Short answer: not with standard consumer or small business plans. Patient information should only go into an AI tool when the vendor has signed a business associate agreement and the tool is configured for it. OpenAI offers BAAs for its API and for sales-managed ChatGPT Enterprise and Edu accounts, and says it does not offer one for ChatGPT Business.
01
When staff paste a patient note, an X-ray report or an insurance letter into an AI tool without a BAA, that can be an impermissible disclosure of PHI. It is one of the fastest-growing risks we see in practices, often called shadow AI.
02
FAQ
It depends on the plan and agreement. OpenAI offers BAAs for its API and for sales-managed ChatGPT Enterprise and Edu accounts. It states it does not offer a BAA for ChatGPT Business, and standard consumer plans should not be used with PHI.
Yes, if the vendor signs a BAA, meets your security requirements and is included in your risk analysis.
Approved tools, what data may never be entered, who approves new tools, and training for every staff member.
Sources: OpenAI: BAA for the API and ChatGPT. This page is general information as of November 2026, not legal advice.
Our AI risk and policy service helps practices use AI without new HIPAA risk.
