# HIPAA compliant AI, by provider

No AI provider is “HIPAA certified”, because the US health department approves no such certification. What a provider can do is sign a business associate agreement (BAA) for a specific plan. As of November 10, 2026, OpenAI and Anthropic sign one for their APIs, Google for Gemini on Google Cloud and in Workspace, and none of the three names one for its free or personal chat plans. The tables also have each provider’s answer on training, retention, SOC 2, and single sign-on, with the page we read it on.

## ChatGPT, Claude, Gemini, and Copilot with patient data

### Is ChatGPT HIPAA compliant?

Not on a standard ChatGPT plan, going by OpenAI’s own page. OpenAI’s enterprise privacy page names two places for health data: the API, where it signs a BAA on request, and ChatGPT for Healthcare, a separate workspace “designed to support HIPAA compliance”. It names no BAA for ChatGPT Free, Plus, Pro, Business, or Enterprise. OpenAI’s help article on BAAs didn’t load for us, so ask OpenAI about Enterprise.

Source: [OpenAI: enterprise privacy](https://openai.com/enterprise-privacy/)

### Is Claude HIPAA compliant?

Only on Enterprise plans and the API, after setup. Anthropic signs a BAA for its API, for Claude in Microsoft Foundry, and for Claude Enterprise plans. On Enterprise, the organization’s primary owner has to turn on the HIPAA-ready configuration and accept the BAA; a standard Enterprise plan is not covered until then. Free, Pro, Max, and Team plans are not covered, and some features stay outside the BAA.

Source: [Anthropic: business associate agreements](https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers)

### Is Gemini HIPAA compliant?

Only through Google Workspace or Google Cloud, under Google’s BAA. Google’s BAA lists the Gemini app and Gemini in Google Workspace for Workspace accounts, and Gemini on Google Cloud. An administrator has to accept the BAA first. A personal Google account is not a Workspace account, and the list does not name the Gemini Developer API.

Source: [Google Cloud and Workspace: HIPAA](https://cloud.google.com/security/compliance/hipaa), [Google Workspace: HIPAA compliance](https://support.google.com/a/answer/3407054)

### Is Microsoft Copilot HIPAA compliant?

Microsoft 365 Copilot at work, under Microsoft’s BAA. Microsoft lists HIPAA among the compliance offerings for Microsoft 365 Copilot, the version a company buys with Microsoft 365, and offers its BAA through the Microsoft Product Terms. The page does not cover the free Copilot app on a personal account.

Source: [Microsoft: data, privacy, and security for Microsoft 365 Copilot](https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy), [Azure compliance: HIPAA](https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-hipaa-us)

## Each provider’s answers at a glance

| Provider | Trains on your inputs? | Inputs kept | SOC 2 report | HIPAA | Single sign-on |
|---|---|---|---|---|---|
| OpenAI (OpenAI API, ChatGPT Business, and ChatGPT Enterprise) | No, by default | 30 days; state until deleted | Type 2 | BAA on request, API | Business, Enterprise, Edu |
| Anthropic (Claude API, Claude Team, and Claude Enterprise) | No, by default | 30 days, with exceptions | Type II | BAA: API and Enterprise | Team and Enterprise |
| Google (Gemini API, Gemini on Google Cloud, and Gemini in Google Workspace) | Not on paid plans | No number given | Type II | BAA: Cloud and Workspace | Through Workspace |
| xAI (xAI API (Grok)) | No | 30 days; zero optional | Type 2 | BAA by inquiry | Not stated |
| Mistral (Mistral API and Vibe) | Depends on the plan | Zero on request | On request | Not stated | Not stated |
| Alibaba (Alibaba Cloud Model Studio (Qwen)) | No | No period given | Yes | Not stated | Not stated |
| Moonshot AI (Kimi API) | No | No period given | Not stated | Not stated | Not stated |
| Microsoft Foundry (Azure) (Models sold by Azure, including OpenAI, xAI, Meta, Mistral, and DeepSeek models) | No | Flagged prompts may be kept | Type 2 | BAA, in-scope services | Microsoft Entra ID |
| Amazon Bedrock (Models from Anthropic, OpenAI, Meta, Mistral, xAI, DeepSeek, Moonshot AI, Qwen, Z.AI, and others) | No | No period given | In audit scope | Eligible, with a BAA | IAM Identity Center |

“Not stated” means the pages we read don’t say. It doesn’t mean the provider lacks it.

