aws.amazon.com/bedrock

`Claude is not HIPAA compliant by default` . It can only be used in a HIPAA-compliant manner through Anthropic’s [HIPAA-ready Enterprise plans](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) or the Claude API, and only after the organization signs a Business Associate Agreement (BAA) and correctly configures the workspace. Consumer and standard team tiers do not support HIPAA compliance.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) [[1]](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans)[[2]](https://www.hipaavault.com/resources/is-claude-hipaa-compliant/)[[3]](https://www.strac.io/blog/is-claude-hipaa-compliant)[[4]](https://bastiongpt.com/post/is-claude-hipaa-compliant) Plans and Features Status - **Free, Pro, Max, and Team Plans:** Not compliant; Anthropic will not sign a BAA for these tiers, and data may be used in training or standard retention loops.[](https://bastiongpt.com/post/is-claude-hipaa-compliant) - **Enterprise Plans:** Compliant only if the Primary Owner explicitly enables the HIPAA setting in organization configurations and executes a formal BAA.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) - **Claude API / Cloud Hosts:** Compliant if utilizing the Messages API under an executed BAA , or when deploying Claude via enterprise cloud services like [Amazon Bedrock](https://aws.amazon.com/bedrock/) or Google Vertex AI under the respective cloud provider's BAA.[](https://www.strac.io/blog/is-claude-hipaa-compliant) [[1]](https://ibl.ai/blog/is-claude-hipaa-compliant-2026) - **Excluded Tools:** Features like Cowork, Claude Code (without Zero Data Retention enabled), and certain developer console tools are frequently excluded from standard BAA coverage.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) If you want, let me know: - Are you planning to use **Claude Enterprise** or the **Claude API**? - Will you be processing **patient records or protected health info (PHI)** directly? I can help you review the setup steps or security requirements. Claude is not HIPAA compliant by default. It can only be used in a HIPAA-compliant manner through Anthropic’s HIPAA-ready Enterprise plans or the Claude API, and only after the organization signs a Business Associate Agreement (BAA) and correctly configures the workspace. Consumer and standard team tiers do not support HIPAA compliance. HIPAA-ready Enterprise plans. ... This feature is available for Enterprise plans only (both self-serve and sales-assisted). We off... Is Claude HIPAA Compliant? A Healthcare AI Compliance Breakdown * Is Claude HIPAA compliant? * Claude AI is not HIPAA compliant by... * Claude can be used in a HIPAA-compliant way — but only on specific Anthropic products, only under a signed Business Associate Ag... Is Claude HIPAA Compliant? (2026 Guide) * The short answer: Claude is not HIPAA compliant by default. ‍Anthropic offers a path to ... Free, Pro, Max, and Team Plans: Not compliant; Anthropic will not sign a BAA for these tiers, and data may be used in training or standard retention loops. Enterprise Plans: Compliant only if the Primary Owner explicitly enables the HIPAA setting in organization configurations and executes a formal BAA. Claude API / Cloud Hosts: Compliant if utilizing the Messages API under an executed BAA, or when deploying Claude via enterprise cloud services like Amazon Bedrock or Google Vertex AI under the respective cloud provider's BAA. Excluded Tools: Features like Cowork, Claude Code (without Zero Data Retention enabled), and certain developer console tools are frequently excluded from standard BAA coverage. - **Free, Pro, Max, and Team Plans:** Not compliant; Anthropic will not sign a BAA for these tiers, and data may be used in training or standard retention loops.[](https://bastiongpt.com/post/is-claude-hipaa-compliant) - **Enterprise Plans:** Compliant only if the Primary Owner explicitly enables the HIPAA setting in organization configurations and executes a formal BAA.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) - **Claude API / Cloud Hosts:** Compliant if utilizing the Messages API under an executed BAA , or when deploying Claude via enterprise cloud services like [Amazon Bedrock](https://aws.amazon.com/bedrock/) or Google Vertex AI under the respective cloud provider's BAA.[](https://www.strac.io/blog/is-claude-hipaa-compliant) [[1]](https://ibl.ai/blog/is-claude-hipaa-compliant-2026) - **Excluded Tools:** Features like Cowork, Claude Code (without Zero Data Retention enabled), and certain developer console tools are frequently excluded from standard BAA coverage.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) The Direct Answer. Claude — Anthropic's model family — is not HIPAA compliant out of the box. Claude usage can be made HIPAA-align... If you want, let me know:Are you planning to use Claude Enterprise or the Claude API ? Will you be processing patient records or protected health info (PHI) directly? I can help you review the setup steps or security requirements. If you want, let me know: - Are you planning to use **Claude Enterprise** or the **Claude API**? - Will you be processing **patient records or protected health info (PHI)** directly? I can help you review the setup steps or security requirements.

