Is ChatGPT HIPAA Compliant? Compliance Checklist for Clinical Teams

ChatGPT is not HIPAA compliant by default. Clinical PHI use needs an eligible service, an applicable executed business associate agreement (BAA) and required configuration, alongside the clinic’s safeguards. OpenAI lists its eligible products and functionality; its HIPAA implementation guide excludes consumer Free, Plus and Pro and ChatGPT Business from eligible services.

For a clinical team, the useful question is: “May this person send this information through this configured service to this destination?” A subscription receipt or a training toggle cannot answer it. The review needs a contracting entity, an exact workspace, a defined task and evidence for each data-handling step.

Legal and vendor sources checked October 7, 2026. Published by Vero, a healthcare documentation software provider.

Which ChatGPT offering are you using?

Start with the service—not the model name. Two staff members can use similar interfaces while working under different account arrangements. Record the offering exactly as provisioned, rather than writing only “ChatGPT approved” in a policy.

The table focuses on common clinic routes, not every government deployment. Eligibility is an entry condition; approval still depends on the actual contract and data flow.

Individual clinical access versus organization-managed access

OpenAI documents ChatGPT for Clinicians for eligible verified U.S. clinicians, with a separate individual clinical workspace. Its BAA can be accepted in Settings → Agreements by someone with authority. An existing personal workspace remains distinct. Teams needing central administration or an organizational arrangement should evaluate the organizational offering. ChatGPT for Clinicians documentation, checked October 7, 2026.

Translate that distinction into a staff procedure: before an approved task, confirm the workspace shown in the account switcher. A verified clinician identity does not make every workspace on that account an approved patient-data destination. Rehearse switching between a personal workspace and a demo clinical workspace using invented text, then document how staff identify the correct one.

The current API BAA route

OpenAI’s October 5, 2026 API changelog confirms a self-service BAA flow for eligible organizations in Platform Settings → Organization → General. Its help article describes HIPAA compliance support, where an authorized organization administrator reviews the BAA and completes acceptance. That article states that self-service eligibility depends on established API usage history, gives a contact route for custom terms and says an enterprise agreement is not required. An unavailable option does not mean coverage exists. Getting an OpenAI BAA, checked October 7, 2026.

For an application, retain evidence of both the executed agreement and the required retention provisioning. An API key working successfully is not evidence that its organization and project are configured for PHI. Include middleware, observability services and output storage in the application review; they do not disappear because the model endpoint is eligible.

What a BAA does and does not establish

A BAA specifies a business associate’s permitted uses and disclosures and required safeguards. HHS describes provisions addressing reporting, subcontractors, records access and return or destruction at termination. Match the agreement’s scope to the service actually being used. HHS business associate contracts, checked October 7, 2026.

A clinic can use a cloud service for ePHI when the applicable requirements are met, including an appropriate BAA. Encryption alone does not remove business-associate status: HHS explains that a cloud provider maintaining ePHI can be a business associate even without the decryption key. OCR also states that it does not endorse, certify or recommend particular technology products. HHS cloud-computing guidance, checked October 7, 2026.

Keep three decisions separate:

1. Contract coverage: is the applicable agreement executed for this entity and service?
2. Technical scope: are the workspace, features, recipients and retention settings within the reviewed configuration?
3. Operational authorization: has the clinic approved the task, workforce access, records handling and response process?

“The vendor offers a BAA” answers none of those completely. A procurement reviewer should be able to identify the actual agreement reference, not only a marketing page. A technical reviewer should be able to reproduce the configuration. The workflow owner should be able to explain what staff are allowed to do—and where they must stop.

The HIPAA Security Rule requires administrative, physical and technical safeguards for ePHI, including risk analysis and risk management. A signed contract does not perform that work for the clinic. This article uses HHS’s summary of the rule currently in effect, rather than treating proposed changes as already binding. HHS Security Rule summary, checked October 7, 2026.

Verify the workspace and feature boundaries

OpenAI’s current list excludes improved memory, Codex Cloud and Sites, among other functionality. Enabling an excluded feature does not bring it into BAA scope. Check the live list and assess third-party services separately. OpenAI functionality scope, checked October 7, 2026.

