intuitionlabs.ai/articles/open-source-phi-de-identification-tools

**Claude is not HIPAA compliant by default** , but it can be used in a HIPAA-compliant manner under very specific conditions. You cannot use standard consumer, free, or team tiers to handle Protected Health Information (PHI) without violating federal laws.[](https://www.hipaavault.com/resources/is-claude-hipaa-compliant/) [[1]](https://www.hipaavault.com/resources/is-claude-hipaa-compliant/)[[2]](https://www.strac.io/blog/is-claude-hipaa-compliant) Plan & Feature Eligibility Breakdown Whether you can achieve compliance depends entirely on the plan you use and the contractual agreements you have in place:[](https://www.strac.io/blog/is-claude-hipaa-compliant) [[1]](https://www.accountablehq.com/post/is-claude-hipaa-compliant-baas-phi-and-security-explained) | Plan / Service Tier | HIPAA Eligibility Status | Requirements for Compliance | |---|---|---| | **Claude Free, Pro, Max, or Team** |❌ **Strictly No** | **Never use PHI.** Anthropic will not sign a Business Associate Agreement (BAA) for these plans. | | **Claude Enterprise** | **Yes** | Requires an active Enterprise subscription where the Primary Owner signs a **Business Associate Agreement (BAA)** and manually toggles "HIPAA Compliance" on in the organization settings. | | **First-Party Claude API** | **Yes** | Requires a custom contract with a **signed BAA** directly through Anthropic Sales or your account team. | | **Amazon Bedrock (Claude Models)** | **Yes** | Covered under your **AWS Business Associate Agreement** . Your data stays within your AWS infrastructure, meaning Anthropic never sees the data. | Explicitly Excluded Features Even if you are on an eligible Enterprise plan or use the API, **not all features are covered under Anthropic's BAA** . According to [Anthropic's BAA Guidelines](https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers) , the following features are **excluded** and should never handle PHI:[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) [[1]](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans)[[2]](https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers)[[3]](https://bastiongpt.com/post/is-claude-hipaa-compliant) - Claude Console & Workbench - Claude Cowork - Beta features (e.g., Claude in Office, Claude Design) - Claude Code (Unless Zero Data Retention is explicitly enabled on a qualified account)[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) [[1]](https://www.hathr.ai/blogs/is-claude-console-hipaa-compliant) How to Enable HIPAA Mode (Enterprise Plan Only) If your organization is already paying for Claude Enterprise, the Primary Owner must complete these steps to protect patient data:[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) 1. Sign in to Claude as the **Primary Owner**. 2. Navigate to **Organization settings** > **Data and privacy**. 3. Scroll to **HIPAA Compliance** and click **Enable**. 4. Review and download the official **Business Associate Agreement (BAA)** and **Implementation Guide**. 5. Click **Accept and enable HIPAA** . Look for the green checkmark confirming activation.[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) Important Operational Reminders - **The Shared Responsibility Model:** Anthropic only provides a secure, "HIPAA-ready" infrastructure. Your organization remains legally responsible for implementing external security measures like Multi-Factor Authentication (MFA), role-based access controls, employee training, and audit logging.[](https://www.hipaavault.com/resources/is-claude-hipaa-compliant/) [[1]](https://www.johndcook.com/blog/2026/04/05/hipaa-compliant-ai/) - **De-identification Alternative:** If your practice cannot afford an Enterprise tier, you may still use standard versions of Claude by completely removing all identifiers (names, dates, locations, phone numbers) before pasting notes into the AI.[](https://www.hipaavault.com/resources/hipaa-compliant-hosting-insights/hipaa-compliant-ai-chatbot/) [[1]](https://www.hipaavault.com/resources/hipaa-compliant-hosting-insights/hipaa-compliant-ai-chatbot/)[[2]](https://intuitionlabs.ai/articles/open-source-phi-de-identification-tools)[[3]](https://personcenteredtech.com/2018/05/18/deidentify-or-not-client-info-under-hipaa/)[[4]](https://research.arizona.edu/sites/default/files/180-limited-data-sets.pdf) Are you looking to deploy Claude for a **specific healthcare use case** (like medical scribing or research), or do you need assistance **evaluating a secure deployment option**? Claude is not HIPAA compliant by default, but it can be used in a HIPAA-compliant manner under very specific conditions. You cannot use standard consumer, free, or team tiers to handle Protected Health Information (PHI) without violating federal laws. Is Claude HIPAA Compliant? A Healthcare AI Compliance Breakdown * Is Claude HIPAA compliant? * Claude AI is not HIPAA compliant by... ✨ Is Claude HIPAA Compliant? The Direct Answer. * Claude can be used in a HIPAA-compliant way — but only on specific Anthropic pro... Whether you can achieve compliance depends entirely on the plan you use and the contractual agreements you have in place: Whether you can achieve compliance depends entirely on the plan you use and the contractual agreements you have in place:[](https://www.strac.io/blog/is-claude-hipaa-compliant) [[1]](https://www.accountablehq.com/post/is-claude-hipaa-compliant-baas-phi-and-security-explained) Claude's Standard Compliance Whether Claude is HIPAA compliant depends on how you deploy it and the contractual and technical cont... | Plan / Service Tier | HIPAA Eligibility Status | Requirements for Compliance | |---|---|---| | **Claude Free, Pro, Max, or Team** |❌ **Strictly No** | **Never use PHI.