Yes, if PHI reaches the AI provider. You need a BAA for the exact product, and many ChatGPT plans have none. A BAA permits PHI. It does not reduce it.
SOC 2 Type II · ISO 27001 · HIPAA, BAA available
One prior-authorization request
Summarize the denial for Grace Whitfield, MRN 4471-209-88, born 03/14/1949, member ID W88213004, and draft an appeal.
BAA only: the provider receives
PermittedAllowed under contract. Stored under the provider’s retention terms.
BAA plus Protecto: the provider receives
TokensReal values stay with you. The answer shows them only to allowed roles.
Under HIPAA, an AI provider that creates, receives, keeps or sends PHI for you is a business associate. You need a business associate agreement (BAA) with it before any PHI goes in.
That holds for chat apps and APIs, even if names are removed and other identifiers remain, and even if the provider promises not to train on your data.
In ChatGPT, only the enterprise version offers a BAA. Free, Plus, Pro and Business do not. APIs often do, with conditions and excluded features.
HHS says a provider that receives only properly de-identified data is not a business associate. Removing names alone rarely meets that bar.
HIPAA’s minimum necessary rule still applies, and every identifier you send sits in the provider’s systems.
Protecto replaces identifiers with tokens before text reaches the model and keeps the mapping in your environment, so the provider holds far fewer identifiers. Tokens can still be PHI, so many teams keep the BAA and let counsel decide.
Inovalon built a secure, HIPAA-compliant analytics product on sensitive healthcare data with Protecto
Documents Inovalon tested in under a week
Entity types across PII, PHI and PCI, plus custom entities such as your member ID format
Than AWS Comprehend and Microsoft Presidio in the independent UT Dallas / DataXpert benchmark
Most BAA gaps start with a plan that sounds right for business use.
A utilization review team buys ChatGPT Business seats. It is a paid business plan, so the team assumes it is approved for patient data. Nurses paste prior-authorization letters into it: patient name, date of birth, member ID, diagnosis. OpenAI does not offer a BAA for ChatGPT Business. Every letter is PHI sent to a provider with no BAA.
Compliance moves the team to ChatGPT Enterprise, which OpenAI signs a BAA for. The disclosure is now permitted. But every name and member ID still goes to the provider and sits in its systems under its retention terms. And a feature someone turns on, or a plugin that calls another service, may fall outside that BAA.
That is the business associate question in practice: who receives PHI, under which contract, and how much of it.
ChatGPT Business seats
Nurses paste prior-authorization letters with names, dates of birth and member IDs.
ChatGPT Enterprise, BAA signed
The same letters, now on a plan OpenAI signs a BAA for.
Enterprise with BAA, Protecto in the path
Identifiers become tokens such as <PERSON>Lm4Tq8</PERSON> before the letter reaches the model.
A BAA decides whether the disclosure is permitted. Tokens decide how much of it there is.
HIPAA calls a vendor that creates, receives, maintains or transmits PHI for a covered entity a business associate, and requires a written agreement first (45 CFR 160.103, 164.502(e), 164.504(e)). HHS’s cloud computing guidance applies this to cloud services directly.
Not legal advice. Summarized from 45 CFR Parts 160 and 164 and HHS guidance on HIPAA and cloud computing.
A BAA is a contract about who may hold PHI and what they must do with it. It says nothing about how much PHI you send.
A provider can sign a BAA and still exclude the feature your team uses. Check the product, the feature and the setting, not the logo.
| Provider | Products with a BAA path | No BAA | Check before PHI |
|---|---|---|---|
| OpenAI (ChatGPT) | Enterprise versions only: ChatGPT Enterprise, including ChatGPT for Healthcare, through OpenAI sales | ChatGPT Free, Plus, Pro and Business | Covered features in the enterprise workspace |
| OpenAI (API) | API with a signed BAA and Modified Retention, self-serve for eligible organizations | API without Modified Retention | Covered endpoints and features |
| Microsoft | Azure OpenAI in Azure AI Foundry, under the HIPAA BAA in Microsoft’s Product Terms | Partner and community models are not individually listed | Deployment type, model source, input types such as images |
| Gemini on Google Cloud’s Gemini Enterprise Agent Platform under the Google Cloud BAA. The Gemini app and Gemini in Workspace, on work accounts, under the Workspace BAA | Gemini on personal Google accounts, Google AI Studio | Named covered products, admin settings | |
| Anthropic | Claude API for a HIPAA-enabled organization with a signed BAA | Consumer Claude plans, Claude Code, features outside the eligibility table | API features. Some, such as Batch API and Files API, are excluded |
| AWS | Amazon Bedrock under the AWS BAA, per the HIPAA eligible services list | Features and models not on the eligible list | Region, model, feature |
Based on each vendor’s public documentation, November 2026. Terms change often. Confirm with the vendor before sending PHI.
Protecto sits between your staff or apps and the model. Identifiers become tokens before the provider sees them.
Protecto finds identifiers in prompts, files and retrieved records, including those written inside clinical sentences. 50+ entity types, plus custom entities such as your member ID format.
Each identifier becomes a consistent token. The same patient gets the same token every time, so the model can still follow one person. Clinical facts your policy leaves readable stay in the text.
The token mapping stays in your environment. The provider, its logs and chat history hold tokens.
Real values return in the answer only for roles your policy allows. Every detection, mask and reveal is logged for your auditors.
Staff who need a chat assistant can use the Protecto AI Privacy Gateway with the model you choose. Apps call Protecto through its API. Tokens can still be PHI, so many teams keep the BAA. Your counsel decides.
Only the enterprise version. As of November 2026, OpenAI offers a BAA for ChatGPT Enterprise, including ChatGPT for Healthcare, and for its API with Modified Retention. ChatGPT Free, Plus, Pro and Business have no BAA, so PHI should not go into them.
No product does that on its own. ChatGPT Enterprise can be used with PHI when OpenAI signs a BAA for your workspace and you use covered features. Your organization still needs its own risk analysis, access controls and policies.
Usually yes. Removing names leaves dates, record numbers, places and context that can still identify a patient. You need no BAA only if the data is de-identified under HIPAA’s Safe Harbor or Expert Determination method.
It depends, and your counsel decides. Tokens can still be PHI when a mapping links them back to patients, and HHS treats providers holding unreadable PHI as business associates. Many teams keep the BAA and tokenize so far fewer identifiers reach the provider.
No. Providers list which products, endpoints and features are covered. Features outside that list, such as some beta tools or plugins that call other services, may fall outside the BAA even on an eligible plan.
That depends on who runs it. When Protecto hosts or manages the service, or can access your instance for support, upgrades or monitoring, Protecto is a business associate and signs a BAA before any PHI flows. When Protecto runs in your environment with no Protecto access, Protecto does not receive PHI and is not a business associate.
Bring a sample of prior-authorization letters or clinical notes. We will show what reaches the model, what stays with you and what the log records.