`Claude is not HIPAA compliant by default` . Anthropic offers a HIPAA-ready Enterprise plan and API access that support compliance, but the primary account owner must actively sign a Business Associate Agreement (BAA) and configure workspace settings correctly. Consumer and lower-tier plans (Free, Pro, Max, and Team) do not offer a BAA and cannot be used for protected health information (PHI).[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) [[1]](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans)[[2]](https://www.hipaavault.com/resources/is-claude-hipaa-compliant/)[[3]](https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers)[[4]](https://bastiongpt.com/post/is-claude-hipaa-compliant) Compliance Status by Plan - **Free, Pro, Max, and Team Plans:** Not compliant; no BAA is available, and data may be retained or used according to standard consumer privacy terms.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) - **Claude Enterprise:** HIPAA-ready only after the primary organization owner signs Anthropic's BAA and toggles HIPAA compliance on in the organization settings.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) - **Claude API:** Available under a signed BAA for qualifying commercial accounts, though specific features (like Workbench, Console, or certain beta tools) may be excluded.[](https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers) [[1]](https://www.hathr.ai/blogs/is-claude-console-hipaa-compliant) - **Cloud Hyperscalers:** Claude accessed via [Amazon Bedrock](https://aws.amazon.com/bedrock/) or Google Cloud Vertex AI can be covered under the respective hyperscaler's BAA while running inside your secure cloud perimeter.[](https://www.strac.io/blog/is-claude-hipaa-compliant) [[1]](https://www.strac.io/blog/is-claude-hipaa-compliant)[[2]](https://ibl.ai/blog/is-claude-hipaa-compliant-2026) Requirements for HIPAA Deployment - **Signed BAA:** Must be executed directly with Anthropic or your cloud provider before processing any PHI.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) - **Feature Restrictions:** Administrators must restrict users to BAA-covered features and disable non-compliant tools or unverified integrations.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) - **Data Safeguards:** Implement proper access controls, single sign-on (SSO), and internal data governance (such as avoiding unapproved data retention or browser data leakage).[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) [[1]](https://www.accountablehq.com/post/is-claude-hipaa-compliant-what-you-need-to-know-for-phi) If you'd like to proceed, let me know: - Are you planning to use **Claude Enterprise** on the web or integrate via the **Claude API** / **AWS Bedrock**? - Do you need help verifying which specific features are covered under Anthropic's current BAA implementation guide? Claude is not HIPAA compliant by default. Anthropic offers a HIPAA-ready Enterprise plan and API access that support compliance, but the primary account owner must actively sign a Business Associate Agreement (BAA) and configure workspace settings correctly. Consumer and lower-tier plans (Free, Pro, Max, and Team) do not offer a BAA and cannot be used for protected health information (PHI). HIPAA-ready Enterprise plans. ... This feature is available for Enterprise plans only (both self-serve and sales-assisted). We off... Is Claude HIPAA Compliant? A Healthcare AI Compliance Breakdown * Is Claude HIPAA compliant? * Claude AI is not HIPAA compliant by... Business Associate Agreements (BAA) for Commercial Customers * This article is about our commercial products such as Claude for Wo... Is Claude HIPAA Compliant? (2026 Guide) * The short answer: Claude is not HIPAA compliant by default. ‍Anthropic offers a limited ... Free, Pro, Max, and Team Plans: Not compliant; no BAA is available, and data may be retained or used according to standard consumer privacy terms. Claude Enterprise: HIPAA-ready only after the primary organization owner signs Anthropic's BAA and toggles HIPAA compliance on in the organization settings. Claude API: Available under a signed BAA for qualifying commercial accounts, though specific features (like Workbench, Console, or certain beta tools) may be excluded. Cloud Hyperscalers: Claude accessed via Amazon Bedrock or Google Cloud Vertex AI can be covered under the respective hyperscaler's BAA while running inside your secure cloud perimeter. - **Free, Pro, Max, and Team Plans:** Not compliant; no BAA is available, and data may be retained or used according to standard consumer privacy terms.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) - **Claude Enterprise:** HIPAA-ready only after the primary organization owner signs Anthropic's BAA and toggles HIPAA compliance on in the organization settings.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) - **Claude API:** Available under a signed BAA for qualifying commercial accounts, though specific features (like Workbench, Console, or certain beta tools) may be excluded.[](https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers) [[1]](https://www.hathr.ai/blogs/is-claude-console-hipaa-compliant) - **Cloud Hyperscalers:** Claude accessed via [Amazon Bedrock](https://aws.amazon.com/bedrock/) or Google Cloud Vertex AI can be covered under the respective hyperscaler's BAA while running inside your secure cloud perimeter.[](https://www.strac.io/blog/is-claude-hipaa-compliant) [[1]](https://www.strac.io/blog/is-claude-hipaa-compliant)[[2]](https://ibl.ai/blog/is-claude-hipaa-compliant-2026) Does signing a BAA with Anthropic make Claude Console HIPAA compliant? No. This is the most common misconception. A BAA covers spe... ✨ Is Claude HIPAA Compliant? The Direct Answer. * Claude can be used in a HIPAA-compliant way — but only on specific Anthropic pro... The Direct Answer. Claude — Anthropic's model family — is not HIPAA compliant out of the box. Claude usage can be made HIPAA-align... Signed BAA: Must be executed directly with Anthropic or your cloud provider before processing any PHI. Feature Restrictions: Administrators must restrict users to BAA-covered features and disable non-compliant tools or unverified integrations. Data Safeguards: Implement proper access controls, single sign-on (SSO), and internal data governance (such as avoiding unapproved data retention or browser data leakage). - **Signed BAA:** Must be executed directly with Anthropic or your cloud provider before processing any PHI.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) - **Feature Restrictions:** Administrators must restrict users to BAA-covered features and disable non-compliant tools or unverified integrations.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) - **Data Safeguards:** Implement proper access controls, single sign-on (SSO), and internal data governance (such as avoiding unapproved data retention or browser data leakage).[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) [[1]](https://www.accountablehq.com/post/is-claude-hipaa-compliant-what-you-need-to-know-for-phi) Claude's Standard Version Limitations Consumer or team-oriented versions of AI chat products are designed for broad use, not regul... If you'd like to proceed, let me know:Are you planning to use Claude Enterprise on the web or integrate via the Claude API / AWS Bedrock ? Do you need help verifying which specific features are covered under Anthropic's current BAA implementation guide? If you'd like to proceed, let me know: - Are you planning to use **Claude Enterprise** on the web or integrate via the **Claude API** / **AWS Bedrock**? - Do you need help verifying which specific features are covered under Anthropic's current BAA implementation guide?

