ChatGPT for Clinicians: Does the Individual BAA Cover Your Practice?

No. ChatGPT for Clinicians is free for verified individual clinicians in the United States, and the clinician can sign a business associate agreement (BAA) for their own workspace. It does not extend to colleagues, front-desk staff or the practice as a whole. A practice-wide BAA needs ChatGPT for Healthcare or another organisation-level agreement.

The detail is where practices get caught. The product has a single clinician as its unit: one person is verified, one workspace is created, one BAA is signed. Everything a practice owner wants to know follows from that, including which staff can use it, what the practice is still responsible for, and what to do about everyone who is not a clinician on the eligible list. It is not legal advice; for what your practice must do as a covered entity, ask your compliance adviser or counsel.

Follow me on Instagram@sagnikteaches

What ChatGPT for Clinicians is, in one paragraph

OpenAI launched it as a version of ChatGPT built for clinical tasks such as documentation and medical research. According to OpenAI's help page, it is free at launch for verified clinicians, and eligible clinicians currently include physicians (MD or DO), nurse practitioners, physician assistants and pharmacists. Both "at launch" and "currently" are OpenAI's words, so the price and the list can change. To sign up you need a ChatGPT account, a valid National Provider Identifier (NPI) and a licence that a third-party verification provider can confirm. It includes clinical search with citations, deep research across medical literature, pre-built skills and starter prompts, drafting help for notes, referral letters, prior-authorisation letters and patient instructions, and support for earning continuing medical education credit. OpenAI says content shared with it is not used to train its models. Image generation is not supported. A read-only Healthcare Public Data plugin can search public sources such as PubMed, ClinicalTrials.gov and DailyMed, and OpenAI tells users not to put patient names, record numbers or other PHI into those queries. The Epic plugin, which reads patient charts in ChatGPT for Healthcare, is not available on individual clinician accounts. The product is aimed at the individual, and the help page says so directly.

Connect on LinkedInSagnik Bhattacharya

What the individual BAA actually covers

A business associate agreement is the contract that lets a vendor handle protected health information (PHI) for a covered entity. Under OpenAI's help page, eligible individual clinicians can review and sign a BAA for their ChatGPT for Clinicians workspace in ChatGPT, under Settings and then Agreements. Three phrases in the page matter for a practice.

Subscribe on YouTube@sagnikteaches

First, "for their ChatGPT for Clinicians workspace". The agreement is tied to that workspace, not to a clinic's other accounts. A clinician's personal ChatGPT workspace remains separate: OpenAI's page says an existing workspace stays available and you switch between them. Pasting patient details into the wrong workspace is a real risk, and the BAA does not travel with the person.

Second, "designed for individual use". OpenAI points anyone needing "centralised deployment, admin controls, or a BAA that covers multiple users" to ChatGPT for Healthcare. So there is no practice admin console, no shared user list and no multi-user cover in this product. That is not a flaw; it is the product's scope.

Third, the warning: do not share PHI unless a BAA is in place "and you are authorised to sign a BAA for your account". That clause is the one practices should take most seriously. A clinician who is an employee of a practice may not be the person authorised to bind it to an agreement about the practice's patient data. Whether an employed clinician can sign on their own account for patient information held by the practice is a question for the practice's compliance lead or counsel before anyone ticks the box.

Who in the practice is covered, person by person

Imagine a primary care practice with six people. This table works through what the individual BAA gives each one, based on OpenAI's published eligibility and the product's individual scope. It is illustrative of the pattern, not a ruling on any particular practice.

The pattern: cover follows the verified clinician. Three people in six have it for their own workspaces. Everyone else is outside, including the people who handle the most paperwork-heavy PHI. A practice that sees "free BAA" and tells all six to use ChatGPT has left three people, and a lot of the volume, uncovered.

Who is left out: therapists and other clinicians not on the list

The help page names four eligible roles. Psychologists, counsellors, therapists, physiotherapists, dentists, nurses outside the NP title and many other clinicians are not on that list. A third-party site may suggest otherwise; do not rely on it. The safe approach is to read OpenAI's current eligibility text and the sign-up flow, and to treat anyone not listed as outside the scheme unless OpenAI confirms in writing. If you are a therapist, the page you want is a comparison of tools that offer agreements, such as HIPAA-compliant AI for therapists and which vendors sign a BAA.

Geography is a limit too. At launch the product is for verified clinicians in the United States only; OpenAI says it plans to expand to more countries over time but gives no dates, so a clinician elsewhere should not assume the offer reaches them.