## The full answers, with sources

### OpenAI

Covers: OpenAI API, ChatGPT Business, and ChatGPT Enterprise.

- Trains on your inputs? No, by default. Business data from the API, ChatGPT Business, and ChatGPT Enterprise is not used for training unless you opt in. ([OpenAI: enterprise privacy](https://openai.com/enterprise-privacy/))
- How long inputs are kept Most API inputs and outputs are kept up to 30 days for abuse monitoring. Endpoints that store state, such as conversations, threads, and vector stores, keep it until you delete it. Zero data retention is on request, for eligible endpoints. On ChatGPT Business and Enterprise your admins set the period. ([OpenAI: enterprise privacy](https://openai.com/enterprise-privacy/), [OpenAI platform: data controls](https://developers.openai.com/api/docs/guides/your-data))
- SOC 2 report SOC 2 Type 2 for the API, ChatGPT Business, and ChatGPT Enterprise. ([OpenAI: enterprise privacy](https://openai.com/enterprise-privacy/))
- HIPAA: signs a BAA? OpenAI signs a BAA for the API on request and sells ChatGPT for Healthcare, a workspace built for HIPAA work. Its page names no BAA for the other ChatGPT plans, so ask OpenAI before you put patient data in one. ([OpenAI: enterprise privacy](https://openai.com/enterprise-privacy/))
- Single sign-on SAML single sign-on for ChatGPT Business, Enterprise, and Edu workspaces, and for eligible API organizations. ([OpenAI: enterprise privacy](https://openai.com/enterprise-privacy/), [OpenAI: single sign-on setup](https://help.openai.com/en/articles/9534785-configuring-sso-for-chatgpt))
- Also sold on Microsoft Foundry (Azure), Amazon Bedrock, and Google Cloud (preview). ([Microsoft Foundry: models sold by Azure](https://learn.microsoft.com/en-us/azure/ai-foundry/foundry-models/concepts/models-sold-directly-by-azure), [Amazon Bedrock: models at a glance](https://docs.aws.amazon.com/bedrock/latest/userguide/model-cards.html), [Google Cloud: partner models](https://cloud.google.com/vertex-ai/generative-ai/docs/partner-models/use-partner-models))

### Anthropic

Covers: Claude API, Claude Team, and Claude Enterprise.

- Trains on your inputs? No, by default, for the API and Claude for Work. A chat you rate with the thumbs buttons can be used. ([Anthropic: is my data used for model training?](https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training))
- How long inputs are kept API inputs and outputs are deleted within 30 days, except what you keep in a feature such as the Files API and what Anthropic holds longer to enforce its usage policy or meet the law. Zero data retention is by agreement. Team and Enterprise chats stay until you delete them, then leave back-end storage within 30 days. ([Anthropic: how long do you store my organization’s data?](https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data))
- SOC 2 report SOC 2 Type I and Type II, with ISO 27001 and ISO 42001. ([Anthropic: certifications](https://privacy.claude.com/en/articles/10015870-what-certifications-has-anthropic-obtained))
- HIPAA: signs a BAA? A BAA covers the API, Claude in Microsoft Foundry, and Enterprise plans once an owner turns on the HIPAA-ready configuration. Not every feature is covered, and Free, Pro, Max, and Team are not. ([Anthropic: business associate agreements](https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers))
- Single sign-on Team plans, Enterprise plans, and Console organizations. ([Claude: set up single sign-on](https://support.claude.com/en/articles/13132885-setting-up-single-sign-on-sso))
- Also sold on Microsoft Foundry (Azure), Amazon Bedrock, and Google Cloud. ([Microsoft Foundry: models from partners](https://learn.microsoft.com/en-us/azure/ai-foundry/foundry-models/concepts/models-from-partners), [Amazon Bedrock: models at a glance](https://docs.aws.amazon.com/bedrock/latest/userguide/model-cards.html), [Google Cloud: partner models](https://cloud.google.com/vertex-ai/generative-ai/docs/partner-models/use-partner-models))

### Google

Covers: Gemini API, Gemini on Google Cloud, and Gemini in Google Workspace.

