A small practice can put patient information only into OpenAI products covered by a signed BAA: ChatGPT for Clinicians (individual verified clinicians), ChatGPT for Healthcare, ChatGPT Enterprise with a regulated workspace, or the API with modified retention. OpenAI says it does not offer a BAA for ChatGPT Business, and Free, Go, Plus and Pro are not on its eligible list.
That one sentence hides a decision by role, because the products are built for different people. A solo physician, a four-clinician group, a practice manager and a developer building an intake tool each land on a different answer. Everything below was checked on OpenAI's own help pages on 4 November 2026, and OpenAI changes these pages often, so confirm on the day you buy.
What a BAA changes, and what it does not
A business associate agreement, or BAA, is a contract under US health-privacy law (HIPAA) between a healthcare provider and a supplier that handles patient information for them. Without one, putting identifiable patient information into a supplier's tool is generally not something the supplier is bound to protect in the way the law expects. With one, the supplier accepts specific duties.
It does not mean the tool is automatically "compliant". OpenAI's help page for the API says in plain words that accepting a BAA and enabling HIPAA compliance support do not make an application compliant on their own. Two further limits matter to a small practice:
- Coverage is per feature. OpenAI lists the functions covered by the agreement and some that are not. At the time of checking, the uncovered list included improved memory, browser use for Work in the cloud, network access for Work in the cloud, event-triggered scheduled tasks, internet access inside Canvas and code blocks, and sharing workspace agents with agent-owned connections. Features not listed as covered should be treated as not covered.
- Your obligations stay yours. Staff training, access control, deciding what may be entered and what happens when something goes wrong are practice decisions.
Practices that are still building their rules should read the AI usage policy template for a medical practice alongside this tutorial, because the product choice only helps if staff know what they may type into it.
The Complete Excel Course with AI Integration
From formulas and pivot tables to Power Query, DAX, VBA and AI with Copilot, ChatGPT and Claude — hands-on from the first lesson.
By Sagnik Bhattacharya and Virginia Thorn, Primetime Emmy Award winner
Buy nowThe products, one by one
ChatGPT for Clinicians: the solo route
OpenAI describes this as a version of ChatGPT for verified clinicians in the United States, free for physicians (MD or DO), nurse practitioners, physician assistants and pharmacists. To sign up you need a ChatGPT account, a valid NPI (the US national provider identifier) and a licence that a third-party verification provider can confirm. After verification you get a separate clinician workspace, and your existing ChatGPT workspace remains available alongside it.
It is designed for individual use, including the ability to sign a BAA yourself, which you do in ChatGPT under Settings, Agreements. It includes clinical search with citations, deep research across medical literature, skills and starter prompts, and drafting support for notes, referral letters, prior-authorisation letters and patient instructions, always for clinician review. Two limits matter. First, the Epic plugin is not available on individual Clinicians accounts. Second, it is one person's account: if your practice wants a BAA covering several people, central admin controls or shared deployment, OpenAI directs you to ChatGPT for Healthcare.
The workspace also offers memory, projects, connected apps and canvas, and those need the same care as any other feature. Improved memory is on OpenAI's not-covered list, and the Clinicians help page warns against sharing patient information with connected apps unless you have the permissions and agreements in place, because third-party apps carry their own terms.
The right user is the solo clinician, or a clinician in a group whose practice has not bought anything for everyone, who wants clinical evidence lookup and drafting help for their own work.
ChatGPT for Healthcare: the group route
This is OpenAI's enterprise version of ChatGPT for clinicians, administrators and researchers, with HIPAA support through enterprise security, no training on data, retention controls and a BAA. It adds role-based access control, SSO, audit logs, data residency options and customer-managed encryption keys, plus trusted clinical search that admins can switch on for particular groups. It can connect to Microsoft SharePoint, Teams and Outlook, and an Epic plugin is available to eligible organisational workspaces, where an administrator sets up the organisation's Epic connection.
Pricing is based on ChatGPT Enterprise and depends on organisation size and deployment needs, with a shared credit pool at contract level rather than a public per-seat price. For a small practice that means a conversation with OpenAI sales, so do not count on a list price. OpenAI's help page says large hospitals and health systems can contact sales to learn more, so a three-person practice should ask early whether a deployment of its size is offered at all, and on what terms.