For ~2TB of data, daily FHIR syncs, and full PHI safety, `turnkey stacks` require combining HIPAA-eligible cloud storage, automated de-identification layers, and native access controls. Top providers include [AWS HealthLake](https://aws.amazon.com/healthlake/) + [Amazon Bedrock](https://aws.amazon.com/bedrock/), [Google Cloud Healthcare API](https://cloud.google.com/healthcare-api) + [Vertex AI](https://cloud.google.com/vertex-ai), Snowflake + [Protecto AI](https://www.protecto.ai/), [Databricks](https://www.databricks.com/) + [John Snow Labs](https://www.johnsnowlabs.com/) , and [AvoMD/Compositional stacks](https://www.avomd.io/).Provider Comparison| Provider & Stack | Deployment Model | HIPAA / SOC 2 Evidence | Est. Monthly Cost (2TB + Daily FHIR) | |---|---|---|---| | **AWS HealthLake + Glue + S3** | Cloud Native (AWS) | BAA available; SOC 2 Type II; AES-256 at rest, TLS 1.3 in transit. | $2,200 – $3,800 | | **GCP Healthcare API + BigQuery** | Cloud Native (GCP) | BAA available; SOC 2 Type II; HITRUST CSF certified; customer-managed encryption keys. | $1,900 – $3,200 | | **Snowflake + Protecto AI** | Cloud / SaaS Hybrid | BAA available; SOC 2 Type II; automated Safe Harbor tokenization. | $2,800 – $4,500 | | **Databricks + John Snow Labs** | Cloud / Multi-Cloud | BAA available; SOC 2 Type II; NLP-driven PHI masking and audit frameworks. | $3,500 – $5,800 | Key Architectural Safeguards - **Encryption & Access:** All platforms enforce AES-256 encryption at rest, TLS 1.2+ in transit, and granular role-based access control (RBAC) mapped to the minimum necessary standard.[](https://www.knowi.com/blog/hipaa-compliant-data-integration-pipeline/) [[1]](https://www.knowi.com/blog/hipaa-compliant-data-integration-pipeline/)[[2]](https://www.knowi.com/blog/what-is-hipaa-compliant-analytics/)[[3]](https://www.leadreceipt.com/blog/hipaa-compliant-data-integration-tools-for-healthcare-complete-guide) - **De-identification:** Integrated tools process incoming JSON/FHIR streams to automatically redact or tokenize the 18 HIPAA Safe Harbor identifiers prior to analytics exposure.[](https://www.datastealth.io/blogs/hipaa-data-masking-best-practices/) [[1]](https://www.datastealth.io/blogs/hipaa-data-masking-best-practices/)[[2]](https://www.protecto.ai/solutions/phi-de-identification-for-data-lakes/)[[3]](https://dataengineeringcompanies.com/healthcare-data-engineering/)[[4]](https://privacyscrubber.com/compliance/hipaa/?srsltid=AfmBOorpPCH8tt1WhIQ83pEhc2rEQqXwWKHnNBZR6wxmKWPW_vXobppb) - **Audit Trails:** Immutable, centralized logging captures timestamped actor and resource access events for compliance validation.[](https://www.knowi.com/blog/hipaa-compliant-data-integration-pipeline/) [[1]](https://www.johnsnowlabs.com/hipaa-compliant-human-in-the-loop-de-identification-in-generative-ai-lab/) If you share your **preferred primary cloud environment (AWS, GCP, or Azure)** and **whether you need custom NLP de-identification for clinical notes** , I can tailor the exact pipeline architecture and tooling recommendation for your team. For ~2TB of data, daily FHIR syncs, and full PHI safety, turnkey stacks require combining HIPAA-eligible cloud storage, automated de-identification layers, and native access controls. Top providers include AWS HealthLake + Amazon Bedrock, Google Cloud Healthcare API + Vertex AI, Snowflake + Protecto AI, Databricks + John Snow Labs, and AvoMD/Compositional stacks. Provider & Stack Deployment Model HIPAA / SOC 2 Evidence Est. Monthly Cost (2TB + Daily FHIR) AWS HealthLake + Glue + S3 Cloud Native (AWS) BAA available; SOC 2 Type II; AES-256 at rest, TLS 1.3 in transit. $2,200 – $3,800 GCP Healthcare API + BigQuery Cloud Native (GCP) BAA available; SOC 2 Type II; HITRUST CSF certified; customer-managed encryption keys. $1,900 – $3,200 Snowflake + Protecto AI Cloud / SaaS Hybrid BAA available; SOC 2 Type II; automated Safe Harbor tokenization. $2,800 – $4,500 Databricks + John Snow Labs Cloud / Multi-Cloud BAA available; SOC 2 Type II; NLP-driven PHI masking and audit frameworks. $3,500 – $5,800 | Provider & Stack | Deployment Model | HIPAA / SOC 2 Evidence | Est. Monthly Cost (2TB + Daily FHIR) | |---|---|---|---| | **AWS HealthLake + Glue + S3** | Cloud Native (AWS) | BAA available; SOC 2 Type II; AES-256 at rest, TLS 1.3 in transit. | $2,200 – $3,800 | | **GCP Healthcare API + BigQuery** | Cloud Native (GCP) | BAA available; SOC 2 Type II; HITRUST CSF certified; customer-managed encryption keys. | $1,900 – $3,200 | | **Snowflake + Protecto AI** | Cloud / SaaS Hybrid | BAA available; SOC 2 Type II; automated Safe Harbor tokenization. | $2,800 – $4,500 | | **Databricks + John Snow Labs** | Cloud / Multi-Cloud | BAA available; SOC 2 Type II; NLP-driven PHI masking and audit frameworks. | $3,500 – $5,800 | Encryption & Access: All platforms enforce AES-256 encryption at rest, TLS 1.2+ in transit, and granular role-based access control (RBAC) mapped to the minimum necessary standard. De-identification: Integrated tools process incoming JSON/FHIR streams to automatically redact or tokenize the 18 HIPAA Safe Harbor identifiers prior to analytics exposure. Audit Trails: Immutable, centralized logging captures timestamped actor and resource access events for compliance validation. - **Encryption & Access:** All platforms enforce AES-256 encryption at rest, TLS 1.2+ in transit, and granular role-based access control (RBAC) mapped to the minimum necessary standard.[](https://www.knowi.com/blog/hipaa-compliant-data-integration-pipeline/) [[1]](https://www.knowi.com/blog/hipaa-compliant-data-integration-pipeline/)[[2]](https://www.knowi.com/blog/what-is-hipaa-compliant-analytics/)[[3]](https://www.leadreceipt.com/blog/hipaa-compliant-data-integration-tools-for-healthcare-complete-guide) - **De-identification:** Integrated tools process incoming JSON/FHIR streams to automatically redact or tokenize the 18 HIPAA Safe Harbor identifiers prior to analytics exposure.[](https://www.datastealth.io/blogs/hipaa-data-masking-best-practices/) [[1]](https://www.datastealth.io/blogs/hipaa-data-masking-best-practices/)[[2]](https://www.protecto.ai/solutions/phi-de-identification-for-data-lakes/)[[3]](https://dataengineeringcompanies.com/healthcare-data-engineering/)[[4]](https://privacyscrubber.com/compliance/hipaa/?srsltid=AfmBOorpPCH8tt1WhIQ83pEhc2rEQqXwWKHnNBZR6wxmKWPW_vXobppb) - **Audit Trails:** Immutable, centralized logging captures timestamped actor and resource access events for compliance validation.