Is ChatGPT HIPAA compliant? A therapist's guide for 2026

No, the ChatGPT that most therapists actually use is not HIPAA compliant. OpenAI does not offer a Business Associate Agreement (BAA) for ChatGPT Free, Plus, or Business accounts, and content entered into the free and Plus versions may be used to train OpenAI's models. Pasting client information into any of those versions is a HIPAA violation, regardless of your practice's internal policies.

OpenAI does now offer HIPAA eligible products. ChatGPT Enterprise, ChatGPT for Healthcare, and the OpenAI API can be covered by a BAA, and since April 22, 2026, ChatGPT for Clinicians gives individual verified US clinicians free, self serve access with the option to sign an individual BAA. Two catches for therapists. OpenAI's published eligibility lists are inconsistent, so whether your license verifies is something you confirm at signup. And the BAA is not automatic: it sits in the account settings, nothing prompts you to sign it, and until you are authorized to sign it and actually execute it, the account must be treated like consumer ChatGPT, with no client information in it.

The short version

ChatGPT Free, Plus, and Business have no BAA. Entering client information into them violates HIPAA. ChatGPT Enterprise and ChatGPT for Healthcare (launched January 8, 2026) can be HIPAA eligible with a signed BAA, but they are sales-managed enterprise products, not self serve. ChatGPT for Clinicians (launched April 22, 2026) is free and self serve with an individual BAA option, though OpenAI's own pages disagree on which licenses qualify, and without an executed BAA it must be treated like consumer ChatGPT. A BAA alone does not make your use compliant: you still need consent, state recording law compliance, and minimum necessary discipline. You can safely use consumer ChatGPT for content with no client information, such as marketing copy, practice policies, and general clinical education. For client work, use a tool built for it. Upheal is an AI-native EHR for mental health clinicians. Upheal signs a BAA with every practice. Upheal does not use session data to train AI unless you and your client both choose it.

Which version of ChatGPT is HIPAA compliant?

Only four OpenAI products can be HIPAA eligible, and each requires a signed BAA with OpenAI before any client information goes in. As of September 2026, this is how the versions compare:

What about ChatGPT for Clinicians?

ChatGPT for Clinicians, launched April 22, 2026, is the one OpenAI product an individual can get without an enterprise contract. It is free for verified US clinicians, verification runs through your NPI, and clinicians authorized to sign a BAA for their account can execute one. Content in it is not used to train OpenAI's models.

Three limits matter for a therapy practice. First, eligibility is not clearly documented for therapists. OpenAI's product page says verified US licensed clinicians, including psychologists and "other licensed clinicians," verified through your NPI. Its Help Center currently lists only physicians (MD and DO), nurse practitioners, physician assistants, and pharmacists. In Upheal's own testing, the verification step appears to accept any active NPI, but OpenAI has not confirmed that in writing, and you cannot find out without going through verification. Second, the BAA is opt in, not default, and easy to miss: it is buried in the account menus and nothing in the signup flow prompts you to sign it. A colleague using ChatGPT for Clinicians without an executed BAA has a nicer interface and a training exclusion, not HIPAA coverage. Third, it is tuned for medical use, not clinical therapy work. Its answers lean heavily on research synthesis, and it does not capture your session, manage consent, or file the note in a record.

Two more details trip people up. ChatGPT Health, launched January 7, 2026, is a consumer product for individuals connecting their own medical records. It is not a clinician tool and does not make your use of ChatGPT compliant. And even inside ChatGPT for Healthcare, some features sit outside the BAA: improved memory is disabled by default and is not covered by the agreement.

Why isn't regular ChatGPT HIPAA compliant?

Regular ChatGPT fails the two tests HIPAA applies to any software vendor that touches Protected Health Information (PHI).

No Business Associate Agreement. When a vendor receives or processes PHI on behalf of a covered entity, HIPAA requires a signed BAA that makes the vendor legally accountable for protecting that data. The U.S. Department of Health and Human Services states that cloud and software vendors handling PHI generally require one. You can read the HHS guidance on cloud computing and HIPAA directly. OpenAI does not offer this agreement on consumer plans, full stop.

Model training and retention. Content entered into ChatGPT Free and Plus may be used to improve OpenAI's models under its consumer terms. Client disclosures from a therapy session are among the most sensitive data HIPAA covers, and psychotherapy notes carry extra protections beyond standard PHI. Feeding either into a consumer AI product means losing control over retention and secondary use.

Turning off training does not fix it. The most common workaround therapists try is to opt out of model training in settings or use a temporary chat. Both reduce what OpenAI keeps, and neither creates a BAA. Your prompts still pass through OpenAI's servers with no contractual obligation to protect them as PHI, so the disclosure is still impermissible under HIPAA.

One more point worth knowing: HHS does not certify or endorse any product as "HIPAA compliant." Compliance describes how a covered entity uses a tool under the right agreements and safeguards, not a badge a product carries. Any vendor claiming a certification is overstating it.

Can therapists use ChatGPT for therapy notes?