ChatGPT Enterprise with a regulated workspace
OpenAI's HIPAA-eligible list also includes ChatGPT Enterprise with a regulated workspace, and for a sales-managed Enterprise or Edu account the route to a BAA is to contact OpenAI sales. This sits at the large-organisation end and is mostly relevant if your practice belongs to a bigger health system already buying Enterprise.
ChatGPT Business: no BAA
OpenAI's BAA help page says plainly: "We do not offer a BAA for ChatGPT Business." Business is a good team plan for work that touches no patient information, for teams of 2 to 200 with no training on your business data by default, but it is not the answer for anything identifiable. OpenAI's business pricing page lists Standard seats at $20 per user per month billed annually or $25 billed monthly, and Premium seats at $100 or $125, so confirm the figures before you budget.
Free, Go, Plus and Pro are individual consumer plans and are not on the BAA list either. The practical rule is simple: if the plan is not on OpenAI's HIPAA-eligible list, no patient information goes into it.
The API with modified retention: the build route
If a developer or an in-house technical person is building a tool, such as an intake summariser, the API with modified retention is on the eligible list. The BAA is accepted in the API Platform by an organisation admin with authority to agree on the organisation's behalf, under Settings, Organization, General, HIPAA compliance support. OpenAI says an enterprise agreement is not required, but self-serve enrolment requires an established history of API usage; if the section shows "Not eligible yet", you can try again in a few days or contact OpenAI. Once enabled it cannot be switched off in the platform settings.
Costs are per token rather than per seat. OpenAI's API pricing page, checked on 4 November 2026, lists GPT-6.1 Sol, one of its mid-priced models, at $2 per million input tokens and $10 per million output tokens; treat that as a rough guide, because model names and prices change. A practice summarising a few hundred letters a month would spend small amounts on tokens, and far more on the developer's time and on getting retention settings right.
Choosing by role: one table
| Who you are | Product to look at first | Why | Watch for |
|---|---|---|---|
| Solo US clinician (MD, DO, NP, PA, pharmacist) | ChatGPT for Clinicians | Free, individual BAA, clinical search, drafting | One person only; no Epic plugin |
| Hospital group or multi-site practice with IT support | ChatGPT for Healthcare | Admin controls, audit logs, shared governance, one BAA | Sales-led pricing; features still limited by the covered list |
| Practice manager writing policies, ads, rotas | ChatGPT Business or any suitable plan, with no patient information | No BAA needed if nothing identifiable goes in | Staff pasting an email thread with patient names |
| Developer building an internal tool | API with modified retention and a signed BAA | Control over what is sent and kept | Eligibility history; features outside the covered list |
| Practice buying a vendor's product built on OpenAI | The vendor's own BAA | Your contract is with the vendor | Subprocessor lists and retention terms |
Four small practices, four answers
These are illustrative, not real clients.
A solo primary-care physician wants help drafting referral letters and checking guideline wording. She verifies for ChatGPT for Clinicians with her NPI, signs the BAA in the product, and uses the clinician workspace only for patient-related drafts. Her existing ChatGPT workspace stays for non-clinical work. Cost: $0 in subscription, perhaps an hour to set up.
A three-clinician group asks whether each of them should simply sign up individually. They can, and OpenAI says individual sign-up stays open even if the organisation also uses ChatGPT for Healthcare, but each clinician has a separate agreement and no shared admin view, and nobody can see how the others use it. If the partners want a policy they can enforce and an audit trail, they should speak to OpenAI about ChatGPT for Healthcare, or choose a purpose-built scribe with its own BAA, as covered in the vendor-questions tutorial on AI scribes.
A practice manager in an eight-person clinic wants help with staff rotas, a patient-facing newsletter and a job advert. None of this contains patient information, so any suitable plan will do, and the main control is a written rule: no patient names, dates of birth, appointment details or free-text clinical content. A shared Business workspace with two or more seats is a sensible fit, and the rule goes in the staff handbook.
