All five major routes to frontier models offer a HIPAA BAA in 2026: OpenAI, Anthropic, Google Cloud, AWS Bedrock and Microsoft Azure. None covers everything. Each BAA applies only to listed products, endpoints or features, and retention settings differ. The practical choice is usually the cloud you already have a BAA with, then checking each feature you call.
"Does this model provider sign a BAA?" used to be the end of the conversation. In 2026 it is the start. Every provider has a BAA, but the coverage is now feature-level: the Messages API may be covered while the Files API is not, a model may be available only with 30-day retention, web grounding may log queries you cannot turn off. Architecture choices made in week one decide whether your app stays inside the covered set. This guide compares the five main routes against their own published documentation, read on 12 November 2026. Terms change often; treat this as a map, then confirm with your executed agreement.
Which LLM providers sign a HIPAA BAA in 2026?
OpenAI, Anthropic, Google Cloud, AWS and Microsoft all sign BAAs for their enterprise and API offerings. Consumer apps are not covered by any of them. Coverage is limited to named services, and several require you to enable a HIPAA configuration or a modified retention mode before sending PHI.
| Route | How you get the BAA | What is covered | Retention notes | Notable exclusions |
|---|---|---|---|---|
| OpenAI API | Request from OpenAI; BAA must name API as an Eligible Service | Listed HIPAA endpoints | Requires a "Modified Retention" mode (e.g. ZDR or modified abuse monitoring) | No PHI as part of a designated record set; no patient end-user accounts |
| Anthropic API | Sign BAA; Anthropic provisions a HIPAA-ready organization | Messages, Token Counting, Models APIs and listed features | Covered models require 30-day retention; not with ZDR unless authorized | Batch, Files, Skills APIs, code execution, web fetch; data sent via external MCP |
| Google Cloud (Vertex / Gemini Enterprise Agent Platform) | Accept Google Cloud BAA in console | Services on Google's HIPAA list, incl. generative AI on its agent platform | Implicit caching on by default (up to 24 h) unless disabled | Services not on the list; Grounding with Google Search stores queries up to 3 days |
| AWS Bedrock | AWS BAA in AWS Artifact | Bedrock is HIPAA-eligible; model providers have no access to prompts | Retention mode per Region: none, default, or aws_review (up to 30 days) | Some newer models require aws_review; zero retention for them only by approval |
| Microsoft Azure (Foundry, Azure OpenAI) | Included by default in Microsoft's Data Protection Addendum | In-scope Azure services | Abuse monitoring may store flagged samples for human review; modified monitoring by approval | Preview features may follow different terms |
What does OpenAI's BAA cover?
OpenAI offers a BAA for API healthcare customers and for ChatGPT for Healthcare and regulated ChatGPT workspaces. For the API, the BAA must expressly list the API as an Eligible Service, the organization must be provisioned with a Modified Retention feature, and PHI may go only to the endpoints OpenAI lists as HIPAA-eligible.
The OpenAI HIPAA Implementation and Configuration Guide (posted 9 July 2026) sets the rules. Modified Retention can mean Modified Abuse Monitoring, Zero Data Retention, Safety Retention or "Eyes Off", and it must be active for each Org ID and Project that carries PHI. Three rules catch engineering teams:
- No designated record set. You may not use OpenAI services to maintain PHI as part of a designated record set. Your EHR or database stays the source of truth.
- No patient accounts. You may not create OpenAI end-user accounts for patients, plan members or their families.
- Stateful endpoints differ. OpenAI's data controls page marks some endpoints as eligible for zero data retention and others, which keep application state such as threads and vector stores, as not eligible. Check each endpoint you use against the HIPAA endpoint list and the retention table.
What does Anthropic's BAA cover?
Anthropic covers its first-party API once the BAA is signed and a HIPAA-ready organization is provisioned, which blocks non-covered features. The Messages API with prompt caching, structured outputs, memory, web search, and the bash and text editor tools is covered; the Batch, Files and Skills APIs, code execution and web fetch are not.
Anthropic's privacy center also lists coverage for Claude Enterprise (with HIPAA turned on by the primary owner), Claude Code in specific configurations, and Claude in Microsoft Foundry with the HIPAA configuration. Three details matter for design:
- Retention. Covered models require 30-day data retention and are not available with zero data retention unless Anthropic authorizes it for your organization. If your security policy says "ZDR only", that conflicts with the default HIPAA path.
- Agreement version. Messages API coverage applies to BAA versions accepted after 1 April 2026, and Enterprise chat coverage to versions accepted after 2 December 2025. Older agreements may cover less.
- MCP. External MCP servers are available but data sent to them leaves the BAA. If you build tools for an agent, host them inside your own boundary; we cover that in MCP server development.