Not with real client information on any consumer plan. Writing a progress note in ChatGPT Free or Plus means pasting session content, names, dates, and clinical details into a system with no BAA and possible model training on your inputs. That is a reportable breach waiting to happen.

Removing names does not solve it. HIPAA's Safe Harbor standard requires removing 18 categories of identifiers, including dates, locations smaller than a state, and any detail that could identify the client in combination. A therapy narrative stripped of a name usually still fails that test. If you would not read the text aloud in a hallway, do not paste it into a consumer chatbot.

If you have already done this, what happens next depends on what you actually shared. A generic question about a treatment approach is not a disclosure at all. Session details, names, dates, or a combination of facts that could identify a client is a different matter, and HIPAA's Breach Notification Rule treats an impermissible disclosure of PHI as a breach unless a documented risk assessment shows otherwise. That assessment turns on specifics, so it is worth talking to a compliance advisor or your liability carrier rather than deciding alone.

There is also a layer HIPAA does not cover: your state's recording and consent laws, and your board's ethics rules on technology and confidentiality. A BAA with a vendor satisfies none of those. Whatever tool you use for session documentation needs client consent language and a workflow your board would recognize as reasonable care.

What can a therapist safely use ChatGPT for?

Anything that contains no client information. Consumer ChatGPT is genuinely useful for the business side of a practice:

• Drafting website copy, blog posts, and directory profiles
• Writing practice policies, intake form language, and email templates
• General clinical education, like summarizing a published treatment approach
• Brainstorming workshop outlines or psychoeducation handouts

The line is simple to state and easy to hold: if the text involves a real client, even indirectly, it does not go into consumer ChatGPT. If it is generic practice content, it is fine.

What does a HIPAA compliant AI assistant for therapists look like?

A compliant assistant is not a chatbot with a disclaimer. It is a system where the compliance work is done before you type anything. Four things to require of any vendor:

1. A BAA that is in force from day one, not an agreement you have to find in a settings menu and execute yourself, so the vendor is legally accountable for your clients' data before you type anything.
2. No model training on client data without your explicit opt in, stated in the terms rather than a marketing page.
3. Access controls and audit trails, so you can show who saw what if you are ever asked.
4. Clear retention and deletion policies for audio, transcripts, and notes.

This is the standard Upheal was built to. Upheal is an AI-native EHR and note-taking platform for mental health clinicians. Upheal signs a BAA with every practice. Upheal does not use session data to train AI unless you and your client both choose it. Its AI assistant works inside that environment: it can draft notes, prep you for sessions, and answer questions about your caseload while the data stays under the same agreement and safeguards as your clinical record. That is the difference between an assistant for therapists and a general chatbot a therapist happens to use.

To be clear about scope: Upheal's assistant works with the practice data inside Upheal. It is not a general purpose chatbot replacement for everything you might use ChatGPT for, and it is not a clinical decision maker. It handles the documentation and admin work around your sessions, which is where the compliance risk actually lives. You can read how Upheal handles data in detail on our privacy and compliance page.

Frequently asked questions

Which version of ChatGPT is HIPAA compliant?

Only ChatGPT Enterprise, ChatGPT for Healthcare, ChatGPT for Clinicians, and the OpenAI API can be HIPAA eligible, and only with a signed BAA. ChatGPT Free, Plus, and Business have no BAA option as of September 2026, and ChatGPT for Clinicians requires NPI verification plus an executed individual BAA.

Is ChatGPT safe for medical records?

No consumer version of ChatGPT is safe for medical records or any Protected Health Information. Without a BAA, entering PHI violates HIPAA, and inputs to free and Plus accounts may be used for model training under OpenAI's consumer terms.

Are therapists allowed to use ChatGPT?

Yes, for work that contains no client information, such as marketing copy, practice policies, and general education. Using it for progress notes, session summaries, or anything involving a real client violates HIPAA on consumer plans.

Is there an AI that is HIPAA compliant for therapists?

Yes. Purpose-built clinical tools are built to operate under a BAA and to keep client data out of model training. For example, Upheal signs a BAA with every practice, and Upheal does not use session data to train AI unless you and your client both choose it. "HIPAA compliant" describes the agreement and safeguards around a tool, not a certification, so verify the BAA before trusting the label.

Does ChatGPT train on what I type?

On free and Plus accounts, your conversations may be used to improve OpenAI's models unless you opt out in settings, and opting out does not make the account HIPAA compliant. Only a signed BAA does that. Enterprise, Healthcare, and Clinicians tiers exclude data from training by default.

The bottom line

The question behind "is ChatGPT HIPAA compliant" is usually "can I keep saving this much time without risking my license." You can. The time savings of AI documentation are real, and they do not require a consumer chatbot with no BAA. They require a tool that signed up for the same obligations you did. Upheal handles the notes, the prep, and the admin inside a HIPAA covered environment, so the shortcut and the safeguard are the same product. Start free, no credit card required.

Last updated September 14, 2026. OpenAI product details verified against OpenAI's Help Center and product pages on that date.