One easily missed distinction concerns search. OpenAI documents eligible-workspace ChatGPT search using its own index, whereas its API data-controls guide treats live internet web search differently. The specified cache-only Responses API route requires external_web_access: false with a key from a Zero Data Retention-enabled project in a ZDR organization; web_search_preview ignores that parameter. Do not transfer one product’s rule to another. OpenAI API data controls, checked October 7, 2026.

For each connection, write down what leaves the workspace: the full prompt, a generated answer, a file, selected fields or metadata. Name the recipient. Then establish whether its role, permissions and terms are approved. “Connected to the EHR” is too imprecise if one step retrieves a chart and another forwards text to a separate application.

OpenAI documents organizational controls in ChatGPT for Healthcare, including role-based access, audit logs and retention controls. Its Epic plugin is an organization-configured, read-only route; retrieval does not itself write an approved note back to the EHR. ChatGPT for Healthcare documentation, checked October 7, 2026.

Worked example: a referral-drafting data flow

EX-CH-01 is a fictional clinic scenario. Follow the source, three configurations and release decisions below.

Supplied task, source and clinic policy

The clinic wants to draft a referral from a short encounter summary. The source says: “The patient reports an outside assessment. The report has not arrived. A referral was discussed, but no order has been placed and nothing has been sent.” No diagnosis, examination finding or treatment decision is supplied.

The example clinic’s policy permits synthetic internal drafting rehearsals. Patient-data release requires the ten-gate review below. External delivery requires a named, approved recipient and route. A clinician must review the draft before it enters the correct encounter; documentation of a proposed action must remain distinct from completing it.

The proposed flow has five steps:

1. A staff member selects the workspace and supplies the summary.
2. The model drafts referral text.
3. A clinician checks the draft against the source.
4. Staff place approved text in the receiving EHR encounter.
5. A separate external app sends the referral.

For the represented production workflow, the packet would contain patient-linked information. Calling the task “drafting” would not remove its PHI status. The PHI definition guide explains why unsigned notes, attachments and appointment context still require careful handling.

Three configurations, three different decisions

Configuration A: personal Plus account, training turned off. No applicable BAA is supplied. Decision: hold PHI at the input boundary. Training preferences cannot substitute for the missing service agreement. The fictional policy allows a new synthetic rehearsal, not the original patient-linked packet with its name removed.

Configuration B: eligible clinical workspace and applicable executed BAA; external app unapproved. The supplied inventory has no agreement, permission or approved recipient route for step five. Decision: hold external delivery. The OpenAI agreement does not settle that app’s status. Record the gap, disable the external step and assign privacy/health-IT review. Do not mark the whole referral “sent” because drafting succeeded.

Configuration C: synthetic-only internal rehearsal, external step disabled. The example draft reads: “Outside report unavailable. Referral discussed; order and delivery remain pending.” The reviewer compares it with the supplied source and rejects any wording saying the report was reviewed or the referral completed. Decision: approve the synthetic rehearsal; hold patient-data use for the completed review and authorization.

What a completed trace would need to show

A useful acceptance record names the workspace and feature configuration, records the source and draft version, documents the reviewer’s corrections, identifies the receiving encounter and checks its saved text. For the disabled delivery step, evidence should show no outbound invocation—not merely an absence of a success banner. Keep sensitive logs in the approved internal evidence store.

Suppose the saved EHR copy omits “order and delivery remain pending.” The text now loses the unfinished-work state even if its remaining sentences are accurate. The reviewer restores that sentence and rechecks the destination. Privacy approval and clinical documentation quality are different checks; both matter. See the clinical notes AI review guide for source-to-draft and draft-to-record comparisons.

Clinical-team compliance checklist

Use this clinical-team checklist to organize evidence. “Confirmed” means the responsible reviewer has supporting evidence for the stated requirement. “Gap” identifies a missing condition; “Not checked” means the requirement has not been assessed. Record the approval owner’s release decision and its scope.