A practice with a developer contractor wants an internal tool that turns a dictated visit note into a draft letter. The contractor builds on the API. Before any real note goes through it, the practice's admin accepts the BAA, the contractor confirms the endpoints used are covered, test data is invented, and the practice owner reads OpenAI's HIPAA implementation guide referenced in the BAA. Cost: mostly build time; tokens are small by comparison.
Common mix-ups that cause real exposure
- "We signed up for Business, so we are covered." Business has no BAA. Moving to a plan with one does not retrospectively fix anything already entered.
- Personal accounts at work. A clinician uses a personal Plus account on their phone for "just one letter". Write the rule that patient information goes only into the approved workspace, and give people an easy way to use it.
- Features that are switched on but not covered. Improved memory, browser use and event-triggered tasks are on OpenAI's list of features outside the BAA at the time of checking. OpenAI keeps these off by default in eligible workspaces, and an admin can switch them on for chosen roles, so check the role settings after every plan change.
- Believing "de-identified" means "safe". A dictated note with a rare diagnosis, a small town and a date can identify a patient with no name attached. Where identification risk is real, treat the content as patient information.
- Vendor products. A "ChatGPT-powered" scheduling tool is the vendor's responsibility, so read the vendor's contract, as in the BAA check for a medical office.
A yearly sum for a six-clinician practice
Numbers help more than adjectives here. Take an illustrative practice with six clinicians, two administrators and a practice manager. All figures are rough list prices, not quotes.
- Clinicians on ChatGPT for Clinicians: six free individual accounts, so $0 in subscriptions. The cost is six verifications, six BAAs to keep on file, and no shared admin view.
- Administrators and practice manager on ChatGPT Business, for work with no patient information: three Standard seats at $20 a month each, billed annually, is $60 a month, or $720 a year. Check the current price first.
- Internal letter tool on the API: say 400 letters a month, each about 1,500 tokens in and 600 tokens out. That is 600,000 input tokens (about $1.20 at $2 per million) and 240,000 output tokens (about $2.40 at $10 per million), roughly $3.60 a month, or $43 a year, before developer time.
- ChatGPT for Healthcare: sales-quoted, so not in the sum. Ask for a written quote for nine users before deciding that the governance is worth it.
The sum shows where the real cost sits: not in the tokens or even the seats, but in setup, rules and review. A practice that spends $720 on seats and nothing on a staff rule has bought the wrong thing.
"May I paste this?" Five examples for staff
A decision table is easier to follow than a policy paragraph. Pin something like this next to the screen, adjusted to the products you actually approve.
| What the member of staff wants to paste | Business plan | BAA-covered workspace |
|---|---|---|
| A job advert draft for a new nurse | Yes | Yes |
| Opening hours and flu-clinic dates for a newsletter | Yes | Yes |
| An email from a patient asking about a test result | No | Yes, if the task is allowed |
| A clinical note, even with the name removed | No | Yes, clinician only |
| A screenshot of the appointment system | No | Only if the product and feature are covered |
The staff rule itself can be three sentences: "Anything about a patient, even without a name, goes only into the approved clinical workspace. Everything else may go into the team workspace. If you are unsure, ask the practice manager before you paste." Short rules get followed; long ones get skimmed.
A prompt and output you could run inside a covered workspace
This is what an allowed task looks like for a clinician in a BAA-covered workspace. The prompt uses placeholders here; in real use the clinician enters the actual clinical content inside the covered workspace only.
Draft a referral letter to [specialty] for a [age]-year-old patient.
Reason for referral: [reason]. Relevant history: [history].
Current medicines: [medicines]. Urgency: [clinician to set].
Tone: professional, concise, under 250 words. Mark anything
you assumed with [CHECK].A sample reply (illustrative) is a short letter with a heading, a one-line reason, a history paragraph and a closing request, with two [CHECK] flags where the model guessed at a medicine dose and a date. The clinician fixes the flags, checks every fact against the chart, and signs. The product choice makes that safe to do; the review makes it correct.
When a clinician leaves, or the plan changes
Two moments catch small practices out. The first is a departure. An individual ChatGPT for Clinicians workspace belongs to that clinician and their own agreement, so it does not stay behind when they go, and the practice has no admin view into it. Decide early which drafts and templates belong in the practice's own shared folder, and make saving final letters to the patient record, not to a chat history, the normal habit.