What a practice-wide agreement needs, and the alternatives

OpenAI describes ChatGPT for Healthcare as an enterprise version of ChatGPT for clinicians, administrators and researchers, with role-based access controls, single sign-on, audit logs, connections to tools such as SharePoint, Teams and Outlook, and a BAA to support HIPAA-compliant use. Its help page says pricing is based on ChatGPT Enterprise and depends on organisation size, and it points large hospitals and health systems to the sales team, so a small clinic should expect a sales conversation rather than a self-serve plan. Non-clinical staff can use it, which is the point for a practice: care coordinators and administrators sit inside the same agreement. A clinician can also keep an individual ChatGPT for Clinicians account even if their organisation uses ChatGPT for Healthcare.

OpenAI's list of eligible products also names ChatGPT Enterprise with a Regulated Workspace, ChatGPT FedRAMP and the API with modified retention. It does not name the Free, Plus, Pro or Business plans, and OpenAI's BAA page states plainly that it does not offer a BAA for ChatGPT Business. A practice already paying for Business seats therefore cannot add a BAA to them.

That gives a small practice roughly four routes, and the right one depends on who needs to use AI and for what.

1. Individual clinician accounts only, with no staff use. Each eligible clinician signs for their own workspace, subject to authorisation, and uses it for clinical tasks. Everyone else uses no AI on patient data.
2. An organisation-wide deployment. ChatGPT for Healthcare, or another vendor's tool with a covering agreement, for anyone who needs it, administered centrally. The cost and set-up are higher.
3. Purpose-built tools with their own agreements. AI scribes, AI receptionists and similar products often include a BAA in the contract. For front-desk work this is usually the right answer; see a BAA and retention checklist for an AI receptionist.
4. No PHI in any general-purpose AI tool. Use ChatGPT, Claude or Gemini for tasks that need no patient information at all, with a written rule and some de-identification habits.

A comparison of what other vendors offer is in which Claude plans offer a BAA, and every ChatGPT plan compared for a small practice sets the full picture for OpenAI.

Three practices, three different answers

A solo physician. The simplest case. One person, eligible, probably authorised to sign for their own patient information. The individual BAA fits, and the main discipline is workspace hygiene and the rule on what goes in. If there is a part-time administrator, they still sit outside it.

A two-physician group with one shared office manager. Both physicians can sign individually, but now the practice has two agreements, two workspaces and no way to see either centrally. If one physician leaves, the practice cannot manage or retrieve anything from their workspace, because it belongs to the individual. That alone is a reason many groups look at the organisation route once the headcount passes a handful, or at least agree a rule on what material clinicians must save to the practice's own record system rather than keeping it only in a chat history.

A multidisciplinary clinic with a psychologist and a physiotherapist. Neither is on the eligible list. The physician and the NP can use the clinician product; the others cannot. The clinic should resist the temptation to let the two groups work differently and quietly: if one discipline uses AI on notes and the other does not, referrals and shared records get awkward. A clinic-wide decision, perhaps for a purpose-built scribe whose agreement covers every discipline, tends to be cleaner than a patchwork.

De-identifying a note before it goes anywhere: a before and after

Many clinical tasks do not need PHI at all, as OpenAI itself notes. De-identifying is a skill, and it is easy to do badly. The HIPAA Safe Harbor method lists 18 identifiers, including names, dates tied to the person (other than the year), locations smaller than a state and any other unique identifying number or code, and free-text notes often hide them in odd places. Here is an illustrative before and after for a request to draft a patient instruction sheet.

Before: "Mrs [surname], 68, from [small town], saw me on 14 March with right knee pain after falling at her daughter [name]'s house. Her husband has dementia and she cares for him at home."

After: "Female in her late 60s with right knee pain after a fall. She is the main carer for a spouse with dementia. Write a plain-language instruction sheet on activity, pain control and when to seek help, with large text and short sentences."

The after version removes the name, exact age, town, date, family member's name and the unusual combination of details that could point to one household. It keeps what the task needs. If you cannot do the task without the identifying details, that is the point at which a covering agreement matters, and the point at which you check that you are in the right workspace.

When a clinician joins or leaves

Because the product is individual, joining and leaving need a small procedure. On joining: confirm eligibility, confirm authority to sign, give the person the practice's AI rule, record that they have read it and keep a copy of their signed agreement date. On leaving: remind them that the workspace is theirs and that patient information must not be carried out of the practice, make sure anything the practice needs is saved in its own records, and update your register. Nothing in the product's design lets a practice delete or retrieve an individual's workspace, so the procedure has to do that job.

