Is ChatGPT HIPAA compliant?

ChatGPT free and ChatGPT Plus are not HIPAA compliant — OpenAI does not provide a Business Associate Agreement (BAA) for these tiers, and these versions may use conversation data for model training. ChatGPT Enterprise and OpenAI's API with a signed BAA can be used in HIPAA-compliant implementations, but require enterprise contracting and configuration. For Florida medical and dental practices, the practical guidance is that the versions of ChatGPT most staff use (free web interface, mobile app) are not HIPAA compliant and cannot be used with PHI — patient names, dates of service, diagnoses, or any other individually identifiable health information.

Which AI tools are HIPAA compliant for medical practices?

AI tools that are HIPAA compliant for Florida medical practices (with appropriate BAAs in place) include: Microsoft 365 Copilot (Microsoft provides a BAA covering M365 and Copilot for healthcare); EHR-integrated AI features from Epic, Athena, and other HIPAA-covered EHR vendors; ambient documentation tools with HIPAA BAAs such as Nuance DAX and Suki; and Google Workspace with Google's HIPAA BAA covering approved Google services. The HIPAA compliance of any AI tool depends on: (1) the vendor providing a signed BAA before use; (2) configuring the tool to disable model training on your data; and (3) training staff on appropriate use. A BAA alone does not guarantee compliance — the tool must also be configured and used correctly.

Does HIPAA allow AI to be used in medical practices?

Yes, HIPAA allows the use of AI in medical practices when implemented with appropriate safeguards. HIPAA does not prohibit AI — it requires that any technology that creates, receives, maintains, or transmits PHI meet the Security Rule's administrative, physical, and technical safeguard requirements. For an AI tool, this means: the vendor must sign a BAA; the tool must use encryption; access must be limited to authorized users; audit logging must be available; and the tool must not disclose PHI to unauthorized parties (including using PHI to train models that are shared publicly). A medical practice that uses a HIPAA-compliant AI tool with a signed BAA, appropriate configuration, and staff training is operating within HIPAA's requirements.

What is a Business Associate Agreement (BAA) and why does it matter for AI?

A Business Associate Agreement (BAA) is a contract required by HIPAA between a covered entity (a medical practice) and any vendor that creates, receives, maintains, or transmits PHI on the practice's behalf. The BAA establishes the vendor's HIPAA obligations, including how PHI must be protected, when breaches must be reported, and what happens to PHI when the contract ends. For AI tools, the BAA is the legal document that makes the tool HIPAA-compatible for PHI processing. Without a BAA, using an AI tool with PHI is an unauthorized disclosure — regardless of how the tool handles the data technically. Many popular AI tools do not offer BAAs, or only offer them at enterprise pricing tiers, which is why practices must verify BAA availability before deploying any AI tool for clinical or administrative use involving PHI.

What should a Florida medical practice do before adopting AI tools?

Before adopting AI tools, a Florida medical practice should: (1) identify which workflows the AI tool will support and whether those workflows involve PHI; (2) verify that the vendor offers a BAA and obtain a signed copy before any PHI is processed; (3) confirm that the tool does not use PHI for model training — this should be explicitly stated in the BAA or data processing agreement; (4) update the practice's HIPAA risk analysis to include the new AI tool as a technology that handles PHI; (5) add the AI vendor to the practice's vendor risk management inventory; and (6) train all staff who will use the tool on HIPAA-appropriate use — including which data types can and cannot be entered.

AI and HIPAA Compliance for Florida Medical Practices — Which Tools Are Safe and Which Are Not

← Back to Blog

Healthcare IT

AI and HIPAA Compliance for Florida Medical Practices — Which Tools Are Safe and Which Are Not

July 7, 20268 min readSteve Condit — Founder, Simply IT

Healthcare IT

Florida medical and dental practices are adopting AI tools faster than their compliance programs can keep up. Ambient documentation AI that transcribes patient visits. AI coding assistants that suggest billing codes. AI scheduling tools that handle patient communication. AI writing tools that draft referral letters and care summaries. Most of these tools are genuinely useful. Several of the most popular ones are not HIPAA compliant — meaning practices that use them with patient data are creating unauthorized PHI disclosures every time a staff member types a patient name into the interface. The question is not whether AI is allowed under HIPAA. The question is whether the specific tool you are using right now has a signed BAA and does not use your patients' data for model training.

