Is ChatGPT HIPAA Compliant for Client Notes?

Then take the same row to decide what you may type into that tier, and where the note goes instead.

Product rows follow OpenAI’s HIPAA Implementation and Configuration Guide posted July 9, 2026, read September 25, 2026, and the companion Enterprise and Edu configuration guide, also posted July 9, 2026 and read the same day. De-identification rows follow 45 CFR 164.514. Terms can change after that read. Open the guide again before you send client information. Ask your counsel before you treat a row as a signing decision.

Is ChatGPT HIPAA compliant for the account open on your laptop right now? Match the row to that account, not to the logo on the login screen. A colleague’s Enterprise seat is not your Plus login. A wrapper that “uses ChatGPT” is not the product named in your BAA.

Start with the account you pay for

You are between sessions. The note is half written. A chat window is already open because the goal line sounds stiff and the next client is in twelve minutes. That is the moment the tier matters. The question is not whether AI can phrase a goal. The question is whether this account may receive identifiable client information.

OpenAI’s HIPAA Guide, posted July 9, 2026, says: “If you do not have a BAA with OpenAI, you may not use the Services with Protected Health Information.” The ChatGPT section then says that if you are not using an Eligible Service, you may not upload, transmit, or process PHI with ChatGPT. For clarity, it lists “ChatGPT services for consumers (e.g., Free, Plus, Pro) and ChatGPT Business” as not Eligible Services.

Read that as three different stops, not one slogan.

If you have no BAA, stop. Payment status does not matter. If you are on Free, Plus, or Pro, stop, even if someone at the group practice has a different OpenAI agreement. If the invoice says Business, stop. The guide names Business on its own, apart from the consumer examples. Is ChatGPT HIPAA compliant on Business? The July 9, 2026 guide says no. A business workspace, single sign-on, or a statement that business data is not used for training is not the Eligible Service test in that sentence.

If the invoice says Team, do not map it yourself. The July 9, 2026 guide names ChatGPT Business, not a product called Team. Ask whoever holds the contract to name the current product in writing and to show you the BAA exhibit. Until that writing matches a row above, keep the note out.

HIPAA compliant AI tools are not a category you can buy from a badge. You buy a named service, on a named plan, with a BAA that lists that service. A ChatGPT HIPAA line on a sales page is not that list.

What a signed BAA actually covers

Eligible ChatGPT use, in the July 9, 2026 guide that covers healthcare products, applies only if your BAA includes “ChatGPT for Healthcare, ChatGPT for Clinicians, ChatGPT Enterprise / Education with the Regulated Workspace, or any other ChatGPT service identified as an Eligible Service in the BAA.”

That sentence does two jobs. It names products. It also refuses a blanket yes. “Any other ChatGPT service” counts only when the BAA identifies it. Your wish that Enterprise “should” be covered is not an identification.

Is ChatGPT HIPAA compliant for the product named in that exhibit, or only for a product you have not bought? Open the exhibit. If ChatGPT for Healthcare is the product you were sold, the exhibit has to say so. If you were sold ChatGPT for Clinicians, a Plus seat you use because you are a clinician is a different row. If you were sold Enterprise, look for the Regulated Workspace, not only the word Enterprise.

A second guide, also posted July 9, 2026, says it does not apply if you are using ChatGPT for Healthcare or ChatGPT Enterprise or Edu with the Regulated Workspace. That second guide is the one to read when you are on Enterprise or Edu and you are not on those healthcare configurations. It says you may not upload, transmit, or process PHI with ChatGPT Enterprise and Edu Services unless the BAA expressly specifies that those services are Eligible Services. Consumer services and ChatGPT Business are still not Eligible Services in that guide.

So Enterprise is not “yes by default,” and it is not “never.” It is yes only in the writing, and the configuration guide you follow depends on whether you are in the Regulated Workspace path or the other Enterprise or Edu path.

On the Regulated Workspace path, the guide says early-access features “do not support HIPAA compliance and should not be used with PHI.” It also says you may not include PHI in user profile data (name and email address), the workspace name and image, or support tickets and other support requests. You may not create end-user accounts on the OpenAI services for patients, plan members, or their families or employer. You may not use the Eligible Services to maintain PHI as part of a designated record set.

That last limit is the one clinicians skip. A chat that helped you word a goal is not the chart. The guide puts the designated-record-set bar on eligible services, not only on the free tier. You still write and sign the note in the record system your practice uses.

On the Enterprise or Edu path that is not the Regulated Workspace, the second guide adds shutoffs. It says Codex, Memories, and Search Agent mode have not been evaluated for HIPAA compliance and may not be used with PHI. It says web browsing in Search and Deep Research may involve transmitting information to third-party search providers and may not be used with PHI. Apps and connectors, canvas code network access, code on macOS, and third-party GPTs can send information outside a HIPAA-enabled service. The guide says you are solely liable for a HIPAA breach that comes from failing to disable those features. It also bars PHI in file names and in GPT name, image, description, instructions, conversation starters, and uploaded files, in addition to profile data, workspace name and image, and support tickets.

If you cannot find the toggle, you do not have a configuration you can defend. Turn the feature off, or keep PHI out. Do not guess that a default is safe because the sales call said the workspace was “HIPAA-ready.”

The API is a separate applicability test. The guide says that if your BAA does not expressly specify OpenAI API Services as Eligible Services, you may not upload, transmit, or process PHI with the API. Use of the API in connection with the BAA currently requires the account to be provisioned for Modified Retention. Modified Retention has to show as activated for the Org ID and Project in the Account Console. A key in a personal project, or a second Org ID you added later without that activation, is not the covered path. The guide tells you to send HIPAA Input only through Org IDs and Projects that have Modified Retention active.