CHATGPT CLINICAL-WORKFLOW REVIEW RECORD
Complete findings in the organization’s approved workspace; link evidence from the restricted internal repository.

Review date / reviewer roles: [fill in]
Use case / jurisdiction / organizational role: [fill in]
Service / workspace or API organization-project / configuration date: [fill in]
BAA reference / entity / effective date / covered scope: [fill in]
Inputs / output destination / other processors: [fill in]

CH-01 — Purpose and information
Owner: Privacy lead
Expected result: Document the task, PHI categories, authority and necessary inputs.
Evidence required: Approved data-flow map and use-case scope.
Worksheet status: Not checked
Actual finding / configuration and test date: [fill in]
Restricted evidence reference: [internal repository reference]
Remediation / responsible person / due date: [fill in]
Recheck finding / date: [fill in]

CH-02 — Service and workspace
Owner: Workspace administrator
Expected result: Identify the exact eligible service, workspace or API organization/project.
Evidence required: Workspace identifier, provisioning record and verification date.
Worksheet status: Not checked
Actual finding / configuration and test date: [fill in]
Restricted evidence reference: [internal repository reference]
Remediation / responsible person / due date: [fill in]
Recheck finding / date: [fill in]

CH-03 — Executed agreement
Owner: Authorized signatory
Expected result: Verify the applicable BAA is executed and covers the intended service.
Evidence required: Signed agreement reference, entity names, effective date and scope.
Worksheet status: Not checked
Actual finding / configuration and test date: [fill in]
Restricted evidence reference: [internal repository reference]
Remediation / responsible person / due date: [fill in]
Recheck finding / date: [fill in]

CH-04 — Features and destinations
Owner: Health-IT lead
Expected result: Check every enabled feature, app, outbound connection and recipient.
Evidence required: Current eligibility source and approved integration inventory.
Worksheet status: Not checked
Actual finding / configuration and test date: [fill in]
Restricted evidence reference: [internal repository reference]
Remediation / responsible person / due date: [fill in]
Recheck finding / date: [fill in]

CH-05 — Access and devices
Owner: Security lead
Expected result: Limit staff access, protect accounts/devices and test user removal.
Evidence required: Role test, authentication settings and offboarding result.
Worksheet status: Not checked
Actual finding / configuration and test date: [fill in]
Restricted evidence reference: [internal repository reference]
Remediation / responsible person / due date: [fill in]
Recheck finding / date: [fill in]

CH-06 — Copies and retention
Owner: Records/privacy lead
Expected result: Account for prompts, files, outputs, logs, backups and downloaded copies.
Evidence required: Configured retention, deletion limitations and records-access route.
Worksheet status: Not checked
Actual finding / configuration and test date: [fill in]
Restricted evidence reference: [internal repository reference]
Remediation / responsible person / due date: [fill in]
Recheck finding / date: [fill in]

CH-07 — Risk and incident process
Owner: Security/privacy leads
Expected result: Assess the workflow’s risks and rehearse reporting and containment.
Evidence required: Risk assessment reference, response contacts and rehearsal record.
Worksheet status: Not checked
Actual finding / configuration and test date: [fill in]
Restricted evidence reference: [internal repository reference]
Remediation / responsible person / due date: [fill in]
Recheck finding / date: [fill in]

CH-08 — Clinical record boundary
Owner: Clinical workflow owner
Expected result: Review generated text, verify patient/encounter and inspect the receiving record.
Evidence required: Synthetic draft-to-EHR acceptance test and approval responsibility.
Worksheet status: Not checked
Actual finding / configuration and test date: [fill in]
Restricted evidence reference: [internal repository reference]
Remediation / responsible person / due date: [fill in]
Recheck finding / date: [fill in]

CH-09 — Workforce instructions
Owner: Operations lead
Expected result: Teach workspace selection, prohibited sharing and support-ticket handling.
Evidence required: Approved procedure and completed staff training record.
Worksheet status: Not checked
Actual finding / configuration and test date: [fill in]
Restricted evidence reference: [internal repository reference]
Remediation / responsible person / due date: [fill in]
Recheck finding / date: [fill in]