One five-person practice, two routes, in numbers

Illustrative figures. A five-person practice has two physicians, one nurse practitioner, a part-time practice manager and a front-desk coordinator. The three clinicians each spend about 40 minutes a day on documentation, referral letters and prior-authorisation text after clinic hours. Suppose AI drafting cuts that by a quarter, about 10 minutes a day each, which across three clinicians and roughly 220 working days comes to about 110 hours a year. That is the prize for the individual route, and it costs nothing in licence fees. The practice manager and front-desk coordinator, who handle patient messages, insurance calls and appointment changes, get nothing from it.

The practice owner decides on a two-step plan. Step one is the individual route for the three clinicians, but only after the owner, with the compliance adviser, confirms that each is authorised to sign for patient information held by the practice and writes the rule on what may go into the workspace. Step two is for the two administrative staff: an AI receptionist or messaging tool that includes a BAA in its contract, assessed separately, and until it is in place, a rule that no patient information goes into any AI tool at all.

Notice what is missing from the plan: any staff sharing a login, or any assumption that the clinicians' BAAs stretch to the office. Notice, too, what is present: each of the three BAAs sits in the practice's compliance folder with a copy of the date and the person who signed.

Writing a practice rule that fits what you now know

An AI usage policy for a practice can be one page. This prompt produces a first draft you can take to your adviser:

Draft a one-page AI use rule for a five-person medical practice. Facts:
three clinicians (2 physicians, 1 nurse practitioner) may use ChatGPT for
Clinicians for clinical tasks, each under their own individually signed
agreement, in that workspace only; no other staff may use any general-purpose
AI tool with patient information; no shared logins; personal ChatGPT
accounts must never be used for patient information; staff may use AI
for non-patient tasks such as marketing copy and policy drafts. Include
sections: who may use what, what must never be entered, how to de-identify
a note, who to ask, and what to do after an accidental disclosure.
Plain English. Do not claim the practice is compliant.

A sample line from the output (illustrative): "If you paste patient information into the wrong account, stop, tell the practice manager at once and do not try to delete it yourself; we will record what happened and decide next steps." What you fix: have counsel read it, because the accidental-disclosure steps may carry notification duties. An AI usage policy for a medical practice goes further, with a fuller template.

Six checks before anyone in the practice signs up

1. Eligibility. Is each clinician on the list of eligible roles, with an NPI and a verifiable licence? If not, stop there.
2. Authority. Who is allowed to sign a BAA about patient information the practice controls? Write down the answer.
3. Workspace discipline. Can the clinician reliably tell their ChatGPT for Clinicians workspace from any other? A screenshot of the account switcher in the policy, and a habit of checking the workspace name before pasting, help.
4. Third-party additions. OpenAI's page warns against sharing PHI with third-party GPTs or connected apps without appropriate permissions and agreements. Switch off or avoid any app that has no agreement in place.
5. Features outside the BAA. OpenAI's list of covered functions also names some that are not covered even in an eligible workspace, including "Use improved memory" (which draws on past chats), and says features not on the covered list are not automatically covered. Check which memory setting the clinician's workspace uses before patient details go anywhere near it.
6. A record. Keep a copy or screenshot of each signed agreement, the date and the person, and review the list when anyone joins or leaves.

Common misreadings to avoid

"Free with a BAA means the practice is covered." It means one verified clinician has a signed agreement for one workspace. The practice's own obligations, from policies to staff training to risk assessments, remain.

"A BAA makes our use compliant." OpenAI's own help text on its API agreement says accepting a BAA does not by itself make an application compliant; you remain responsible for how you use the service. The same logic holds for clinicians.

"Verified means OpenAI checks my practice." Verification confirms an individual's licence and NPI through a third-party provider. It does not review your practice, its policies or its staff.

"The model is clinical-grade, so I can skip the check." OpenAI says the product supports clinicians and that they remain responsible for care decisions and should verify information. Treat output as a draft.

What to check on OpenAI's pages before you act

These products change quickly, and OpenAI's eligibility list, regions and pricing may have moved by the time you read this. Before signing anything, open OpenAI's help-centre page for ChatGPT for Clinicians and read the Availability section and the BAA section. Open the page listing HIPAA-eligible products and confirm the product you plan to use is on it. If you are considering the organisation route, ask OpenAI's sales team for the BAA terms, the audit and admin controls, and the price for your headcount. For an overview of the privacy basics that apply whichever route you pick, see whether it is safe to put customer data into ChatGPT. And if you would like to map who in your practice needs AI for which tasks, that is the kind of job my AI implementation consultation covers, alongside, not instead of, your compliance adviser.

