HIPAA BAA for AI Vendors: Which AI Tools Sign a BAA?

By BAA Generator Editorial  ·  Published Apr 20, 2026  ·  Last reviewed Apr 20, 2026  ·  8 min read

Healthcare organizations are adopting AI faster than their compliance programs can keep up. Clinical documentation assistants, diagnostic support tools, patient communication bots, and revenue cycle automation all touch protected health information — often without a BAA in place. This guide covers every major AI vendor category, their BAA status by plan tier, and the specific conditions that trigger the obligation.

Does an AI Tool Need a HIPAA BAA?

An AI tool needs a BAA if it qualifies as a business associate. Under 45 CFR § 160.103, a business associate is any entity that, on behalf of a covered entity, creates, receives, maintains, or transmits PHI. The analysis is function-based, not technology-based — the fact that a tool uses machine learning is irrelevant. What matters is whether PHI flows through it.

Three categories of AI tools routinely trigger the BAA requirement in healthcare settings:

• Foundation model APIs — When you send patient notes, lab results, or clinical records to an LLM API for summarization, coding, or analysis, that vendor processes PHI and needs a BAA.
• Observability and monitoring tools — Error logs, distributed traces, and session recordings in health apps frequently contain PHI. A stack trace that includes a patient ID or a session replay that captures a diagnosis field makes the observability vendor a business associate.
• Product analytics platforms — Event tracking in a patient portal or EHR records user actions that may directly or indirectly identify patients. Analytics vendors that ingest those events are BAs.

The conduit exception at 45 CFR § 164.502(e)(1)(ii)(C) exempts vendors that only transmit PHI without accessing it — like a telecom carrier routing an encrypted HTTPS connection. AI vendors that process, store, or analyze data do not qualify for this exception.

AI Vendor BAA Status by Category

Foundation Model Providers (LLMs)

Developer Tools and Infrastructure

Analytics and Observability Platforms

Why Consumer AI Plans Are Never HIPAA-Eligible

Consumer-tier subscriptions (ChatGPT Free, ChatGPT Plus, Claude.ai Pro, Gemini.google.com) explicitly exclude healthcare use in their terms of service and do not offer BAAs. The practical reasons are structural: these plans share infrastructure across millions of users, have no enterprise controls for data isolation, and operate under consumer privacy policies rather than HIPAA-aligned data processing terms.

Switching from the free web interface to the API changes the risk profile: API calls operate under separate enterprise terms, data is not used for training by default (depending on agreement), and the vendor will execute a BAA. The technical experience feels the same; the contractual and compliance posture is entirely different.

If your organization's staff are using consumer ChatGPT or Claude.ai to process patient notes or records — even internally — that is a HIPAA violation regardless of any internal policy or acknowledgment screen.

Observability Tools: The Overlooked BAA Gap

Error monitoring and APM tools are the most commonly missed BAA in healthtech organizations. In a standard web application, a Sentry error event might capture:

• The URL at the time of the error (which may contain a patient ID: /patients/12345/chart)
• Request parameters passed to an API (which may contain PHI in JSON body fields)
• Local variables in a stack trace (which may include an in-memory patient object)

None of this is intentional — it is the default behavior of error monitoring SDKs. The PHI exposure is often invisible until an OCR audit uncovers it. Sentry, Datadog, and similar tools offer data scrubbing configurations that can reduce PHI exposure, but these configurations do not eliminate the BAA requirement: if PHI has ever flowed through the tool, the vendor is a business associate.

What to Do When an AI Vendor Won't Sign a BAA

If an AI vendor will not sign a BAA, you have three options:

1. Present your own BAA template. Vendors who don't proactively offer a BAA will often sign one you provide. Use a BAA structured around 45 CFR § 164.504(e) — generate one at BAA Generator for $49 and send it to the vendor's legal or compliance team.
2. De-identify data before sending. Under 45 CFR § 164.514(b), properly de-identified data is no longer PHI and does not trigger the BAA requirement. This is technically feasible for some AI use cases (removing the 18 HIPAA identifiers before sending to a summarization API) but difficult for others (clinical documentation where patient context is essential).
3. Switch to a HIPAA-eligible alternative. For every major AI vendor category, a HIPAA-eligible alternative exists. The table above identifies qualifying plans and alternatives in each category.

There is no fourth option. Using an AI vendor that processes PHI without a signed BAA is a direct HIPAA violation — not a gray area, and not fixed retroactively by de-identifying data after the fact.

How to Generate a BAA for Your AI Vendor

If your AI vendor will sign a BAA but expects you to provide the document, BAA Generator produces a HIPAA-compliant agreement in under 5 minutes:

1. Enter your organization's details as the Covered Entity (or Business Associate, if you are a healthtech company)
2. Enter the AI vendor's details as the Business Associate
3. Describe the services and the PHI types involved (e.g., "AI-assisted clinical note summarization" / "patient names, DOBs, diagnoses")
4. Download the free sample-data preview to review, or pay $49 for the clean PDF + Word (.docx) with your actual party information to execute
5. Route through DocuSign, Adobe Sign, or any e-signature platform — electronic signatures are valid under ESIGN and UETA

Frequently Asked Questions

Do AI tools need a HIPAA BAA?

Yes — if an AI tool creates, receives, maintains, or transmits PHI on behalf of a covered entity, it is a business associate and a BAA is required under 45 CFR § 164.504(e). This applies to LLM APIs, analytics tools, error monitoring services, and observability platforms when healthcare app data contains PHI.

Does OpenAI sign a HIPAA BAA?

Yes — for API customers (via the Privacy Addendum) and ChatGPT Enterprise. ChatGPT Free, Plus, and Team plans are not eligible. See the full OpenAI HIPAA BAA guide.

Does Anthropic sign a HIPAA BAA?

Yes — for Claude Enterprise and qualifying API customers with a Data Processing Addendum. Claude.ai Free, Pro, and Team plans are not HIPAA eligible. See the full Anthropic HIPAA BAA guide.

Can I use Google Gemini or Vertex AI with PHI?

Google Cloud (Vertex AI, Healthcare AI APIs) signs a HIPAA BAA for all commercial GCP accounts via self-service in the GCP Console. Consumer Gemini at gemini.google.com is not HIPAA eligible. See the full Google Cloud HIPAA BAA guide.

Do observability tools like Sentry or Datadog need a HIPAA BAA?

Yes, if your error logs or traces contain PHI. In healthcare apps, stack traces and API logs frequently capture patient identifiers. Sentry requires Business or Enterprise plan; Datadog requires Enterprise. See Sentry and Datadog guides.

What if my AI vendor won't sign a HIPAA BAA?

You must either present your own BAA template for them to sign, de-identify data before sending, or switch to a HIPAA-eligible alternative. You cannot route PHI through a vendor without a signed BAA — there is no compliant workaround. See the full guide on what to do when a vendor won't sign a BAA.