[](https://www.knowi.com/blog/hipaa-compliant-data-integration-pipeline/) [[1]](https://www.johnsnowlabs.com/hipaa-compliant-human-in-the-loop-de-identification-in-generative-ai-lab/) Quick Summary (TL;DR) * A HIPAA-compliant data integration pipeline must encrypt PHI in transit using TLS 1.2+ and at rest using A... HIPAA-compliant analytics systems process Protected Health Information (PHI) under HIPAA's Privacy, Security, and Breach Notificat... Key Takeaways: * Security Requirements: Tools must use AES-256 encryption, TLS 1.2+ (preferably TLS 1.3), OAuth 2.0, and Multi-Fac... Implementing HIPAA Data Masking with DataStealth DataStealth enables healthcare organizations to implement HIPAA-compliant data ma... De-identify PHI without losing context—mask clinical notes, datasets, and analytics pipelines while keeping HIPAA compliance and d... PHI De-identification Pipelines Automate the removal of 18 HIPAA identifiers from datasets used for research or analytics. Deploy ... AI Summary / Key Takeaways ... "PrivacyScrubber implements the HIPAA Safe Harbor de-identification method (45 CFR §164.514(b)(2)) ... FAQs * How does this platform ensure HIPAA compliance? It enforces access control, tracks every interaction, and retains audit log... ✓ Any AI tool that processes PHI on your behalf is a HIPAA business associate — a BAA is required ✓ OpenAI (API + ChatGPT Enterpri...

`Claude is not HIPAA compliant by default` , but compliance is achievable exclusively through Anthropic’s **HIPAA-ready Enterprise plans** , the **first-party Claude API** with a signed Business Associate Agreement (BAA), or via regulated cloud wrappers like **Amazon Bedrock** or **Google Cloud Vertex AI** . Consumer and standard business tiers (Free, Pro, Max, and Team) do not offer or support BAAs and cannot legally process Protected Health Information (PHI).[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) [[1]](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans)[[2]](https://www.strac.io/blog/is-claude-hipaa-compliant)[[3]](https://ibl.ai/blog/is-claude-hipaa-compliant-2026)[[4]](https://bastiongpt.com/post/is-claude-hipaa-compliant)[[5]](https://ligamentmediaai.com/is-claude-hipaa-compliant/) Unsupported and Non-Compliant Plans - **Consumer Tiers:** Claude Free, Pro, Max, and Team plans explicitly exclude BAA coverage and retain user prompt data. - **Excluded Tools:** Standard developer interfaces like the Claude Console, Workbench, Cowork, and various beta integrations are not covered by Anthropic's commercial BAA.[](https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers) [[1]](https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers)[[2]](https://www.hathr.ai/blogs/is-claude-console-hipaa-compliant) Requirements for Compliant Use - **Enterprise Opt-In:** Organization primary owners must explicitly activate the HIPAA compliance configuration setting within a qualifying Enterprise account.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) - **Cloud Infrastructure Alternatives:** Deploying Claude via [Amazon Bedrock](https://aws.amazon.com/bedrock/) or [Google Cloud Vertex AI](https://cloud.google.com/vertex-ai) allows organizations to execute workloads under those respective platforms' established BAAs.[](https://ibl.ai/blog/is-claude-hipaa-compliant-2026) - **Feature Restrictions:** Administrators must restrict employee access to non-covered auxiliary features and adhere strictly to Anthropic's implementation guidelines.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) If you're planning a rollout, tell me: - Are you looking to use the **Claude Enterprise web interface** or the **Claude API**? - Will you be deploying via Anthropic directly or through a cloud provider like **AWS Bedrock**? I can help outline the exact setup requirements for your workflow. Claude is not HIPAA compliant by default, but compliance is achievable exclusively through Anthropic’s HIPAA-ready Enterprise plans, the first-party Claude API with a signed Business Associate Agreement (BAA), or via regulated cloud wrappers like Amazon Bedrock or Google Cloud Vertex AI. Consumer and standard business tiers (Free, Pro, Max, and Team) do not offer or support BAAs and cannot legally process Protected Health Information (PHI). HIPAA-ready Enterprise plans. Updated over a week ago. Table of contents. Overview Who is this for? Feature availability Additiona... The Direct Answer. * Claude can be used in a HIPAA-compliant way — but only on specific Anthropic products, only under a signed Bu... What to Take Away * Claude is not HIPAA compliant by default. * Claude can be used in HIPAA-regulated workflows under Anthropic's ... Is Claude HIPAA Compliant? (2026 Guide) * The short answer: Claude is not HIPAA compliant by default. ‍Anthropic offers a limited ... Is Claude HIPAA compliant? (Direct answer up front) Claude is not HIPAA compliant by default. The standard versions of Claude avai... Consumer Tiers: Claude Free, Pro, Max, and Team plans explicitly exclude BAA coverage and retain user prompt data. Excluded Tools: Standard developer interfaces like the Claude Console, Workbench, Cowork, and various beta integrations are not covered by Anthropic's commercial BAA. - **Consumer Tiers:** Claude Free, Pro, Max, and Team plans explicitly exclude BAA coverage and retain user prompt data. - **Excluded Tools:** Standard developer interfaces like the Claude Console, Workbench, Cowork, and various beta integrations are not covered by Anthropic's commercial BAA.[](https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers) [[1]](https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers)[[2]](https://www.hathr.ai/blogs/is-claude-console-hipaa-compliant) Business Associate Agreements (BAA) for Commercial Customers * This article is about our commercial products such as Claude for Wo... Which Claude products are covered under Anthropic's BAA? As of mid-2026, Anthropic's BAA covers the Claude API (first-party, with ... Enterprise Opt-In: Organization primary owners must explicitly activate the HIPAA compliance configuration setting within a qualifying Enterprise account. Cloud Infrastructure Alternatives: Deploying Claude via Amazon Bedrock or Google Cloud Vertex AI allows organizations to execute workloads under those respective platforms' established BAAs. Feature Restrictions: Administrators must restrict employee access to non-covered auxiliary features and adhere strictly to Anthropic's implementation guidelines. - **Enterprise Opt-In:** Organization primary owners must explicitly activate the HIPAA compliance configuration setting within a qualifying Enterprise account.