Practice questions about the clinician BAA

Can my receptionist or biller use my ChatGPT for Clinicians account?

No. The workspace belongs to the verified clinician, and the BAA is signed for that individual's workspace. Sharing a login would also be poor security practice. Staff who need AI for patient-related work should use a tool with an agreement that covers them, such as an organisation-wide deployment.

Is ChatGPT for Clinicians open to therapists and psychologists?

OpenAI's help page lists eligible clinicians as physicians (MD or DO), nurse practitioners, physician assistants and pharmacists. Therapists, psychologists, physiotherapists and nurses outside those titles are not listed, so do not assume cover. Check the sign-up flow and OpenAI's page, and ask OpenAI if you are unsure.

Does ChatGPT Business or Plus come with a BAA?

No. OpenAI's list of eligible products names ChatGPT for Healthcare, ChatGPT Enterprise with a Regulated Workspace, ChatGPT FedRAMP, ChatGPT for Clinicians and certain API configurations, not Free, Plus, Pro or Business, and its BAA page says it does not offer a BAA for ChatGPT Business. Check the list again before pasting anything in, because it changes.

Do I need a BAA if I never enter patient details?

Not for tasks that involve no protected health information, and OpenAI notes that many clinical tasks do not need it. The risk is accidental disclosure: names, dates, rare diagnoses and free text can identify someone. A rule and a habit of de-identifying matter more than the agreement for these tasks.

Further reads

• AI in Healthcare for Physicians: Personal Tool or Practice-Wide Tool? — Decide between a personal tool and a practice-wide one.
• HIPAA-Compliant AI Assistants for a Medical Office: BAA by Plan — A BAA-by-plan check for an entire medical office.
• AI in Skilled Nursing Facilities: Screening Hospital Referral Packets — A concrete task where protected data and AI meet.
• HIPAA Compliance Policy for a Home Care Agency: Build It With ChatGPT — Draft a privacy policy for a smaller care provider.
• AI Chatbot for Healthcare: A Small Clinic's Data and Consent Checklist — Data and consent checks for a patient-facing chatbot.
• ABA Session Notes With AI: From Raw Session Data to a Draft Note — A practice-owner workflow for turning trial data into a draft ABA note: de-identify or use a BAA tool, a prompt, a worked example and sign-off.
• AI Denial Management for Medical Billing: Group, Appeal, Track — Export your remits, group denials by reason code, draft appeals with AI and track outcomes on one sheet, with a worked month in numbers.
• ChatGPT for Medical Billing: Appeals and Claim Checks Without PHI — A redaction method, appeal and claim-check prompts, and the review step that lets a billing team use ChatGPT without pasting patient data.
• ChatGPT for Medical Notes: A Safe Drafting Workflow for Small Practices — Which note types a small practice can draft with ChatGPT, a de-identified workflow, and when only a BAA-covered scribe will do.
• How to Train Employees on AI in a Clinic: Four Short Sessions — Four 30-minute sessions for clinic staff: rules, de-identified practice, consent wording and incident reporting, plus a sign-off sheet.
• How to Use ChatGPT for Data Analysis in a Clinic: No-Show Rates — Strip names, dates of birth and phone numbers, then ask ChatGPT for no-show rates by day, slot and lead time, and check the totals by hand.
• AI for Sleep Clinics: Study Bookings, CPAP Follow-Up and Letters — Study bookings, CPAP reminders and letters a sleep clinic can hand to AI, with a worked booking flow and the clinical jobs that stay human.
• AI Agents for Healthcare: Six Safe First Jobs for a Small Practice — Six admin-only first jobs for an AI agent in a small practice, the clinical work that stays human, and the contract checks each tool needs.
• AI Search Tools for Medical Providers: How to Check the Citations — A five-step routine for checking an AI search answer's citations before you act, plus a look at the tools that cite and what never goes in a prompt.
• Is There an AI Tool for Pharmacists? What US and UK Teams Can Use — Yes: ChatGPT for Clinicians for verified US pharmacists, general business-plan tools elsewhere. What to use them for and what to keep out.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: OpenAI help-centre articles ChatGPT for Clinicians; HIPAA eligible products and functionality; Getting a Business Associate Agreement for the OpenAI API; ChatGPT for Healthcare (all read 4 November 2026); the Safe Harbor identifier list in 45 CFR 164.514(b)(2). Check the live pages before acting.