OpenAI API: HIPAA status
OpenAI's models for developers building their own applications. A BAA is available on request, limited to endpoints eligible for zero data retention.
Signs a BAAConditional
OpenAI API signs a Business Associate Agreement only under specific conditions. Available on request for API use limited to zero-data-retention-eligible endpoints.
Source: OpenAI Help Center — How can I get a BAA with OpenAI? · checked
OpenAI API and HIPAA at a glance
OpenAI API signs a Business Associate Agreement only under specific conditions. A BAA alone does not make its use HIPAA compliant: you still need to request the BAA and use only endpoints eligible for zero data retention. Facts checked against OpenAI's own documentation on 2026-10-06.
| Signs a BAA | Only under conditions |
|---|---|
| How you get it | Available on request for API use limited to zero-data-retention-eligible endpoints. |
| You still need to | Request the BAA and use only endpoints eligible for zero data retention. |
| Main limitation | Endpoints that store application state are outside BAA coverage. |
| Last checked | 2026-10-06 |
BAA details
| Signs a BAA | Conditional | OpenAI Help Center — How can I get a BAA with OpenAI? |
|---|
What you still have to configure
- Request the BAA and use only endpoints eligible for zero data retention. source
Limitations
- Endpoints that store application state are outside BAA coverage. source
Against our criteria
| BAA without a sales process | No — BAA must be requested and approved. | OpenAI Help Center — How can I get a BAA with OpenAI? |
|---|---|---|
| Covers a ready-to-use chat app | No — API only — you build the application. | OpenAI Help Center — How can I get a BAA with OpenAI? |