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) - **Cloud Infrastructure Alternatives:** Deploying Claude via [Amazon Bedrock](https://aws.amazon.com/bedrock/) or [Google Cloud Vertex AI](https://cloud.google.com/vertex-ai) allows organizations to execute workloads under those respective platforms' established BAAs.[](https://ibl.ai/blog/is-claude-hipaa-compliant-2026) - **Feature Restrictions:** Administrators must restrict employee access to non-covered auxiliary features and adhere strictly to Anthropic's implementation guidelines.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans)

**Claude is not HIPAA compliant by default, but it can be configured for compliance on specific high-tier plans.** Anthropic provides a self-serve Business Associate Agreement (BAA) and a "HIPAA-ready" environment, but this is strictly limited to enterprise and developer channels. Inputting Protected Health Information (PHI) into standard consumer accounts will result in a immediate HIPAA violation.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) [[1]](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans)[[2]](https://medium.com/@automation.labs/claude-made-hipaa-self-serve-check-these-3-things-first-1945e96c386b)[[3]](https://www.hipaavault.com/resources/is-claude-hipaa-compliant/)[[4]](https://bastiongpt.com/post/is-claude-hipaa-compliant)[[5]](https://www.accountablehq.com/post/is-claude-hipaa-compliant-what-you-need-to-know-for-phi) Compliance Status by Account Type - ❌ **Free, Pro, Max, and Team Plans**: **Not HIPAA compliant.** Anthropic will not sign a BAA for these tiers. Data may be retained for up to 30 days or longer, and security configurations do not meet healthcare regulatory requirements.[](https://bastiongpt.com/post/is-claude-hipaa-compliant) [[1]](https://www.accountablehq.com/post/is-claude-hipaa-compliant-what-you-need-to-know-for-phi)[[2]](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans)[[3]](https://bastiongpt.com/post/is-claude-hipaa-compliant) - ✅ **Claude Enterprise**: **HIPAA-compliant optional.** The primary organization owner must manually accept the BAA and toggle on HIPAA compliance within the organization's settings.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) [[1]](https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers)[[2]](https://ibl.ai/blog/is-claude-hipaa-compliant-2026) - ✅ **Anthropic API (First-Party)**: **HIPAA-compliant optional.** Developers can build healthcare tools using the first-party API if they sign a BAA directly through Anthropic's sales or account teams.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) [[1]](https://www.hathr.ai/blogs/is-claude-console-hipaa-compliant)[[2]](https://www.paubox.com/blog/is-claude-fable-hipaa-compliant)[[3]](https://bloodgpt.com/use-case/how-to-use-Claude-for-Healthcare) - ✅ **Cloud Infrastructure (AWS Bedrock & Google Vertex AI)**: **HIPAA-compliant.** Accessing Claude models hosted via [AWS Bedrock](https://aws.amazon.com/bedrock/) or Google Cloud Vertex AI utilizes the cloud provider's existing infrastructure BAA. In this setup, data stays inside your secure cloud environment and never reaches Anthropic.[](https://www.strac.io/blog/is-claude-hipaa-compliant) [[1]](https://www.strac.io/blog/is-claude-hipaa-compliant)[[2]](https://www.youtube.com/watch?v=uanPtzcxVpg&t=23)[[3]](https://bastiongpt.com/post/is-claude-hipaa-compliant)[[4]](https://www.strac.io/blog/is-claude-hipaa-compliant) Feature Gaps and Limitations Even if you enable the HIPAA-ready Enterprise configuration, not all built-in features are covered under Anthropic's BAA. Administrators must monitor feature categories carefully:[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) - **Covered Features** : Core conversational interfaces like Chat, Projects, Artifacts, Voice, Web Search, and standard file code execution. - **Conditional/Excluded Features** : Claude Code is only covered if Zero Data Retention (ZDR) is actively enabled. Conversely, services like Claude Console, Cowork, and several beta features are completely excluded from the BAA and must not process PHI.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) [[1]](https://www.paubox.com/blog/is-claude-fable-hipaa-compliant) For official configuration rules, review the live [Anthropic BAA Commercial Documentation](https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers) and download their official Implementation Guide before deploying any healthcare workflows.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) Would you like to know more about **how to configure AWS Bedrock** for Claude, or do you need help drafted **internal AI usage policies** for your medical staff? Claude is not HIPAA compliant by default, but it can be configured for compliance on specific high-tier plans. Anthropic provides a self-serve Business Associate Agreement (BAA) and a "HIPAA-ready" environment, but this is strictly limited to enterprise and developer channels. Inputting Protected Health Information (PHI) into standard consumer accounts will result in a immediate HIPAA violation. HIPAA-ready Enterprise plans. ... This feature is available for Enterprise plans only (both self-serve and sales-assisted). We off... Until now, turning Claude into a HIPAA-ready product meant a sales conversation and a signed BAA. As of the July 14 release notes, Is Claude HIPAA Compliant? A Healthcare AI Compliance Breakdown * Is Claude HIPAA compliant? * Claude AI is not HIPAA compliant by... Is Claude HIPAA Compliant? (2026 Guide) * The short answer: Claude is not HIPAA compliant by default. ‍Anthropic offers a limited ... Is Claude HIPAA Compliant? What You Need to Know for PHI ( Protected Health Information (PHI ) If you handle Protected Health Info... ❌ Free, Pro, Max, and Team Plans : Not HIPAA compliant. Anthropic will not sign a BAA for these tiers. Data may be retained for up to 30 days or longer, and security configurations do not meet healthcare regulatory requirements. ✅ Claude Enterprise : HIPAA-compliant optional. The primary organization owner must manually accept the BAA and toggle on HIPAA compliance within the organization's settings. ✅ Anthropic API (First-Party) : HIPAA-compliant optional. Developers can build healthcare tools using the first-party API if they sign a BAA directly through Anthropic's sales or account teams. ✅ Cloud Infrastructure (AWS Bedrock & Google Vertex AI) : HIPAA-compliant. Accessing Claude models hosted via AWS Bedrock or Google Cloud Vertex AI utilizes the cloud provider's existing infrastructure BAA. In this setup, data stays inside your secure cloud environment and never reaches Anthropic. - ❌ **Free, Pro, Max, and Team Plans**: **Not HIPAA compliant.** Anthropic will not sign a BAA for these tiers. Data may be retained for up to 30 days or longer, and security configurations do not meet healthcare regulatory requirements.[](https://bastiongpt.com/post/is-claude-hipaa-compliant) [[1]](https://www.accountablehq.com/post/is-claude-hipaa-compliant-what-you-need-to-know-for-phi)[[2]](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans)[[3]](https://bastiongpt.com/post/is-claude-hipaa-compliant) - ✅ **Claude Enterprise**: **HIPAA-compliant optional.** The primary organization owner must manually accept the BAA and toggle on HIPAA compliance within the organization's settings.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) [[1]](https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers)[[2]](https://ibl.ai/blog/is-claude-hipaa-compliant-2026) - ✅ **Anthropic API (First-Party)**: **HIPAA-compliant optional.** Developers can build healthcare tools using the first-party API if they sign a BAA directly through Anthropic's sales or account teams.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) [[1]](https://www.hathr.ai/blogs/is-claude-console-hipaa-compliant)[[2]](https://www.paubox.com/blog/is-claude-fable-hipaa-compliant)[[3]](https://bloodgpt.com/use-case/how-to-use-Claude-for-Healthcare) - ✅ **Cloud Infrastructure (AWS Bedrock & Google Vertex AI)**: **HIPAA-compliant.** Accessing Claude models hosted via [AWS Bedrock](https://aws.amazon.com/bedrock/) or Google Cloud Vertex AI utilizes the cloud provider's existing infrastructure BAA. In this setup, data stays inside your secure cloud environment and never reaches Anthropic.[](https://www.strac.io/blog/is-claude-hipaa-compliant) [[1]](https://www.strac.io/blog/is-claude-hipaa-compliant)[[2]](https://www.youtube.com/watch?v=uanPtzcxVpg&t=23)[[3]](https://bastiongpt.com/post/is-claude-hipaa-compliant)[[4]](https://www.strac.io/blog/is-claude-hipaa-compliant) Claude's Standard Version Limitations. Consumer or team-oriented versions of AI chat products are designed for broad use, not regu... You can enable the HIPAA configuration from organization settings if your organization is on an Enterprise plan. Team plans and in... Conclusion Claude is a capable AI assistant, but it is not HIPAA compliant by default. Standard plans (Free, Pro, Max, Team) shoul... Business Associate Agreements (BAA) for Commercial Customers * This article is about our commercial products such as Claude for Wo... The Claude.ai consumer product and the Claude for Teams tier do not support HIPAA workloads. Neither does Claude for Enterprise un... Does signing a BAA with Anthropic make Claude Console HIPAA compliant? No. This is the most common misconception. A BAA covers spe... What does the Claude Fable BAA cover? The Claude Fable BAA covers the use and disclosure of protected health information (PHI), st... A common question is whether Claude is HIPAA compliant: Anthropic does offer a Business Associate Agreement (Anthropic BAA) on the... * Claude can be used in a HIPAA-compliant way — but only on specific Anthropic products, only under a signed Business Associate Ag... so most people think that they can't use GPT or Claude because it's not HIPPA compliant. and they are right. but what a lot of peo... Even if you enable the HIPAA-ready Enterprise configuration, not all built-in features are covered under Anthropic's BAA. Administrators must monitor feature categories carefully: Even if you enable the HIPAA-ready Enterprise configuration, not all built-in features are covered under Anthropic's BAA. Administrators must monitor feature categories carefully:[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) Covered Features : Core conversational interfaces like Chat, Projects, Artifacts, Voice, Web Search, and standard file code execution. Conditional/Excluded Features : Claude Code is only covered if Zero Data Retention (ZDR) is actively enabled. Conversely, services like Claude Console, Cowork, and several beta features are completely excluded from the BAA and must not process PHI. - **Covered Features** : Core conversational interfaces like Chat, Projects, Artifacts, Voice, Web Search, and standard file code execution. - **Conditional/Excluded Features** : Claude Code is only covered if Zero Data Retention (ZDR) is actively enabled. Conversely, services like Claude Console, Cowork, and several beta features are completely excluded from the BAA and must not process PHI.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) [[1]](https://www.paubox.com/blog/is-claude-fable-hipaa-compliant) For official configuration rules, review the live Anthropic BAA Commercial Documentation and download their official Implementation Guide before deploying any healthcare workflows. For official configuration rules, review the live [Anthropic BAA Commercial Documentation](https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers) and download their official Implementation Guide before deploying any healthcare workflows.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) Would you like to know more about how to configure AWS Bedrock for Claude, or do you need help drafted internal AI usage policies for your medical staff? Would you like to know more about **how to configure AWS Bedrock** for Claude, or do you need help drafted **internal AI usage policies** for your medical staff?

