HIPAA-Compliant LLM API: Models With a BAA (Nov 2026)
Which LLM APIs can take PHI under a BAA? GPT-6.1, Claude 5.5, Gemini 4 Argon, DeepSeek V4.1 and Kimi K3 under one BAA on Concentrate, plus alternatives.
Concentrate.ai
On this page
A HIPAA-compliant LLM API is one where the company running the inference signs a BAA with you and keeps PHI on covered routes. On Concentrate, one BAA covers 69 models across 7 BAA-eligible providers today, including GPT-6.1, Claude 5.5, Gemini 4 Argon, DeepSeek V4.1, GLM-5.3 and Kimi K3. Below is the full list by model family, and how the alternatives compare.
What makes an LLM API HIPAA compliant?
An LLM API can be used with PHI only when the provider handling the data has signed a BAA with you; the model itself is never compliant on its own. Under HHS guidance, a cloud or AI service that handles ePHI for you must sign a BAA. In practice you also want zero data retention, no logging of request content, and a way to stop requests from falling back to a provider you have no BAA with.
Which models have a BAA on Concentrate today?
Today, BAA-covered models on Concentrate include these, grouped by maker (newest first, examples as of November 2026):
Model family
Examples
BAA-eligible providers
Input / output $/M (example)
LLM Gateway
Instant access to every model
Change models, providers, add fallbacks, and more by running all AI usage through one platform.
Claude Opus 5.5, Sonnet 5.5, Haiku 5.5, plus older Claude 4.5 to 5 routes
Anthropic, Azure (some older Claude models also on Google Vertex AI)
Sonnet 5.5: $2.00 / $10.00
Google Gemini
Gemini 4 Argon, Gemini 3.8 Flash, plus older routes
Google Vertex AI
Gemini 4 Argon: $2.00 / $10.00
DeepSeek
DeepSeek V4.1 Flash 1017, V4.1 Flash, V3.2
Azure, Azure Fireworks, Baseten, Fireworks AI
V4.1 Flash 1017: $0.30 / $1.20
Zhipu GLM
GLM-5.3, GLM-5.3-Flash
Azure Fireworks, Baseten, Fireworks AI
GLM-5.3-Flash: $0.15 / $0.50
Moonshot Kimi
Kimi K3, Kimi K3.1 Pro
Baseten, Fireworks AI
Kimi K3: $3.00 / $15.00
Others
Grok 4.7, Qwen3.8 Max, MiniMax M3, gpt-oss 120B
Varies by model
See the model page
Every covered route, with prices, is on the HIPAA LLM gateway page. See Model Fortress for the live list; we keep adding BAA-eligible providers.
How do the HIPAA LLM API options compare?
Most options cover one cloud or one model maker; Concentrate covers several model families under one BAA with covered failover.
Option
Who signs the BAA
Models covered
Fees
Concentrate
Concentrate
GPT, Claude, Gemini, DeepSeek, GLM, Kimi and more on 7 BAA-eligible providers
$499/month with a BAA (no subscription fee without one); no per-request fees or token markup
Aptible LLM Gateway
Aptible
Anthropic, OpenAI and Bedrock-hosted models
$200/month plus token usage
Amazon Bedrock
AWS
Eligible Bedrock models, checked model by model; AWS only
AWS pricing
Azure AI Foundry
Microsoft
In-scope Azure services; third-party Foundry models can have different terms; Azure only
Azure pricing
OpenAI direct
OpenAI
OpenAI models only
OpenAI pricing
Fireworks direct
Fireworks
Open models; no Claude or frontier GPT
Fireworks pricing
Aptible covers "Anthropic, OpenAI, and Bedrock-hosted models under a single BAA" (Aptible pricing). Best for: teams that only need Anthropic, OpenAI and Bedrock models.
Azure includes a HIPAA BAA in Microsoft's Product Terms for in-scope services (Microsoft). Best for: teams all-in on Azure.
Fireworks states HIPAA support and zero data retention for open models (Fireworks). Best for: open models only.
Why not just use Azure AI Foundry or Bedrock for everything?
You can, but one cloud's BAA doesn't automatically cover every model in its catalog, so you still check coverage model by model. Microsoft's BAA covers in-scope Azure services, and third-party Foundry models can have different terms. Claude in Microsoft Foundry is covered by Anthropic's own BAA, which the customer's Primary Owner signs (Anthropic). On Bedrock, eligibility is checked model by model under the AWS BAA. Concentrate publishes every covered route, model by model, on one page, and blocks the rest.
Is $499/month worth it compared with direct BAAs?
It is when you use more than one model maker. OpenAI and Anthropic each offer BAAs for their own APIs, but each covers only that maker's models, so GPT plus Claude plus an open model means separate agreements, separate keys and no covered failover between them. On Concentrate, BAA use is $499/month for all covered routes, inference is billed at provider rates, and there are no per-request fees and no markup on tokens. Without a BAA there is no subscription fee. If you only ever call one maker's models, a direct BAA may be enough.
Why not use a gateway like OpenRouter, Portkey or LiteLLM?
None of them both runs the inference and signs a BAA that covers it. OpenRouter's enterprise page lists SOC 2 Type II and a DPA, not a BAA. Portkey stores your own provider keys (Portkey docs), so you need a BAA with every model provider. LiteLLM is an open-source proxy you deploy yourself (LiteLLM docs), so you run the infrastructure and negotiate each BAA.
How does Concentrate keep PHI on covered routes?
HIPAA mode locks the settings that matter, so PHI cannot drift to an uncovered provider:
Zero data retention is locked on, and request-content logging is locked off.
Uncovered routes are blocked, including fallbacks; if no covered route is left, the request is rejected.
The auto router only picks covered, zero-retention routes.
Bring-your-own-key is off, because the BAAs don't cover your own provider accounts.
Start the $499/month BAA subscription and sign the BAA. There are no per-request fees and no markup on tokens.
We turn on HIPAA mode for your organization.
Call any covered model through one API.
FAQ: HIPAA-compliant LLM APIs
Is there a HIPAA-compliant LLM API?
Yes, when the provider signs a BAA and keeps PHI on covered routes. Concentrate covers 69 models across 7 BAA-eligible providers under one BAA today.
Is GPT-6.1 HIPAA compliant?
GPT-6.1 Sol and Terra can be used with PHI on Concentrate under a signed BAA, on OpenAI or Azure. See GPT-6.1 Sol.
Is Claude HIPAA compliant through an API?
Claude Opus, Sonnet and Haiku 5.5 can be used with PHI on Concentrate under a signed BAA, on Anthropic or Azure. More in Is Claude HIPAA compliant?
Does Concentrate sign a BAA?
Yes. BAA use is $499/month, with no per-request fees and no markup on tokens. Without a BAA there is no subscription fee. Start at concentrate.ai/compliance.
Can I use open models like DeepSeek with PHI?
Yes. DeepSeek V4.1 Flash runs on four BAA-eligible providers on Concentrate. See DeepSeek V4.1 Flash BAA.
Blog