BAA

Required before any AI tool touches PHI

$50K-1.9M

OCR fine range per HIPAA violation category

HIPAA exemptions for AI — existing rules apply fully

60 days

Breach notification deadline after PHI disclosure

AI Tool Compliance Status for Florida Healthcare

Tool	BAA available?	PHI use guidance
ChatGPT (free / Plus)	No	Cannot be used with PHI — no BAA, may train on inputs
ChatGPT Enterprise / API	Yes (enterprise)	BAA available; disable training on data; requires enterprise contract
Microsoft Copilot (M365 add-on)	Yes (Microsoft HIPAA BAA)	Covered under Microsoft's standard HIPAA BAA — sign before use
Google Gemini (consumer)	No	Cannot be used with PHI — no BAA for consumer tier
Google Workspace + Gemini (Business/Enterprise)	Yes (Google HIPAA BAA)	Google HIPAA BAA covers Workspace; verify Gemini is included
Epic/Athena AI features	Yes (in EHR BAA)	Covered under existing EHR Business Associate Agreement
Nuance DAX (ambient documentation)	Yes	HIPAA-designed product with BAA — purpose-built for clinical use
Claude (Anthropic — consumer)	No	Cannot be used with PHI — no BAA for consumer tier

The 4-Step HIPAA AI Adoption Checklist

Verify the BAA before any PHI is entered

The BAA must be signed before the tool is used with any patient data — not after. Contact the vendor's enterprise or healthcare sales team to request the BAA. If the vendor cannot produce a BAA, the tool cannot be used with PHI, regardless of how the vendor describes their data handling in marketing materials. 'We take security seriously' and 'We are HIPAA compliant' are not substitutes for a signed BAA.

Confirm training on PHI is disabled

The BAA establishes the vendor's legal obligations, but you must also confirm the specific configuration setting that prevents the tool from using your patients' data to train its AI models. This setting may be on by default or off by default depending on the tool and tier. For Microsoft Copilot, Microsoft's standard M365 tenant configuration does not train on your data. For other tools, check the vendor's data processing documentation and confirm the configuration in writing.

Update your HIPAA risk analysis

HIPAA requires that the risk analysis be updated when technology changes occur in the environment. Adding an AI tool that processes PHI is a qualifying change. Update the risk analysis to include the new tool, document the BAA status, the data it accesses, the access controls in place, and any residual risk. This documentation is what OCR requests in an audit and what your cyber insurance carrier requests when reviewing healthcare coverage.

Train staff on appropriate use before go-live

Staff training on AI tools in HIPAA-covered contexts must cover: which tools are approved and which are not; what patient data can and cannot be entered into each approved tool; how to verify the accuracy of AI-generated clinical content before use; and what to do if PHI is accidentally entered into a non-approved tool. This training must be documented, with completion dates recorded by employee.

// Did You Know?

OCR's 2024 guidance on AI and HIPAA explicitly states that existing HIPAA rules apply to AI tools without modification — there is no AI exception. The guidance notes that covered entities are responsible for ensuring that any AI tool that accesses, processes, or generates PHI meets the Security Rule's technical safeguard requirements, and that Business Associate Agreements must be in place. OCR has not yet brought AI-specific enforcement actions, but has signaled that AI-related PHI disclosures will be investigated under existing HIPAA enforcement authority.

// Key Takeaway

The most common AI HIPAA compliance failure at Florida medical and dental practices is not malicious — it is staff using ChatGPT or Google Gemini consumer tier to help draft clinical documents, not realizing these tools do not have BAAs and may train on the data entered. A written AI policy, an approved tools list with BAA status for each tool, and 30 minutes of staff training eliminates most of this risk. Simply IT helps Florida healthcare practices implement HIPAA-compliant AI tools and document the compliance program that protects them if OCR comes looking.

// Related Reading

→ HIPAA Compliance for Ocala Medical Practices — What OCR Is Actually Auditing in 2026 → Why Every Florida Small Business Needs a Written AI Policy — and What to Put in It → Cyber Insurance for Florida Medical and Dental Practices — What HIPAA Doesn't Cover

Schedule a Free HIPAA AI Compliance Review →

// Written By

STEVE CONDIT

Founder & Owner, Simply IT · US Marine Veteran · 30+ Years IT Experience

Steve Condit founded Simply IT to bring enterprise-grade IT management to small and mid-sized businesses across North Central Florida. With over 30 years of IT experience and a background in the US Marine Corps, Steve built Simply IT around the principle that local businesses deserve the same quality of technology partnership that large companies take for granted — without long-term contracts or national call center support.

Full Bio →LinkedIn →About Simply IT →