**Claude is not HIPAA compliant by default, but it can be configured for compliance on specific high-tier plans.** Anthropic provides a self-serve Business Associate Agreement (BAA) and a "HIPAA-ready" environment, but this is strictly limited to enterprise and developer channels. Inputting Protected Health Information (PHI) into standard consumer accounts will result in a immediate HIPAA violation.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) [[1]](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans)[[2]](https://medium.com/@automation.labs/claude-made-hipaa-self-serve-check-these-3-things-first-1945e96c386b)[[3]](https://www.hipaavault.com/resources/is-claude-hipaa-compliant/)[[4]](https://bastiongpt.com/post/is-claude-hipaa-compliant)[[5]](https://www.accountablehq.com/post/is-claude-hipaa-compliant-what-you-need-to-know-for-phi) Compliance Status by Account Type - ❌ **Free, Pro, Max, and Team Plans**: **Not HIPAA compliant.** Anthropic will not sign a BAA for these tiers. Data may be retained for up to 30 days or longer, and security configurations do not meet healthcare regulatory requirements.[](https://bastiongpt.com/post/is-claude-hipaa-compliant) [[1]](https://www.accountablehq.com/post/is-claude-hipaa-compliant-what-you-need-to-know-for-phi)[[2]](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans)[[3]](https://bastiongpt.com/post/is-claude-hipaa-compliant) - ✅ **Claude Enterprise**: **HIPAA-compliant optional.** The primary organization owner must manually accept the BAA and toggle on HIPAA compliance within the organization's settings.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) [[1]](https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers)[[2]](https://ibl.ai/blog/is-claude-hipaa-compliant-2026) - ✅ **Anthropic API (First-Party)**: **HIPAA-compliant optional.** Developers can build healthcare tools using the first-party API if they sign a BAA directly through Anthropic's sales or account teams.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) [[1]](https://www.hathr.ai/blogs/is-claude-console-hipaa-compliant)[[2]](https://www.paubox.com/blog/is-claude-fable-hipaa-compliant)[[3]](https://bloodgpt.com/use-case/how-to-use-Claude-for-Healthcare) - ✅ **Cloud Infrastructure (AWS Bedrock & Google Vertex AI)**: **HIPAA-compliant.** Accessing Claude models hosted via [AWS Bedrock](https://aws.amazon.com/bedrock/) or Google Cloud Vertex AI utilizes the cloud provider's existing infrastructure BAA. In this setup, data stays inside your secure cloud environment and never reaches Anthropic.[](https://www.strac.io/blog/is-claude-hipaa-compliant) [[1]](https://www.strac.io/blog/is-claude-hipaa-compliant)[[2]](https://www.youtube.com/watch?v=uanPtzcxVpg&t=23)[[3]](https://bastiongpt.com/post/is-claude-hipaa-compliant)[[4]](https://www.strac.io/blog/is-claude-hipaa-compliant) Feature Gaps and Limitations Even if you enable the HIPAA-ready Enterprise configuration, not all built-in features are covered under Anthropic's BAA. Administrators must monitor feature categories carefully:[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) - **Covered Features** : Core conversational interfaces like Chat, Projects, Artifacts, Voice, Web Search, and standard file code execution. - **Conditional/Excluded Features** : Claude Code is only covered if Zero Data Retention (ZDR) is actively enabled. Conversely, services like Claude Console, Cowork, and several beta features are completely excluded from the BAA and must not process PHI.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) [[1]](https://www.paubox.com/blog/is-claude-fable-hipaa-compliant) For official configuration rules, review the live [Anthropic BAA Commercial Documentation](https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers) and download their official Implementation Guide before deploying any healthcare workflows.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) Would you like to know more about **how to configure AWS Bedrock** for Claude, or do you need help drafted **internal AI usage policies** for your medical staff? Claude is not HIPAA compliant by default, but it can be configured for compliance on specific high-tier plans. Anthropic provides a self-serve Business Associate Agreement (BAA) and a "HIPAA-ready" environment, but this is strictly limited to enterprise and developer channels. Inputting Protected Health Information (PHI) into standard consumer accounts will result in a immediate HIPAA violation. Claude Help Center +3 HIPAA-ready Enterprise plans. ... This feature is available for Enterprise plans only (both self-serve and sales-assisted). We off... Until now, turning Claude into a HIPAA-ready product meant a sales conversation and a signed BAA. As of the July 14 release notes, Is Claude HIPAA Compliant? A Healthcare AI Compliance Breakdown * Is Claude HIPAA compliant? * Claude AI is not HIPAA compliant by... Is Claude HIPAA Compliant? (2026 Guide) * The short answer: Claude is not HIPAA compliant by default. ‍Anthropic offers a limited ... Is Claude HIPAA Compliant? What You Need to Know for PHI ( Protected Health Information (PHI ) If you handle Protected Health Info... ❌ Free, Pro, Max, and Team Plans : Not HIPAA compliant. Anthropic will not sign a BAA for these tiers. Data may be retained for up to 30 days or longer, and security configurations do not meet healthcare regulatory requirements. BastionGPT +1 ✅ Claude Enterprise : HIPAA-compliant optional. The primary organization owner must manually accept the BAA and toggle on HIPAA compliance within the organization's settings. Claude Help Center +1 ✅ Anthropic API (First-Party) : HIPAA-compliant optional. Developers can build healthcare tools using the first-party API if they sign a BAA directly through Anthropic's sales or account teams. Claude Help Center +1 ✅ Cloud Infrastructure (AWS Bedrock & Google Vertex AI) : HIPAA-compliant. Accessing Claude models hosted via AWS Bedrock or Google Cloud Vertex AI utilizes the cloud provider's existing infrastructure BAA. In this setup, data stays inside your secure cloud environment and never reaches Anthropic. Strac +1 - ❌ **Free, Pro, Max, and Team Plans**: **Not HIPAA compliant.