CH-10 — Release and change control
Owner: Named approval owner
Expected result: Resolve gaps, authorize a bounded workflow and set a recheck trigger/date.
Evidence required: Recorded decision, conditions, owner and configuration baseline.
Worksheet status: Not checked
Actual finding / configuration and test date: [fill in]
Restricted evidence reference: [internal repository reference]
Remediation / responsible person / due date: [fill in]
Recheck finding / date: [fill in]

Release decision: [hold / limited approved use / other, with scope and rationale]
Unresolved work / restrictions: [fill in]
Approval owner / approval date: [fill in]
Next review date / change triggers: [fill in]
A checked count records worksheet progress; the organization makes the release decision.

EX-CH-01 — fictional completed requirement row
Requirement: CH-04 — Features and destinations
Owner: Health-IT lead
Expected result: Each recipient and connection has a documented approved route.
Evidence required: Feature eligibility source and integration inventory.
Configuration/test date: October 7, 2026; demo workflow; invented workspace CLINIC-DEMO.
Actual finding: A proposed referral uses an external app absent from the supplied approved inventory. No executed agreement or permitted disclosure route for that app has been supplied.
Status: Gap
Restricted evidence reference: DEMO-MAP-01; synthetic configuration only.
Remediation: Disable the external step; health-IT and privacy leads review the recipient and required terms.
Recheck: October 8 demo configuration lists the external step as disabled; no outbound invocation occurs in the fictional trace.
Decision: External delivery remains on hold. Synthetic internal drafting can be rehearsed under the supplied policy. PHI release requires the complete review.
Approval: Example approval owner retains the external-delivery hold.

The offline record includes expected results, evidence requirements, findings, remediation and approval. Its completed EX-CH-01 row shows a held external connection, a named owner and a recheck. Open “View a completed ten-gate review” for the full Configuration C API example: every gate has a finding, sample evidence reference and follow-up. The decision permits synthetic drafting only; the missing BAA/provisioning and unapproved external route remain explicit holds.

Before approving PHI use, reconcile the record with the risk assessment and contractual scope. A requirement marked confirmed without an evidence reference is unfinished documentation. Likewise, passing a synthetic note test says nothing about offboarding, incident handling or retention unless those controls were tested separately.

Define what triggers a new review: enabling a feature, changing a retention setting, adding an app, changing the receiving system, replacing an API project or changing the task’s information needs. Keep a baseline so reviewers can tell what changed rather than repeat a vague annual “AI approved” sign-off.

Retention, access and the receiving record

Build a copy inventory for the actual workflow: uploaded files, prompts, outputs, application state, logs, downloaded documents, clipboard contents and the final clinical record. Ask who can retrieve each copy, how long it remains, what deletion does and which person answers a records-access request. Review these obligations against the applicable service terms and the clinic’s records policy.

Do not equate not used for model training, short retention and Zero Data Retention. They address different questions. An API feature can have its own application-state behavior; consult the endpoint and tool table for the selected configuration. OpenAI API retention documentation, checked October 7, 2026.

Worked copy inventory: Configuration C API rehearsal

This fictional configuration extends EX-CH-01 with an API route. It uses GPT-4.1, POST /v1/responses, store: false, background: false, standard abuse monitoring and no conversations or tools. MAM and ZDR are not enabled. One synthetic source PDF is uploaded as user_data, with expires_after set to anchor: created_at, seconds: 3600. The approved scope is synthetic data only.

Vendor lifecycles: API data controls, prompt caching, file expiry and file deletion, checked October 7, 2026. Clinic timings and receipts are sample inputs for EX-CH-01. Flagged images can be retained for safety review even under MAM/ZDR.

At the rehearsal’s end, the example reviewer deletes the uploaded file and retains DEMO-DELETE-01. The receipt covers the uploaded file only; abuse logs, cache and clinic backups follow their separate schedules in DEMO-COPIES-01. A records-access request goes to the clinic’s records lead, who retrieves its source, draft and saved-copy evidence through approved access. The clinic retains its own review copies because stored Responses are disabled.