An API key is a different row. Is ChatGPT HIPAA compliant will not answer whether that Org ID may receive PHI. Codex Cloud is simpler. The guide says it is not an Eligible Service and is not covered by the BAA, and that you may not upload, transmit, or process PHI using Codex Cloud. A local coding tool is not a place for a transcript export.

The guide also says its own text “does not constitute legal advice and adhering to this guidance does not ensure compliance or alignment with your specific HIPAA obligations.” Take that sentence to your counsel with the exhibit, not to a group chat as a green light.

What stays out of the prompt

Use the same stop list when you are tempted to “just remove the name.” Session date, clinic city, age over 89, phone, email, medical record number, insurance number, account number, device identifier, photo, and voice are on the Safe Harbor list. So is any other unique identifying number, characteristic, or code. A rare detail plus a small town can fail 164.514(b)(2)(ii) even after the name is gone. If you know the recipient could identify the person, you still have identifiable information.

On an eligible configuration, add the guide’s own prohibited fields to that list: the name and email on the user profile, the workspace name and image, and anything you would put in a support ticket or a screenshot attached to support. On the non-regulated Enterprise or Edu path, add file names and the GPT instruction fields. Do not upload the note as a file and call it de-identified because the filename says “redacted.”

De-identify only when the tier still cannot take the note

45 CFR 164.514(a) says health information that does not identify an individual, and with respect to which there is no reasonable basis to believe the information can be used to identify an individual, is not individually identifiable health information. Section 164.514(b) says a covered entity may determine that health information is not individually identifiable only in one of two ways.

The first is expert determination: a person with appropriate knowledge applies accepted statistical and scientific principles, finds that the risk of identification is very small, and documents the methods and results. You do not complete that method by deleting a first name in a chat box between sessions.

The second is the Safe Harbor path in 164.514(b)(2). You remove listed identifiers of the individual or of relatives, employers, or household members, and you do not have actual knowledge that the remaining information could identify the person. The identifier list includes names; geographic subdivisions smaller than a state, with a narrow zip-code exception; all elements of dates except year that relate directly to the individual, plus ages over 89; telephone and fax numbers; email addresses; Social Security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate and license numbers; vehicle and device identifiers; URLs; IP addresses; biometric identifiers, including finger and voice prints; full-face photographs and comparable images; and any other unique identifying number, characteristic, or code, except as 164.514(c) allows for a re-identification code the covered entity does not disclose.

Deleting the name does not change the consumer row. Is ChatGPT HIPAA compliant on Free, Plus, Pro, or Business? Still no. The guide’s eligibility sentence does not have a de-identification exception. Use 164.514 when you are building a general craft question that never contained the note, or when you are checking whether a leftover detail still identifies someone. Do not use it as a ritual that blesses a paste.

If you assign a code so you can re-identify the material later, 164.514(c) says the code must not be derived from information about the individual, and you must not disclose the mechanism. A chart number with the letters scrambled is not that code.

Keep the note in a workflow that already has a BAA

The alternative is not a cleverer prompt. It is a place where the note already lives, under an agreement you have signed, with you still deciding what becomes the record. Once the note is back in the chart, the remaining question is narrow. Is ChatGPT HIPAA compliant for the account you will open tomorrow, with the BAA you have actually signed?

If the row you matched says PHI is not allowed, close the chat and finish the note in the chart. If you want a second pair of eyes on wording, use the craft question above only after the identifiers are gone, and keep the session facts in the record. If the row says PHI is allowed, confirm the exhibit and the workspace or Org ID first, then still keep prohibited fields empty, and still sign the note in the chart. OpenAI’s guide does not let an eligible chat hold the designated record set.

When you are comparing a vendor agreement rather than an OpenAI login, use the business associate agreement template to mark permitted use, safeguards, incident notice, subcontractors, and return or destruction against the workflow you will actually run. The business associate agreement for therapists is the practice-side review of parties, plan tier, and what happens when you cancel. Neither document is a reason to paste a note into a consumer chat while you wait.

If the draft itself should happen inside a clinical workflow, look at what your practice has already signed. On Emosapien, a BAA is available on Professional and Enterprise plans before protected health information moves through the clinical workflow. You sign that BAA first. Session content is not used to train public models. You review and sign the note before it is part of the record. Those are product controls, not a finding that every possible use is compliant. The security page states the BAA availability, encryption, access controls, and the no-public-model-training limit. BAA-ready plans are where that Professional and Enterprise line starts. If your seat is not on one of those plans, do not send PHI there either.

A signed BAA is the start of the review, not the end. Ask which subprocessors see session content, how long audio or a transcript is kept, whether a support agent can open a recording, and what you can export when you leave. The Vendor Due Diligence Pack is the pass/fail sheet for those questions. It does not grade ChatGPT for you. You still match the answers to your row in the eligibility table.

Questions to send before the first client fact

Send this as email, not as a chat that already contains a note. You want the product name, the exhibit, and the shutoffs in writing before any client fact moves.

If the reply is a link to a marketing page, send the questions again. You are buying a named configuration, not a slogan. If the reply names a product that is not on your invoice, do not “upgrade in your head.” Change the contract, or stay on the row that matches what you pay for today.

Before the next session, ask again: is ChatGPT HIPAA compliant for the account you will actually open? A yes on a colleague’s Regulated Workspace is not a yes on the Plus tab in your browser.

Download the vendor due diligence pack

Print the questionnaire before the call so you are not scrolling for the BAA row while a salesperson talks. Mark pass or fail on the tier you would buy, then file the written reply with the exhibit.