- Trains on your inputs? Not on the paid Gemini API or on Google Cloud. On the free Gemini API tier and AI Studio, yes, and human reviewers may read it. ([Gemini API additional terms](https://ai.google.dev/gemini-api/terms), [Google Cloud: generative AI and zero data retention](https://cloud.google.com/vertex-ai/generative-ai/docs/data-governance))
- How long inputs are kept The paid Gemini API logs prompts “for a limited period” to detect abuse and gives no number. Google sends workloads that need guaranteed zero retention to Google Cloud, where it takes specific settings. ([Gemini API additional terms](https://ai.google.dev/gemini-api/terms), [Gemini API: zero data retention](https://ai.google.dev/gemini-api/docs/zdr), [Google Cloud: generative AI and zero data retention](https://cloud.google.com/vertex-ai/generative-ai/docs/data-governance))
- SOC 2 report SOC 2 Type II reports for Google Cloud and Google Workspace, issued every quarter. ([Google Cloud: SOC 2](https://cloud.google.com/security/compliance/soc-2))
- HIPAA: signs a BAA? Google’s BAA lists Gemini on Google Cloud, Gemini Enterprise, and the Gemini app and Gemini in Workspace for Workspace accounts. The list does not name the Gemini Developer API. ([Google Cloud and Workspace: HIPAA](https://cloud.google.com/security/compliance/hipaa))
- Single sign-on Through Google Workspace or Cloud Identity, which take a SAML identity provider. ([Google Workspace: setting up SSO](https://support.google.com/a/answer/12032922))
- Also sold on Google Cloud only. Amazon Bedrock lists Google’s open Gemma models, not Gemini. ([Amazon Bedrock: models at a glance](https://docs.aws.amazon.com/bedrock/latest/userguide/model-cards.html))

### xAI

Covers: xAI API (Grok).

- Trains on your inputs? No. xAI says it never trains on API inputs or outputs without your explicit permission. ([xAI docs: API security FAQ](https://docs.x.ai/developers/faq/security))
- How long inputs are kept Requests and responses are kept 30 days for abuse audits, then deleted. Uploaded files and conversations you ask xAI to store stay on its servers for the features that use them. A team admin can turn on zero data retention, which switches those features off. ([xAI docs: API security FAQ](https://docs.x.ai/developers/faq/security))
- SOC 2 report SOC 2 Type 2. The report sits in a trust center that asks for a signed NDA. ([xAI docs: API security FAQ](https://docs.x.ai/developers/faq/security))
- HIPAA: signs a BAA? By inquiry: xAI asks you to fill in a BAA questionnaire and replies with next steps. ([xAI docs: API security FAQ](https://docs.x.ai/developers/faq/security))
- Single sign-on Not stated on the pages we read.
- Also sold on Microsoft Foundry (Azure), Amazon Bedrock, and Google Cloud. ([Microsoft Foundry: models sold by Azure](https://learn.microsoft.com/en-us/azure/ai-foundry/foundry-models/concepts/models-sold-directly-by-azure), [Amazon Bedrock: models at a glance](https://docs.aws.amazon.com/bedrock/latest/userguide/model-cards.html), [Google Cloud: partner models](https://cloud.google.com/vertex-ai/generative-ai/docs/partner-models/use-partner-models))

### Mistral

Covers: Mistral API and Vibe.