Access testing should include a user who is allowed to draft, a user who is not, and a departing staff member. Confirm that removing access affects the intended workspace and any connected systems. Inspect shared links, local exports and shared devices as separate surfaces rather than assuming workspace removal recalls every copy.

Select the information needed for the approved purpose. HHS’s minimum-necessary guidance includes exceptions, such as disclosures to or requests by healthcare providers for treatment. That exception does not itself approve an AI processing arrangement or eliminate other safeguards. HHS minimum-necessary guidance, checked October 7, 2026.

For rehearsals, newly created synthetic packets avoid starting with a real chart. If real information is to be de-identified, use an approved process: HIPAA recognizes Safe Harbor and Expert Determination, and removing a name alone is insufficient. Narrative details and attachments need review too. HHS de-identification guidance, checked October 7, 2026.

The final EHR entry remains a separate destination. Check identity, encounter, completeness and authentication after transfer. Record where corrections are made and whether an earlier generated version can overwrite them. A processor’s BAA does not prove that text landed in the right chart or that an order was executed. The medical records software guide develops records access, amendment and export checks.

If patient information went to the wrong place

Stop additional sharing and promptly use the clinic’s incident process. Record the service/workspace, time, information categories, intended and actual recipients, and any mitigation. Preserve evidence in an approved location; do not copy PHI into a general support ticket to explain the mistake.

The privacy team determines the required assessment and response. HHS explains that an impermissible use or disclosure is presumed a breach unless the applicable assessment establishes a low probability of compromise, considering the information, recipient, actual acquisition or viewing, and mitigation. Deleting a chat does not establish those facts. HHS breach notification guidance, checked October 7, 2026.

Separate the immediate staff reporting expectation from formal notification obligations. Staff should not wait for an outside notification deadline before escalating. Use the organization’s designated response contacts and preserve the record of who made the notification decision.

“Outside HIPAA” also does not mean “unprotected.” The FTC explains that its Health Breach Notification Rule covers specified personal-health-record vendors, related entities and service providers outside HIPAA, while Section 5 addresses unfair or deceptive practices. Applicability depends on the entity and activity; it is not automatic for every app. FTC health privacy guidance, checked October 7, 2026.

Canadian teams need a separate jurisdiction review

A U.S. BAA is not a Canadian privacy approval. Identify the governing federal or provincial framework and the organization’s role before assessing the information flow. Do not treat the U.S.-only individual Clinicians eligibility route as a Canadian access promise.

Canada’s privacy regulators’ generative-AI principles emphasize establishing legal authority for collection, use and disclosure, meaningful consent where it is the basis, safeguards and accountability. They also identify particular concerns for sensitive uses such as healthcare. The applicable law depends on the organization and activity. OPC generative-AI principles, checked October 7, 2026.

For a Canadian clinic, extend the review record with its jurisdiction, accountable privacy officer, processing locations, access arrangements, required patient information/consent approach and transfer assessment. Have the responsible reviewer resolve those facts instead of importing a U.S. checklist unchanged. The PHI guide’s Canadian section explains the different meanings and jurisdiction boundaries.

Make a bounded decision you can explain

An actionable conclusion names what is approved, for whom, in which configuration and with what information. “Approved for synthetic drafting rehearsal; PHI and external delivery held pending CH-03 and CH-04 evidence” is more useful than “ChatGPT is safe.” So is a production approval that identifies its contractual scope, allowed features, record destination and change triggers.

Keep the agreement, configuration record and workflow evidence together. Recheck live vendor documentation when functionality changes. Above all, preserve the distinction between an eligible service, an approved data flow and a clinically reviewed final record. None is a shortcut for the other two.

Evaluating Vero for clinical documentation? Review its security and privacy information alongside the documented note-creation workflow. Start with synthetic material, then document your organization’s approval of the terms, configuration and patient-data workflow.

Primary sources and verification date

The offering comparison links to the exact OpenAI documents used. Legal and regulator references appear beside the relevant claims. Sources checked October 7, 2026.