
• Anthropic, Zero data retention scope — which products ZDR applies to, and the BAA's relationship to it.
• Anthropic, Is my data used for model training? (consumer plans) — when consumer chats may be used to improve models.
• AWS, HIPAA Eligible Services Reference — Amazon Bedrock listed as eligible; AWS BAA required first.
• OpenAI, API data controls — training and retention comparison.
• OpenAI, HIPAA configuration guide (Codex) — ChatGPT Enterprise training statement.

Related HIPAA guides

• Is ChatGPT HIPAA Compliant?
• Is Gemini HIPAA Compliant?
• Is Microsoft Copilot HIPAA Compliant?
• Is GitHub Copilot HIPAA Compliant?
• Is Perplexity AI HIPAA Compliant?
• HIPAA-Compliant AI: A Complete Checklist for 2026