** Anthropic will not sign a Business Associate Agreement (BAA) for these plans. | | **Claude Enterprise** | **Yes** | Requires an active Enterprise subscription where the Primary Owner signs a **Business Associate Agreement (BAA)** and manually toggles "HIPAA Compliance" on in the organization settings. | | **First-Party Claude API** | **Yes** | Requires a custom contract with a **signed BAA** directly through Anthropic Sales or your account team. | | **Amazon Bedrock (Claude Models)** | **Yes** | Covered under your **AWS Business Associate Agreement** . Your data stays within your AWS infrastructure, meaning Anthropic never sees the data. | Even if you are on an eligible Enterprise plan or use the API, not all features are covered under Anthropic's BAA. According to Anthropic's BAA Guidelines, the following features are excluded and should never handle PHI: Even if you are on an eligible Enterprise plan or use the API, **not all features are covered under Anthropic's BAA** . According to [Anthropic's BAA Guidelines](https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers) , the following features are **excluded** and should never handle PHI:[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) [[1]](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans)[[2]](https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers)[[3]](https://bastiongpt.com/post/is-claude-hipaa-compliant) HIPAA-ready Enterprise plans. ... This feature is available for Enterprise plans only (both self-serve and sales-assisted). We off... Business Associate Agreements (BAA) for Commercial Customers * This article is about our commercial products such as Claude for Wo... Anthropic's own privacy documentation states clearly that its Business Associate Agreement (BAA) "does not cover Workbench and Con... Claude Console & Workbench Claude Cowork Beta features (e.g., Claude in Office, Claude Design) Claude Code (Unless Zero Data Retention is explicitly enabled on a qualified account) - Claude Console & Workbench - Claude Cowork - Beta features (e.g., Claude in Office, Claude Design) - Claude Code (Unless Zero Data Retention is explicitly enabled on a qualified account)[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) [[1]](https://www.hathr.ai/blogs/is-claude-console-hipaa-compliant) Which Claude products are covered under Anthropic's BAA? As of mid-2026, Anthropic's BAA covers the Claude API (first-party, with ... If your organization is already paying for Claude Enterprise, the Primary Owner must complete these steps to protect patient data: If your organization is already paying for Claude Enterprise, the Primary Owner must complete these steps to protect patient data:[](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans) The Shared Responsibility Model: Anthropic only provides a secure, "HIPAA-ready" infrastructure. Your organization remains legally responsible for implementing external security measures like Multi-Factor Authentication (MFA), role-based access controls, employee training, and audit logging. De-identification Alternative: If your practice cannot afford an Enterprise tier, you may still use standard versions of Claude by completely removing all identifiers (names, dates, locations, phone numbers) before pasting notes into the AI. - **The Shared Responsibility Model:** Anthropic only provides a secure, "HIPAA-ready" infrastructure. Your organization remains legally responsible for implementing external security measures like Multi-Factor Authentication (MFA), role-based access controls, employee training, and audit logging.[](https://www.hipaavault.com/resources/is-claude-hipaa-compliant/) [[1]](https://www.johndcook.com/blog/2026/04/05/hipaa-compliant-ai/) - **De-identification Alternative:** If your practice cannot afford an Enterprise tier, you may still use standard versions of Claude by completely removing all identifiers (names, dates, locations, phone numbers) before pasting notes into the AI.[](https://www.hipaavault.com/resources/hipaa-compliant-hosting-insights/hipaa-compliant-ai-chatbot/) [[1]](https://www.hipaavault.com/resources/hipaa-compliant-hosting-insights/hipaa-compliant-ai-chatbot/)[[2]](https://intuitionlabs.ai/articles/open-source-phi-de-identification-tools)[[3]](https://personcenteredtech.com/2018/05/18/deidentify-or-not-client-info-under-hipaa/)[[4]](https://research.arizona.edu/sites/default/files/180-limited-data-sets.pdf) Posted on 5 April 2026 by John The best way to run AI and remain HIPAA compliant is to run it locally on your own hardware, instea... FAQ: HIPAA-Compliant AI Chatbots * Is ChatGPT HIPAA compliant? Only ChatGPT Enterprise or Teams under a signed BAA. * Can I use fr... Local Contexts: Many identifiers in notes are local (specific hospital codes, clinician initials). These often require site-specif... A client's initials are considered to be identifying for the purposes of determining if a given piece of information is PHI under ... The health information that may remain in the information disclosed may include: a. Dates such as admission, discharge, service, d... Are you looking to deploy Claude for a specific healthcare use case (like medical scribing or research), or do you need assistance evaluating a secure deployment option ? Are you looking to deploy Claude for a **specific healthcare use case** (like medical scribing or research), or do you need assistance **evaluating a secure deployment option**?