If a researcher wants to paste patient data, clinical notes, or any protected health information (PHI) into ChatGPT or an API-based AI tool, a signed Business Associate Agreement (BAA) has to exist first. Under HIPAA, any vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity or another business associate is itself a “business associate,” and the covered entity is legally required to have a BAA in place before PHI is sent through that vendor’s system — see HHS’s own HIPAA Privacy Rule guidance. Most consumer and general-business AI products are not covered by a BAA by default, which is why this is a procedural question research offices run into constantly: which product tier actually qualifies, how do you request one, and what is excluded even once it is signed.
Quick answer: does OpenAI offer a BAA?
Yes, but not for every OpenAI product, and not automatically. As of this page’s last verification, OpenAI’s own Help Center draws a firm line between the API platform and ChatGPT:
| Product | BAA available? | How to get one |
|---|---|---|
| OpenAI API platform | Yes | Email [email protected] with company and use-case details; no enterprise agreement required |
| ChatGPT Enterprise / ChatGPT Edu | Yes, sales-managed accounts only | Contact OpenAI sales; self-serve sign-ups are not eligible |
| ChatGPT Business | No | Not offered on this tier at all |
| ChatGPT for Clinicians | Yes, for eligible individual clinicians | Separate in-product BAA flow, not the general sales process |
| ChatGPT Free / Plus / Team | No | Do not route PHI through these tiers |
Source: OpenAI Help Center, “How can I get a Business Associate Agreement (BAA) with OpenAI for the API Services?” (help.openai.com), retrieved and verified 2026-08-16. Confirm current tier eligibility directly with OpenAI before relying on this table for a live procurement decision — vendor product tiers and BAA policies change.
How the OpenAI API BAA request actually works
This is a procedural, case-by-case review, not an automatic checkbox:
- Email [email protected] with details about your organization and intended use case. OpenAI states a response within 1-2 business days.
- OpenAI reviews the request case-by-case and may ask for additional information about how PHI will be used. Per OpenAI, the process is usually completed within a few business days once the request is submitted.
- Approval is not guaranteed. OpenAI states it approves most requesting customers but that some use cases do not pass internal evaluation. If a request is not initially approved, reconsideration is only available to organizations working with an OpenAI sales team member — there is no general appeals path outside the sales relationship.
- No enterprise agreement is required to sign a BAA for the API platform specifically — this is a narrower commitment than what ChatGPT Enterprise requires.
For ChatGPT Enterprise or ChatGPT Edu, the path is different: a BAA is only available to customers with a sales-managed account, reached by contacting OpenAI sales directly. There is no self-serve BAA request for ChatGPT the way there is for the API.
What a BAA covers — and what it does not
A BAA is a contract, not a certification, and signing one does not by itself make every use of a tool compliant. Two things a research office should confirm before assuming coverage:
- Not every API service is automatically in scope. OpenAI’s own documentation states that most, but not all, API services are covered once a BAA is signed — certain tools that call out to third-party services (for example, some retrieval/search-connected features) can fall outside the agreement’s scope. Confirm the exact list of covered services with OpenAI directly for your account, since this changes as new API products ship.
- A BAA does not authorize collecting PHI you were not otherwise permitted to collect. It governs how a vendor may handle PHI you are already authorized to hold under the Common Rule, your IRB protocol, and any separate HIPAA authorization or waiver covering the underlying research. A signed BAA with an AI vendor is a downstream data-handling control, not a substitute for IRB approval or a participant authorization.
- It does not automatically cover every model or feature inside a product family. The OpenAI table above shows this directly: a BAA with the API platform says nothing about ChatGPT Team, and a ChatGPT Enterprise BAA says nothing about the API. Each product line has to be assessed and contracted separately.
- It is one piece of a larger data-governance picture. Institutions that route research data to external systems generally also rely on data use/transfer agreements for the underlying dataset — see CASRAI’s entry on the FDP Data Transfer and Use Agreement (DTUA) — and, for identifiable health data specifically, on de-identification as an alternative that removes data from HIPAA’s scope entirely rather than relying on a BAA.
Before a research office signs anything: a short checklist
- Confirm the specific product and tier the researcher intends to use — “OpenAI” is not one product for BAA purposes; the API, ChatGPT Enterprise/Edu, ChatGPT Business, and ChatGPT for Clinicians are governed by different rules, per the table above.
- Confirm your institution, not an individual lab or PI, is the contracting party. A BAA executed by an individual researcher rarely satisfies institutional compliance office requirements, and most vendors expect an authorized institutional signatory.
- Check whether the underlying data collection is already covered by an IRB-approved protocol and a valid informed consent or HIPAA authorization — a vendor BAA is necessary but not sufficient on its own.
- Ask the vendor directly, in writing, which specific product features/tools are excluded from the BAA’s scope (for example, connectors, plugins, or retrieval features that route data through a third party), since exclusions are common and change over time.
- Confirm data retention and training-use settings separately from the BAA itself — a BAA establishes a legal relationship, but retention windows and whether inputs are used to train models are typically controlled by separate product settings (such as an enterprise/API “zero data retention” or “do not train” configuration) that your compliance office should verify are actually enabled for the account in use.
- Document the BAA alongside your other institutional agreements the same way you would a Clinical Trial Agreement or data use agreement — it should be retrievable by your compliance office, not held only in an individual researcher’s inbox.
What about other AI vendors?
OpenAI is not the only vendor research institutions ask this question about. Major cloud and AI providers — including Microsoft (through Azure-hosted AI services), Google Cloud, and Anthropic — generally offer BAAs as part of their enterprise/cloud compliance programs for customers handling regulated health data, consistent with how each already offers BAAs for their broader cloud platforms. The pattern that holds across nearly all of them mirrors OpenAI’s: BAA availability is usually restricted to specific enterprise or business tiers rather than free or self-serve consumer plans, and the request has to go through a sales or compliance contact rather than a self-serve toggle. Because exact eligibility, covered services, and request processes change frequently and are not something CASRAI can independently verify for every vendor on an ongoing basis, confirm current terms directly with each vendor’s compliance or sales team before contracting, and treat the OpenAI process above as the level of procedural detail to expect from any of them.
Frequently asked questions
What is a Business Associate Agreement (BAA)?
A BAA is a contract required under the HIPAA Privacy and Security Rules between a covered entity (or another business associate) and any vendor that creates, receives, maintains, or transmits protected health information on its behalf. It obligates the vendor to safeguard PHI and sets out permitted uses, required security controls, and breach-notification obligations.
Can I use ChatGPT with patient data if my institution has a BAA with OpenAI?
Only if the BAA actually covers the specific product tier you are using. A BAA covering the OpenAI API platform does not extend to ChatGPT Team or ChatGPT Business, and a BAA covering ChatGPT Enterprise or Edu does not extend to the API. Confirm which product your BAA names before assuming coverage.
Does every AI vendor require a separate BAA?
Generally yes. A BAA is specific to the vendor (and often the specific product/tier), so a BAA with one AI provider does not extend to another vendor’s tools, even if both are used for the same research project.
Does signing a BAA mean the AI tool is automatically HIPAA compliant?
No. A BAA is a required contractual control, but HIPAA compliance also depends on how the tool is configured and used — access controls, retention settings, minimum-necessary data practices, and whether the underlying data collection itself was authorized under the Common Rule and a valid consent or HIPAA authorization.
Last verified 2026-08-16 against OpenAI’s own Help Center documentation. Vendor BAA policies, covered-services lists, and product tiers change; confirm current terms directly with the vendor before relying on this page for a live procurement or compliance decision.