** Anthropic will not sign a BAA for these tiers. Data may be retained for up to 30 days or longer, and security configurations do not meet healthcare regulatory requirements.[](https://bastiongpt.com/post/is-claude-hipaa-compliant) [[1]](https://www.accountablehq.com/post/is-claude-hipaa-compliant-what-you-need-to-know-for-phi)[[2]](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans)[[3]](https://bastiongpt.com/post/is-claude-hipaa-compliant) - ✅ **Claude Enterprise**: **HIPAA-compliant optional.** The primary organization owner must manually accept the BAA and toggle on HIPAA compliance within the organization's settings.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) [[1]](https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers)[[2]](https://ibl.ai/blog/is-claude-hipaa-compliant-2026) - ✅ **Anthropic API (First-Party)**: **HIPAA-compliant optional.** Developers can build healthcare tools using the first-party API if they sign a BAA directly through Anthropic's sales or account teams.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) [[1]](https://www.hathr.ai/blogs/is-claude-console-hipaa-compliant)[[2]](https://www.paubox.com/blog/is-claude-fable-hipaa-compliant)[[3]](https://bloodgpt.com/use-case/how-to-use-Claude-for-Healthcare) - ✅ **Cloud Infrastructure (AWS Bedrock & Google Vertex AI)**: **HIPAA-compliant.** Accessing Claude models hosted via [AWS Bedrock](https://aws.amazon.com/bedrock/) or Google Cloud Vertex AI utilizes the cloud provider's existing infrastructure BAA. In this setup, data stays inside your secure cloud environment and never reaches Anthropic.[](https://www.strac.io/blog/is-claude-hipaa-compliant) [[1]](https://www.strac.io/blog/is-claude-hipaa-compliant)[[2]](https://www.youtube.com/watch?v=uanPtzcxVpg&t=23)[[3]](https://bastiongpt.com/post/is-claude-hipaa-compliant)[[4]](https://www.strac.io/blog/is-claude-hipaa-compliant) Claude's Standard Version Limitations. Consumer or team-oriented versions of AI chat products are designed for broad use, not regu... You can enable the HIPAA configuration from organization settings if your organization is on an Enterprise plan. Team plans and in... Conclusion Claude is a capable AI assistant, but it is not HIPAA compliant by default. Standard plans (Free, Pro, Max, Team) shoul... Business Associate Agreements (BAA) for Commercial Customers * This article is about our commercial products such as Claude for Wo... The Claude.ai consumer product and the Claude for Teams tier do not support HIPAA workloads. Neither does Claude for Enterprise un... Does signing a BAA with Anthropic make Claude Console HIPAA compliant? No. This is the most common misconception. A BAA covers spe... What does the Claude Fable BAA cover? The Claude Fable BAA covers the use and disclosure of protected health information (PHI), st... A common question is whether Claude is HIPAA compliant: Anthropic does offer a Business Associate Agreement (Anthropic BAA) on the... * Claude can be used in a HIPAA-compliant way — but only on specific Anthropic products, only under a signed Business Associate Ag... so most people think that they can't use GPT or Claude because it's not HIPPA compliant. and they are right. but what a lot of peo... Even if you enable the HIPAA-ready Enterprise configuration, not all built-in features are covered under Anthropic's BAA. Administrators must monitor feature categories carefully: Claude Help Center Even if you enable the HIPAA-ready Enterprise configuration, not all built-in features are covered under Anthropic's BAA. Administrators must monitor feature categories carefully:[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) Covered Features : Core conversational interfaces like Chat, Projects, Artifacts, Voice, Web Search, and standard file code execution. Conditional/Excluded Features : Claude Code is only covered if Zero Data Retention (ZDR) is actively enabled. Conversely, services like Claude Console, Cowork, and several beta features are completely excluded from the BAA and must not process PHI. Claude Help Center +2 - **Covered Features** : Core conversational interfaces like Chat, Projects, Artifacts, Voice, Web Search, and standard file code execution. - **Conditional/Excluded Features** : Claude Code is only covered if Zero Data Retention (ZDR) is actively enabled. Conversely, services like Claude Console, Cowork, and several beta features are completely excluded from the BAA and must not process PHI.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) [[1]](https://www.paubox.com/blog/is-claude-fable-hipaa-compliant) For official configuration rules, review the live Anthropic BAA Commercial Documentation and download their official Implementation Guide before deploying any healthcare workflows. Claude Help Center For official configuration rules, review the live [Anthropic BAA Commercial Documentation](https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers) and download their official Implementation Guide before deploying any healthcare workflows.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) Would you like to know more about how to configure AWS Bedrock for Claude, or do you need help drafted internal AI usage policies for your medical staff? Would you like to know more about **how to configure AWS Bedrock** for Claude, or do you need help drafted **internal AI usage policies** for your medical staff?