- Trains on your inputs? It depends on the plan. On the free API tier, inputs and outputs may be used for training unless you opt out. Pay-as-you-go customers can opt out at any time, and Vibe Enterprise is opted out by default. ([Mistral: do you use my data to train your models?](https://help.mistral.ai/en/articles/347617-do-you-use-my-user-data-to-train-your-artificial-intelligence-models))
- How long inputs are kept Zero data retention can be requested on paid plans, for stateless API calls. The pages we read give no default period. ([Mistral docs: zero data retention](https://docs.mistral.ai/admin/monitor-comply/zero-data-retention))
- SOC 2 report A SOC 2 report is available to clients on request. ([Mistral: how do you ensure the security of user data?](https://help.mistral.ai/en/articles/347624-how-do-you-ensure-the-security-of-user-data))
- HIPAA: signs a BAA? Not stated on the pages we read.
- Single sign-on Not stated on the pages we read.
- Also sold on Microsoft Foundry (Azure), Amazon Bedrock, and Google Cloud. ([Microsoft Foundry: models sold by Azure](https://learn.microsoft.com/en-us/azure/ai-foundry/foundry-models/concepts/models-sold-directly-by-azure), [Amazon Bedrock: models at a glance](https://docs.aws.amazon.com/bedrock/latest/userguide/model-cards.html), [Google Cloud: partner models](https://cloud.google.com/vertex-ai/generative-ai/docs/partner-models/use-partner-models))

### Alibaba

Covers: Alibaba Cloud Model Studio (Qwen).

- Trains on your inputs? No. Alibaba Cloud says it will never use your data for model training. ([Alibaba Cloud Model Studio: security certifications and privacy](https://www.alibabacloud.com/help/en/model-studio/privacy-notice))
- How long inputs are kept Model Studio stores data from model calls as the law requires. The page gives no period. ([Alibaba Cloud Model Studio: security certifications and privacy](https://www.alibabacloud.com/help/en/model-studio/privacy-notice))
- SOC 2 report SOC 2, with an unqualified opinion. ([Alibaba Cloud Model Studio: security certifications and privacy](https://www.alibabacloud.com/help/en/model-studio/privacy-notice))
- HIPAA: signs a BAA? Not stated on the pages we read.
- Single sign-on Not stated on the pages we read.
- Also sold on Open-weight Qwen models are listed on Microsoft Foundry (Azure) and Amazon Bedrock. ([Microsoft Foundry: models sold by Azure](https://learn.microsoft.com/en-us/azure/ai-foundry/foundry-models/concepts/models-sold-directly-by-azure), [Amazon Bedrock: models at a glance](https://docs.aws.amazon.com/bedrock/latest/userguide/model-cards.html))

### Moonshot AI

Covers: Kimi API.

- Trains on your inputs? No. Moonshot says API inputs and outputs are not used to train or improve Kimi models. ([Kimi help: API data security and privacy](https://www.kimi.com/en/help/kimi-api/api-data-security))
- How long inputs are kept The page says API data is not kept for training and gives no retention period. ([Kimi help: API data security and privacy](https://www.kimi.com/en/help/kimi-api/api-data-security))
- SOC 2 report Not stated on the pages we read.
- HIPAA: signs a BAA? Not stated on the pages we read.
- Single sign-on Not stated on the pages we read.
- Also sold on Amazon Bedrock. ([Amazon Bedrock: models at a glance](https://docs.aws.amazon.com/bedrock/latest/userguide/model-cards.html))

### Microsoft Foundry (Azure)

Covers: Models sold by Azure, including OpenAI, xAI, Meta, Mistral, and DeepSeek models.

- Trains on your inputs? No. Prompts and outputs are not available to OpenAI or other model makers, and are not used to train foundation models without your permission. ([Microsoft Foundry: data, privacy, and security for models sold by Azure](https://learn.microsoft.com/en-us/azure/ai-foundry/responsible-ai/openai/data-privacy))
- How long inputs are kept Flagged prompts can be sampled and stored for abuse review, with human review as needed. Approved customers can apply to have that storage and human review switched off. ([Microsoft Foundry: data, privacy, and security for models sold by Azure](https://learn.microsoft.com/en-us/azure/ai-foundry/responsible-ai/openai/data-privacy))
- SOC 2 report Azure publishes SOC 2 Type 2 reports. ([Azure compliance: SOC 2 Type 2](https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-soc-2))
- HIPAA: signs a BAA? Microsoft offers a HIPAA BAA through its Product Terms for in-scope Azure services. Check that the service you use is on the in-scope list. ([Azure compliance: HIPAA](https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-hipaa-us))
- Single sign-on Microsoft Entra ID. ([Microsoft Foundry: authentication and authorization](https://learn.microsoft.com/en-us/azure/ai-foundry/concepts/authentication-authorization-foundry))

### Amazon Bedrock

Covers: Models from Anthropic, OpenAI, Meta, Mistral, xAI, DeepSeek, Moonshot AI, Qwen, Z.AI, and others.