Are Google Gemini and Vertex AI covered by a BAA?
Yes, for services on Google Cloud's HIPAA list, which includes generative AI on its agent platform (the product line formerly called Vertex AI) and Gemini in Google Workspace. The Gemini API through Google AI Studio is not on that list. You accept the Google Cloud BAA and must not use unlisted services with PHI.
Google's HIPAA compliance page says to disable unsupported services, and if you cannot disable one, not to use it for PHI. Its zero data retention guide adds the details that matter:
- Implicit caching is on by default for supported Gemini models, with data deleted within 24 hours. You can turn it off at the project level.
- Abuse monitoring may log prompts under Google Cloud's terms for some models.
- Grounding with Google Search keeps derived query logs for up to three days, and this cannot be disabled; Google points to its enterprise web grounding option for zero retention.
How do AWS Bedrock and Azure handle BAAs and retention?
Both cover their model platforms under the cloud BAA you probably already have. AWS lists Bedrock as HIPAA-eligible and lets you set a retention mode per Region; Azure includes the BAA in Microsoft's data protection addendum and keeps models inside Azure, with abuse monitoring you can modify only with approval.
AWS Bedrock
Bedrock is on the AWS HIPAA-eligible services list. AWS's data protection documentation says model providers have no access to Bedrock logs or customer prompts and completions. Its data retention controls offer modes: none (zero retention), default (model's policy; AWS may retain for abuse prevention) and aws_review (retained up to 30 days and possibly reviewed by AWS, never shared with the provider). Some newer frontier models require aws_review; zero retention for those is by approval only. You can enforce a mode organization-wide with a service control policy.
Microsoft Azure
Microsoft makes its HIPAA BAA available by default through its data protection addendum for in-scope services. Its Foundry data privacy page says prompts and completions are not available to OpenAI or other model providers and are not used to train foundation models. Abuse monitoring may store flagged prompts for human review; managed customers can apply for modified abuse monitoring, and the resource then shows ContentLogging: false. Stateful features such as the Responses API and Assistants threads store data in your resource. Confirm that the specific model and features you use are in Azure's in-scope list.
What does zero data retention actually mean for HIPAA?
Zero data retention means the provider does not keep prompts and outputs after responding. It is a privacy control, not a HIPAA requirement, and it is not always compatible with the HIPAA path: Anthropic's covered models need 30-day retention, and some Bedrock models need review mode.
What HIPAA requires is a BAA, safeguards and minimum necessary use. Retention with a business associate under a BAA is allowed. ZDR reduces the blast radius if something goes wrong, but it can disable features you rely on (stateful conversations, stored responses, some tools). Decide which matters more for each workload. Many teams use ZDR or the strictest mode for high-volume inference and keep stateful features for non-PHI workloads. Combine either with tokenization; see de-identifying PHI for LLMs.
How should you choose an LLM provider for a HIPAA workload?
Start from the cloud where your PHI already lives and its BAA, then pick models available there. Choose a direct provider BAA only when you need a feature or model the cloud route lacks. Then map every API feature your app uses against the covered list before writing code.
- List your features. Chat, tool calls, file upload, batch, embeddings, web search, code execution, realtime voice.
- Check coverage per feature on the provider's current page, not a blog post (including this one).
- Pick a retention mode and check it does not disable a feature you need.
- Enforce it in code. Use separate projects or accounts for PHI workloads, block uncovered endpoints at your gateway, and alert if a request goes to one.
- Keep models swappable. Coverage and model availability change. An abstraction layer with pinned model versions and an evaluation suite lets you move without a rewrite; see LLM testing for regulated industries.
And remember the BAA is one control, not compliance. You still need access control, audit logs and human review where it matters; our HIPAA-compliant AI agent architecture lays out the full stack.
How BeevR builds this
We start every healthcare AI build with a coverage map: each model call and feature mapped to the provider's covered list and retention mode, reviewed with your compliance lead. Then we enforce it in the architecture: a model gateway that only routes PHI to covered endpoints, separate accounts for PHI and non-PHI workloads, tokenization before inference, pinned model versions with evals in CI, and audit logs of every call. The model can run inside your own AWS account under your AWS BAA, or through Azure or Google Cloud if that is where your data lives, and BeevR signs a BAA as your business associate.
We are a senior, founder-led team in Hanoi, rated 5.0 on Clutch, and we built a multi-tenant EHR now live across four US clinics at about 300 patients a day. We work in fixed phases, from $10K per phase, and you own the code from day one. See our HIPAA-compliant AI agent and healthcare AI agent development pages.
If you are choosing a model provider for PHI, book a 30-minute call. Send your feature list beforehand and we will mark which calls are covered on which route.