Claude (Anthropic): HIPAA status
Anthropic's Claude models and apps. Anthropic signs a BAA covering its HIPAA-ready services, including the API and Enterprise plans with HIPAA compliance activated.
Claude (Anthropic) signs a Business Associate Agreement only under specific conditions. Covers HIPAA-ready services: Claude Enterprise with HIPAA compliance activated, the first-party API, Claude in Microsoft Foundry, and Claude Code / Cowork in local mode with HIPAA configuration.
Source: Anthropic — Business Associate Agreements for commercial customers · checked
Claude (Anthropic) and HIPAA at a glance
Claude (Anthropic) signs a Business Associate Agreement only under specific conditions. A BAA alone does not make its use HIPAA compliant: you still need to enterprise: the Primary Owner activates HIPAA compliance in organization settings and accepts the BAA, and API: the Primary Owner signs the BAA, then contacts Anthropic to enable it. Facts checked against Anthropic's own documentation on 2026-10-06.
| Signs a BAA | Only under conditions |
|---|---|
| Plans with a BAA | Claude Enterprise (HIPAA activated), Anthropic API, Claude in Microsoft Foundry |
| How you get it | Covers HIPAA-ready services: Claude Enterprise with HIPAA compliance activated, the first-party API, Claude in Microsoft Foundry, and Claude Code / Cowork in local mode with HIPAA configuration. |
| You still need to | Enterprise: the Primary Owner activates HIPAA compliance in organization settings and accepts the BAA. |
| Main limitation | Covered models require 30-day data retention; zero data retention is not available unless Anthropic expressly authorizes it. |
| Last checked | 2026-10-06 |
BAA details
| Signs a BAA | Conditional | Anthropic — Business Associate Agreements for commercial customers |
|---|---|---|
| Plans that include a BAA | Claude Enterprise (HIPAA activated), Anthropic API, Claude in Microsoft Foundry | Anthropic — Business Associate Agreements for commercial customers |
What you still have to configure
- Enterprise: the Primary Owner activates HIPAA compliance in organization settings and accepts the BAA. source
- API: the Primary Owner signs the BAA, then contacts Anthropic to enable it. source
Limitations
- Covered models require 30-day data retention; zero data retention is not available unless Anthropic expressly authorizes it. source
- Claude Console, cloud-based Cowork and beta features such as Claude Design and Claude Slides are excluded. source
- The BAA covers only the single organization that accepted it. source
Against our criteria
| BAA without a sales process | Partial — Enterprise customers accept it in settings; API access is enabled through Anthropic. | Anthropic — Business Associate Agreements for commercial customers |
|---|---|---|
| Covers a ready-to-use chat app | Yes — Claude Enterprise with HIPAA compliance activated. | Anthropic — Business Associate Agreements for commercial customers |