HIPAA, private data, and private models — the BAA is the floor, not the product

PHI (protected health information) is any individually identifiable health data held by a covered entity or its vendors — names + conditions, appointment reasons, insurance details, even an email address in a medical context. A BAA(Business Associate Agreement) is the contract HIPAA requires between a healthcare organization and any vendor that touches PHI on its behalf. No BAA, no PHI — full stop. A chatbot on a clinic’s website that lets a visitor type “can I book about my diabetes medication” is receiving PHI, which makes the chatbot vendor a business associate whether it planned to be or not.

The phrase vendors avoid saying out loud: there is no such thing as a “HIPAA-certified” AI model. HHS certifies nobody. “HIPAA-eligible” means the vendor will sign a BAA and has the technical safeguards to back it; compliance is a property of the whole deployment — contracts + encryption + access control + audit trail + workforce process — never of a model.

The cleanest way to use a frontier model on PHI is through a cloud platform whose BAA covers the model service, because the data never reaches the model lab at all:

AWS Bedrock — HIPAA-eligible under the standard AWS BAA with no model exclusions. Claude, Llama, Mistral and the rest run inside AWS infrastructure; Anthropic is a sub-processor that cannot see inputs or outputs. Prompts are not stored or used for training. For a team already on AWS, this is one checkbox in an account that likely already has a BAA — which is why “the AWS service” is the default answer when a healthcare client asks about private model access.

Google Vertex AI— on Google Cloud’s HIPAA-eligible services list; Gemini models called through Vertex are covered under the GCP BAA. This is exactly the arrangement Jotform discloses for its HIPAA accounts (“we utilize Google’s Gemini Models via Vertex AI”) — a useful proof that a chatbot platformcan inherit compliance by routing its HIPAA tier through a covered cloud path rather than the model lab’s consumer API.

Azure OpenAI— GPT-family access under Microsoft’s BAA, with Azure identity, networking and logging around it. Strongest when the organization’s security review already runs through Microsoft.

The labs now sign their own BAAs, with sharper edges than the cloud paths:

Anthropic — offers a BAA for the Claude API and (since December 2025) HIPAA-ready Enterprise plans under one agreement. The coverage is feature-scoped: as of mid-2026 the Messages API, prompt caching, structured outputs, memory, and web search are covered; the Batch API, Files API, code execution, and computer use explicitly are not. Covered Models require 30-day retention — they aren’t available under zero-data-retention — while some products (Claude Code) are covered only with ZDR enabled. Translation: read the covered-features list per product, every time; the BAA is a map with holes, not a blanket.

OpenAI — a BAA path for the API using zero-retention-eligible endpoints, plus a ChatGPT for Healthcare workspace (2026). Consumer ChatGPT and standard team workspaces remain uncovered — the most common HIPAA violation in the wild is still a clinician pasting a chart into a free chat tab.

The pattern across both: BAAs are sales-assisted, feature-scoped, and retention-nuanced. The hyperscaler path is broader and blunter; the direct path gets newer features sooner but demands you track a coverage matrix.

The third path removes the model vendor entirely: run an open-weights model (Llama 4, Qwen 3.5, Mistral Large 3, Gemma 4) on infrastructure you control. No BAA with a model provider is needed because there is no model provider — PHI never leaves your boundary. This is the most defensible architecture for PHI-in-the-prompt workloads, and by 2026 the open models are good enough for intake-and-answer chatbot work.

The honest caveats come from our own self-hosting reality check: you inherit the serving problem (concurrency, uptime, upgrades), and renting a GPU instead of owning it puts the BAA obligation right back — the GPU landlord can physically access the machine, so they become your business associate. A VPC-isolated deployment on a cloud you already have a BAA with (private Bedrock throughput, a vLLM box inside a covered AWS account) is usually the pragmatic middle: self-hosted control, hyperscaler paperwork.

The model path is maybe a third of the work. A chatbot that receives PHI also needs, per the Security Rule’s technical safeguards: TLS 1.2+ in transit and AES-256 at rest for every stored transcript; role-based access control and MFA on every admin surface; audit logging of every PHI access (45 CFR § 164.312(b) — recording and examining activity in systems containing ePHI); data-retention controls the customer can set; and a breach-notification process. Plus the administrative layer — risk assessments, workforce training, incident response — which no vendor can sell you.

And the chain rule: a BAA must cover everysubprocessor that touches the data. A chatbot platform’s BAA is only as good as its own BAAs with its database host, its model provider, its logging pipeline. One uncovered analytics script in the widget breaks the chain.

A signed BAA covers the vendor’s side of the ledger. It does not stop a staff member pasting a patient record into an uncovered tool; it does not redact PHI inside an uploaded PDF; it does not produce the audit evidence an auditor asks for; and it does not make model output clinically safe — a grounded chatbot that abstains when it doesn’t know matters more in a medical context than anywhere else. Compliance is the entry ticket; answer quality is still the product.

Already on AWS/GCP/Azure?Use that cloud’s model service under the BAA you likely already have — Bedrock for Claude, Vertex for Gemini, Azure for GPT. Need the newest lab features first? Direct BAA with the lab, and track the covered-features matrix. PHI must never leave your boundary? Open-weights in your own VPC or on owned hardware. Buying a chatbot platform? Ask three questions: who signs the BAA, which model path serves the HIPAA tier, and where do transcripts live — and ask for the subprocessor list. A vendor that answers all three in writing is real; one that answers with a logo wall is not.