BlogBlogHealthcare teams can use Claude Code safely by routing requests through a HIPAA-compliant gateway.
Zach Moskow
Healthcare developers need AI coding help on real systems: investigating a failed job, fixing a production bug or updating infrastructure. Those tasks can expose protected health information through logs, database output and tool results even when the source code contains no patient data.
Concentrate offers a BAA covering its gateway and eligible managed inference routes. That gives healthcare engineering teams a covered path for approved model requests, with model access controls and spend tracking. The coding application, local session storage and connected tools must also fit the organization’s approved setup.
Anthropic now documents covered local Claude Code configurations on qualifying HIPAA-ready Enterprise plans, with the required organization settings applied. Its BAA coverage table distinguishes those sessions from extensions, cloud sessions, connectors and other excluded features.
Importantly, Anthropic’s Enterprise HIPAA configuration excludes Claude Code sessions that connect through an LLM gateway or custom base URL. Connecting Claude Code to Concentrate does not carry Anthropic’s direct Enterprise coverage over to that connection. API-key configurations have their own eligibility and retention conditions.
Use the current product-specific implementation requirements to decide which client configuration your organization can approve. Treat the gateway’s agreement and the coding tool’s data handling as separate checks.
A BAA for a gateway does not automatically establish coverage for every upstream model service. Some gateway arrangements require the customer to supply provider credentials and maintain separate provider agreements. Ask who supplies the inference and which serving routes the agreement covers.
With Concentrate, ask for a signed BAA, a HIPAA-enabled organization and confirmation of the specific eligible model-and-provider routes for your workload. Confirm the primary route and each fallback. A model may have a covered provider route and other routes that are not covered.
This is the practical distinction: the request-handling gateway and the eligible inference path both need appropriate coverage. A badge on a vendor website, a model name or an API key is not enough to establish it.
Consider a failed appointment-notification job. The initial debugging context can contain the error code, relevant function and a synthetic record. It does not need the patient’s name, full chart or entire production log.
If real PHI is necessary for an approved diagnostic task, restrict access to the minimum needed, use the approved request path and keep the resulting context out of unapproved storage. Separate read-only investigation from write access. Have a person review the patch, test it in staging and deploy through the normal approval process.
A BAA is not permission for an agent to make unrestricted production changes.
Inspect what the coding tool stores locally, what it sends as telemetry, whether it shares sessions, and which plugins or MCP servers can receive data. A terminal command that prints patient records can place PHI into the next model request. A support connector can create another destination for that same data.
Use approved credentials, retention settings and connected services. Keep payload logging off where required, and retain appropriate usage and administrative audit events. Metadata itself may contain patient or employee identifiers, so it needs review too.
Zero data retention and a BAA address different requirements. HIPAA does not universally mandate ZDR; the applicable agreements, eligible service and organization’s requirements determine the necessary settings. Confirm Concentrate’s required configuration for each selected route.
PII redaction can reduce what leaves the client or gateway, but redaction does not automatically make data de-identified under HIPAA. HHS explains that cloud use requires appropriate agreements and safeguards, alongside the customer’s own risk analysis.
Talk to Concentrate about BAA-covered gateway and inference access for your healthcare engineering team. Bring the coding tools, model routes and connected production services you plan to use so the approved request path is explicit.
LLM Gateway
Change models, providers, add fallbacks, and more by running all AI usage through one platform.