Is ChatGPT HIPAA compliant?
No. Consumer ChatGPT is not HIPAA compliant, because OpenAI will not sign a Business Associate Agreement for it. Entering protected health information into it is a disclosure to a party with no BAA — impermissible under the Privacy Rule, regardless of how careful the staff member was.
Why the BAA is the whole question
HIPAA doesn't ban new technology; it governs disclosure. Any vendor that processes PHI on your behalf is a business associate and must sign a BAA. Consumer ChatGPT, Gemini and Claude are offered without one. That single fact settles it before any discussion of encryption or model quality.
Does the enterprise tier fix it?
Partly. Some enterprise and API tiers are BAA-eligible, which makes the disclosure permissible. It does not make the data local: PHI still leaves your building, retention is still the vendor's configuration, and your audit trail is still their console. That may be acceptable to your risk assessment — it is a smaller question than whether it is allowed.
What OCR has actually penalized
The 2025 enforcement wave ran from $25,000 to $3 million, and much of it targeted missing or stale risk analyses rather than headline breaches. Undocumented AI use is exactly the kind of gap that shows up in a risk-analysis review.
The on-premise answer
If inference happens on a server in your own building, there is no third party and therefore no BAA to obtain. PHI is read on hardware you own, under your encryption, access control and logging. The compliance conversation shifts from “who else has our data” to “here is our control narrative”.
Three ways to deploy, side by side
| The question | Consumer cloud AI | BAA / enterprise cloud | Handistack on-prem |
|---|---|---|---|
| Where client data goes | Bad: The vendor's cloud | Qualified: The vendor's cloud, contract-bound | Good: Stays on hardware you own |
| Trained on your content | Bad: Yes, unless you opt out | Qualified: No — by contract | Good: Never. No upstream to train |
| Retention of prompts & files | Bad: Vendor policy, human review possible | Qualified: Configurable, vendor-controlled | Good: Your policy, your disks |
| BAA / DPA in place | Bad: Not available | Good: Available | Good: Not needed — no third party |
| Audit trail you control | Bad: None | Qualified: Vendor console | Good: Your log store and SIEM |
| Cost shape | Qualified: $20–30 per seat / mo | Bad: $60+ per seat / mo | Good: One-time build, one flat retainer |
| Works with the internet down | Bad: No | Bad: No | Good: Yes |
You hold PHI, and there is no BAA standing behind a consumer chatbot.
We build, install and maintain the private system that makes this a non-question — inside your building, owned by you, with the control documentation for your file.