drata.com/lp/iso-27001-demo

**It depends on which ChatGPT product and account you’re using.** As of August 2026: - **Regular consumer ChatGPT (Free/Plus/Pro)** should **not be treated as HIPAA-compliant for handling PHI**. In particular, OpenAI says its consumer **Health** feature does not offer a BAA and isn't intended for covered-entity use. [help.openai.com](https://help.openai.com/en/articles/20001036-health-in-chatgpt?utm_source=chatgpt.com) - **ChatGPT for Healthcare** is specifically designed for regulated healthcare use and supports HIPAA-compliant use, including availability of a **Business Associate Agreement (BAA)** with OpenAI. [help.openai.com](https://help.openai.com/en/articles/20001046-chatgpt-for-healthcare?utm_source=chatgpt.com)[help.openai.com](https://help.openai.com/en/articles/20001069-hipaa-eligible-products-and-functionality?utm_source=chatgpt.com) - **ChatGPT Enterprise with a Regulated Workspace** can also be HIPAA-eligible when covered by the appropriate BAA. [help.openai.com](https://help.openai.com/en/articles/20001046-chatgpt-for-healthcare?utm_source=chatgpt.com)[help.openai.com](https://help.openai.com/en/articles/20001069-hipaa-eligible-products-and-functionality?utm_source=chatgpt.com) - **OpenAI's API** can be used for PHI when the organization has a BAA and the account is configured with **Modified Retention** as required by OpenAI. [help.openai.com](https://help.openai.com/en/articles/20001069-hipaa-eligible-products-and-functionality?utm_source=chatgpt.com) The important distinction is that **HIPAA compliance isn't simply a property of "ChatGPT."** It depends on the specific OpenAI product, contractual BAA, configuration, and how your organization uses it. If you're asking because you want to **put patient information into ChatGPT**, tell me which plan/product you're using (e.g., Plus, Business, Enterprise, Healthcare, or API), and I can tell you whether that particular setup is appropriate for PHI.