The second is a change of plan. If you start on one product and move to another, do not assume the earlier chats come with you: BAA coverage applies to use from an eligible workspace, and anything typed into an uncovered plan stays uncovered. Treat the old workspace as closed: stop entering patient information, export what you are entitled to and need, and note the date in your compliance log. OpenAI's export help page says self-service export is not available in Business, Enterprise or ChatGPT for Healthcare workspaces, so do not plan around finding old conversations later. The same page advises anyone moving a personal workspace into a managed one to request, download and check their export before the personal workspace is removed.
How to verify before you commit
- Open OpenAI's "HIPAA eligible products and functionality" page and write down today's list of products and the "not covered" features, with the date.
- Confirm the product you plan to use is on the eligible list under its exact name.
- Sign the BAA yourself, or confirm in writing who has, and keep a copy in your compliance folder.
- Switch off or restrict any feature outside the covered list, and put the rest in a one-page rule for staff.
- Run a test with invented data only: a made-up patient, fake dates, fake conditions. Check the output, where it is stored and who in your workspace can see it.
- Diary a review for three months out, because plan names, features and the covered list change.
None of this is legal advice, and a healthcare lawyer or compliance adviser should look at your final set-up. If you would like help mapping which tasks in your practice need a BAA product at all and which do not, that is something I cover in my AI implementation consultation, via the contact page. For what to put in a staff policy, see personal tool or practice tool for physicians.
Questions practice owners ask about OpenAI and patient data
Does signing a BAA make my use compliant?
No. OpenAI's own help page says accepting a BAA does not by itself make an application compliant. You still have to use only covered features, configure the workspace correctly, train staff and meet your own obligations. The agreement allows protected information to be processed; it does not do your compliance work.
Can my front-desk staff use ChatGPT for Clinicians?
Not as such. It is built for verified individual clinicians, and OpenAI points multi-user deployments, admin controls and BAAs covering several people to ChatGPT for Healthcare. Staff who are not clinicians need a workspace set up for the practice, or a task that involves no patient information at all.
What if my software vendor uses OpenAI behind the scenes?
Your BAA is with the vendor, not with OpenAI. Ask the vendor for its BAA, which services it uses, whether patient data is retained or used for training, and how it handles a subprocessor. An OpenAI agreement you signed yourself does not cover their product.
Is the free version of ChatGPT safe if I remove names?
Removing names is not enough on its own, because dates, places, rare conditions and free-text details can identify a patient. If a task needs clinical detail, use a product with a BAA. If it does not, such as drafting a newsletter or a policy, any suitable plan is fine.
Further reads
- AI Medical Scribe for Clinicians: Shared Templates in a Group Practice — Shared templates when several clinicians use one tool.
- AI for Nurse Practitioners: Prior-Auth Letters and Practice Policies — A worked clinical-admin use case: prior-authorisation letters.
- AI Chatbot for Healthcare: A Small Clinic's Data and Consent Checklist — Data and consent checks for patient-facing chatbots.
- Best HIPAA-Compliant AI for Therapists: Which Vendors Sign a BAA? — BAA vendors compared for therapy practices.
- HIPAA-Compliant AI Receptionist: A BAA and Retention Checklist — BAA and retention checks for an AI receptionist.
- AI Voice Agent for a Dentist: Minutes, BAA and Exit Terms to Negotiate — Contract terms to negotiate with an AI voice vendor.
- AI for Mental Health Providers: A Roll-Out Plan for Group Practices — A roll-out plan for a group practice.
- Optometry Insurance Verification: A Front-Desk Workflow With AI — A front-desk routine for checking vision and medical eye insurance before the visit, with a call script, note template and safe uses of AI.
- Optometry Referral Letter Template: Draft With AI, Then Check — A referral letter template for GPs and ophthalmologists, a safe AI drafting method, and a pre-send checklist for laterality, numbers and urgency.
- AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.
Sources: OpenAI help pages 'ChatGPT for Clinicians', 'ChatGPT for Healthcare', 'HIPAA eligible products and functionality', 'Getting a Business Associate Agreement for the OpenAI API' and 'Exporting your ChatGPT history and data'; OpenAI business pricing, ChatGPT pricing and API pricing pages (all checked 4 November 2026).