AI Vendor BAA Guide

45 CFR 164.502(e)(1)(i) permits a covered entity to disclose PHI to a business associate only if it "obtains satisfactory assurance that the business associate will appropriately safeguard the information." 164.502(e)(2) then requires that those assurances be "documented through a written contract or other written agreement or arrangement with the business associate that meets the applicable requirements of § 164.504(e)."

45 CFR 164.308(b)(1) is the Security Rule counterpart, and it is narrower and more specific: a covered entity may permit a business associate "to create, receive, maintain, or transmit electronic protected health information on the covered entity's behalf only if the covered entity obtains satisfactory assurances, in accordance with § 164.314(a)." 164.308(b)(3) requires the same documentation in writing.

45 CFR 164.504(e)(2) decides whether the paper you hold is worth anything. The contract must establish the permitted and required uses and disclosures of PHI, and it must require the business associate to:

1. Not use or disclose the information beyond what the contract or law permits.
2. Use appropriate safeguards and comply with the Security Rule where applicable.
3. Report unauthorized uses, disclosures, and breaches.
4. Ensure that subcontractors agree to the same restrictions.
5. Make PHI available for individual access under 164.524.
6. Make PHI available for amendment under 164.526.
7. Provide an accounting of disclosures under 164.528.
8. Make its records available to the Secretary for a compliance review.
9. Return or destroy PHI at termination, or extend the protections if return is not feasible.

Anthropic. The BAA covers Claude Enterprise and the first-party API. Consumer plans (Free, Pro, Max) are excluded, and so is Team. For Enterprise, the organization's Primary Owner accepts the BAA directly while activating HIPAA compliance in organization settings under "Data and privacy." For the first-party API, the Primary Owner signs the BAA and then contacts Anthropic sales to have it enabled. The agreement covers only the single organization that accepted it, and Anthropic's documentation names features it excludes, including Workbench, Claude Console, Claude Cowork, and features in beta. (Anthropic Privacy Center, "Business Associate Agreements (BAA) for Commercial Customers," read 2026-08-05.)

OpenAI. Request by emailing baa@openai.com with your company details and use case. OpenAI reviews each request case by case and states an enterprise agreement is not required to sign a BAA for the API platform. (OpenAI Help Center, "How can I get a Business Associate Agreement (BAA) with OpenAI for the API Services?", read via search index 2026-08-05; the article returned a 403 to direct fetch.)

The executable step: identify your plan first, then the product, then request. Asking sales for a BAA while your team runs on a consumer tier produces a slow no.

AWS. Sign in to AWS Artifact in the AWS Management Console to review, accept, and manage the BAA. AWS then states you "should only process, store, and transmit protected health information (PHI) in the HIPAA-eligible services defined in the Business Associate Addendum." Amazon Bedrock is on the HIPAA Eligible Services list, with named model exclusions. Amazon SageMaker AI is on it with named feature exclusions.

Google Cloud. Go to the IAM and Admin privacy page in the Cloud Console, select a project, click "Review and Accept" under the Google Cloud Platform HIPAA Business Associate Addendum, then "I Accept." You only need to opt in from one project in the account. Coverage is a named product list of roughly a hundred products, and Google states it "is updated as new products become available to the HIPAA program."

Microsoft. You do not have to request it. Microsoft states its HIPAA Business Associate Agreement "is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA." Scope is the in-scope cloud services list, which currently names Microsoft 365 Copilot and Microsoft 365 Copilot Chat under Office 365 Commercial and GCC.

The executable step: accept the BAA, then match your exact workload to a named covered product before any PHI moves, and disable everything else. Google Vertex AI is the live example: Google Cloud signs a self-serve BAA, but "Vertex AI" by that name was not on the covered-products list when we checked. Vertex AI Workbench instances were. A signed BAA and an uncovered product is the same exposure as no BAA at all.

Ask in writing anyway. A dated written "no" from the vendor is an audit artifact, and it is worth more in a review than an absence of evidence. It is also what closes the loop on the case where a third-party aggregator says a BAA exists and the vendor's own documentation does not, which is exactly the Plaud case below.

The executable step: email the vendor, name the tier you actually run, ask whether a BAA is available on it, and file the reply either way.

Four questions, in writing, before signature:

1. Which model providers process our data, by name?
2. Do you hold a signed BAA with each of them?
3. Are they named as subprocessors in your published terms?
4. Will you provide the subcontractor chain in writing on request, and notify us when it changes?

BastionGPT is the clean version of this category: its own security documentation states that all of its plans automatically incorporate a BAA, with no enterprise-tier gate and no request process (read 2026-08-05). CompliantChatGPT includes a standard BAA on all four of its tiers, and its privacy policy states that customer content is not used to train any model, "whether our own or any third party's" (read 2026-08-05). Our entry also notes that the same privacy policy does not name the model providers as subprocessors. Both facts are true at once, and question 3 above exists because of it.

Both rules then add one more provision: the covered entity is not required to obtain those assurances directly. 164.502(e)(1)(i) says plainly that "a covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor."

• Link 1. The hospital is the covered entity. It signs a BAA with the documentation vendor. This is the only contract the hospital signs.
• Link 2. The documentation vendor is a business associate. Because it routes PHI to Bedrock, AWS is its subcontractor, and 164.502(e)(1)(ii) obliges the vendor to obtain satisfactory assurances from AWS. AWS provides them through the BAA accepted in AWS Artifact.
• Link 3. The Bedrock route puts Anthropic's model inside AWS's covered service rather than under a separate Anthropic agreement. Amazon Bedrock is on the AWS HIPAA Eligible Services list, with named model exclusions, so the vendor has to confirm the specific model it calls is not one of the excluded ones.
• Link 4. Had the vendor used Anthropic's first-party API instead, the chain would run to Anthropic directly, and the vendor would need Anthropic's own BAA on a HIPAA-ready organization, not just an API key.

The live case in our own directory is Plaud. Its compliance documentation, read 2026-08-05, enumerates ISO/IEC 27001:2022, ISO/IEC 27701:2019, GDPR, SOC 2 Type II, a HIPAA Validation Report, and EN 18031, and adds a Data Processing Agreement on the Team plan. A Business Associate Agreement is not among them. A vendor that holds a BAA says BAA, because it is the first artifact healthcare buyers ask for.

The full argument lives elsewhere. SOC 2 against HIPAA is SOC 2 and HIPAA for AI platforms. HITRUST, the ISO standards, the Validation Report, and the DPA get their own treatment at /ai-governance/hipaa-attestation-vs-baa/.

The full verdicts, sources, and dates for every row live in the AI Tool HIPAA Compliance Directory.

That is shadow AI, and it is a different control problem entirely. Contracts govern sanctioned paths. They have no reach into unsanctioned ones.

Which is why the vendor question and the workforce question have to be worked at the same time. Signing paper with three vendors while staff use eleven tools produces a compliant deployment and an uncontrolled surface. For how the two halves fit together, and what OCR expects of each, see HIPAA and AI compliance.