Updates
Only changes that alter our data or recommendations. Each update links to the pages it changed.
- OpenAI API: eligible organizations can now accept a BAA themselves →Vendor change · 2026-10-05On October 5, 2026, OpenAI added an in-product flow in API Organization settings > General: admins of eligible organizations can accept the standard Business Associate Agreement and enable HIPAA compliance support without going through sales. OpenAI's current list of BAA-eligible ChatGPT services names ChatGPT for Healthcare, Enterprise with the Regulated Workspace, FedRAMP and ChatGPT for Clinicians.
- HHS releases Security Risk Assessment Tool version 3.7 →Regulation · 2026-09-18HHS (ASTP/ONC with OCR) released version 3.7 of its free Security Risk Assessment Tool for small and medium practices, as a Windows application and an Excel workbook. It adds a question on assessment scope across every location handling ePHI and one on remote access and telework.
- OpenAI's BAA now covers ChatGPT for Healthcare and for Clinicians →Vendor change · 2026-07-09OpenAI's HIPAA implementation guide, posted July 9, 2026, lists ChatGPT for Healthcare, ChatGPT for Clinicians and Enterprise or Edu workspaces with the Regulated Workspace as BAA-eligible. Consumer plans (Free, Plus, Pro) and ChatGPT Business are not. API use with PHI requires a Modified Retention setting for each organization and project.
- OCR launches civil enforcement of 42 CFR Part 2 →Enforcement · 2026-02-13On February 13, 2026, ahead of the February 16, 2026 compliance date of the 2024 Part 2 final rule, HHS's Office for Civil Rights announced its civil enforcement program for the confidentiality of substance use disorder patient records. Part 2 breaches now follow HIPAA's breach notification requirements.
- Google's HIPAA list includes the Gemini app and Gemini in Workspace →Vendor change · 2025-08-31Google's list of Workspace services covered by its HIPAA BAA, last updated August 31, 2025 and checked on October 14, 2026, covers the Gemini app (excluding Gemini in Chrome), the Gemini Mac app and Gemini in Workspace for customers who have accepted Google's HIPAA BAA.