- Trains on your inputs? No. AWS says your data is not shared with model makers and is not used to improve the base models. ([Amazon Bedrock: security and privacy](https://aws.amazon.com/bedrock/security-compliance/))
- How long inputs are kept Model makers have no access to Bedrock logs or to your prompts and answers. The pages we read give no retention period. ([Amazon Bedrock: data protection](https://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html))
- SOC 2 report In scope for SOC and ISO audits. ([Amazon Bedrock: security and privacy](https://aws.amazon.com/bedrock/security-compliance/))
- HIPAA: signs a BAA? HIPAA eligible, under a BAA with AWS. ([Amazon Bedrock: security and privacy](https://aws.amazon.com/bedrock/security-compliance/))
- Single sign-on Federated sign-in through AWS IAM Identity Center or your own identity provider. ([Amazon Bedrock: identity and access management](https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam.html))

## Providers we couldn’t read

- Meta: We found no page that sets out business data terms for Meta’s Model API. Its models are also sold on Microsoft Foundry (Azure), Amazon Bedrock, and Google Cloud (preview), where that cloud’s terms apply.
- DeepSeek: DeepSeek’s policy pages did not load on the day we checked. Its models are also sold on Microsoft Foundry (Azure), Amazon Bedrock, and Google Cloud, where that cloud’s terms apply.
- Z.AI: Z.AI’s developer privacy policy does not say plainly whether API inputs are used for training. Its models are also sold on Amazon Bedrock and Google Cloud, where that cloud’s terms apply.

## What these answers don’t settle

- We read public pages, not contracts. Your signed agreement is what binds the provider, and it can differ from the page in either direction.
- Each row covers the plans named under the provider’s name. A personal chat plan has its own terms.
- We didn’t ask the providers anything. Where a cell says “Not stated”, a sales team may have an answer the website doesn’t.
- We last read every page on November 10, 2026, and we re-read them within 45 days.

## Then pick the model

Once you know which providers your company can approve, the job pages rank their models: [Legal documents or legal research](/best/for/legal), [Finance, accounting, and tax work](/best/for/finance), [Marketing copy and business content](/best/for/marketing), [Customer-support or service workflows](/best/for/support), [Analyze data and write SQL or Python](/best/for/data-analysis). Or describe your work in the [LLM Selector](/tools/llm-selector).

## Questions

### Is there a HIPAA certification for AI tools?

No. Microsoft’s HIPAA page says the US Department of Health and Human Services has approved no certification program for a company acting as a business associate. A provider can sign a business associate agreement and offer controls that support compliance. Whether your use complies also depends on how you set up and use the service.

### Does a BAA make my use of AI HIPAA compliant?

Not by itself. A BAA is the contract that lets a provider handle patient information for you. Anthropic’s page, for example, says some features stay outside its BAA and that an Enterprise owner has to turn on a HIPAA-ready configuration first. Check which plan, features, and settings your agreement covers.

### Which AI providers don’t train on business data by default?

On November 10, 2026, OpenAI, Anthropic, xAI, Alibaba, and Moonshot AI each said they don’t train on API or business-plan inputs by default. Google says the same for its paid Gemini API and Google Cloud, but not for the free tier. Mistral’s answer depends on the plan, so check which one you’re on.

### Does Claude train on your data?

Not by default on the API or Claude for Work, according to Anthropic’s privacy pages on November 10, 2026. The exception it names is a chat you rate with the thumbs buttons, which can be used. Personal Free, Pro, and Max plans come under separate consumer terms that this page doesn’t cover.

### What does a SOC 2 Type 2 report tell me?

It’s an independent auditor’s opinion on how a company’s security controls worked over a period, usually several months. A Type 1 report covers their design on one date. Neither says anything about model quality, or about whether the provider trains on your inputs, so read it alongside the other columns.

Last updated: November 10, 2026

Canonical page: https://benchlm.ai/hipaa-compliant-ai