Claude is an artificial intelligence assistant developed by Anthropic that helps users draft content, summarize documents, analyze information and write code. Healthcare organizations can use eligible versions to support tasks such as reviewing prior authorization requests and organizing patient communications.

Is Claude HIPAA compliant? Yes, Claude can be HIPAA compliant, but there are limitations.

 

What changed this year?

In January 2026, Anthropic introduced Claude for Healthcare, expanding its healthcare offering with HIPAA ready products and tools for tasks such as prior authorization reviews and care coordination. As of October 2026, coverage remains specific to eligible services and features; the launch did not make every Claude plan suitable for processing PHI.

 

Will Claude sign a business associate agreement (BAA)?

Yes, Claude’s provider, Anthropic, will sign a business associate agreement for eligible services. Its published BAA requirements and coverage can be reviewed here.

For Enterprise, the organization’s Primary Owner must accept the BAA and enable HIPAA in organization settings. The agreement is provided during that setup process. Eligible API customers also need an executed BAA and HIPAA-enabled organization before processing PHI.

 

What does the Claude BAA cover?

Anthropic’s BAA guidance states: “Anthropic provides a BAA covering our HIPAA-ready services.” Covered features include:

  • Enterprise chat, projects in chat and artifacts in chat.
  • Enterprise voice, web search and Research.
  • Enterprise file creation and code execution, excluding network access and external websites.
  • Supported first-party API features, including the Messages API.

Claude Code and Cowork in local mode can also be covered on eligible Enterprise accounts after a separate HIPAA configuration is applied. This configuration requires an Anthropic account team; enabling HIPAA for chat alone does not activate that coverage.

 

What does the Claude BAA exclude?

Free, Pro, Max and Team plans cannot enable HIPAA coverage. An Enterprise subscription also requires HIPAA activation and BAA acceptance before its eligible features are covered.

Anthropic’s guidance says the BAA “excludes features such as Claude Console, Cowork in the cloud.” Other exclusions include published artifact pages and specified beta products, including Claude Design, Claude Slides and Claude Docs.

Third-party data transfers through connectors are not covered by Anthropic’s BAA. Organizations must separately assess any connected service receiving PHI. API exclusions also include batch processing, the Files API and API code execution.

 

Conclusion

Claude may be HIPAA compliant, but only when an eligible service is covered by an executed BAA and configured and used to meet HIPAA requirements. Its consumer and Team plans should not be used to process PHI on behalf of a covered entity.

Learn more: HIPAA Compliant Email: The Definitive Guide

 

FAQs

What is a BAA?

A BAA is a legally binding contract establishing a relationship between a covered entity under HIPAA and its business associates. The purpose of this agreement is to ensure the proper protection of PHI as required by HIPAA regulations.

 

What is HIPAA?

HIPAA sets national standards for protecting the privacy and security of certain health information, known as PHI.

HIPAA is designed to protect the privacy and security of individuals’ health information and to ensure that healthcare providers and insurers can securely exchange electronic health information. Violations of HIPAA can result in significant fines and penalties for covered entities.

 

Who does HIPAA apply to?

HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.