Is Claude HIPAA Compliant? How to Get a BAA for the Claude API Without an Enterprise Plan
Access Claude with health data through a BAA without paying for Enterprise.
Concentrate.ai
On this page
Claude is not HIPAA compliant by default, and no AI model is. Claude can be used with protected health information (PHI) when the product you use is covered by a signed Business Associate Agreement (BAA) and configured the way that BAA requires. For the Claude apps that means a HIPAA-ready Claude Enterprise plan. For the Claude API you have two routes: sign a BAA with Anthropic and have Anthropic turn it on, or use Claude through Concentrate, which signs one BAA covering Claude on Anthropic and Azure plus GPT, Gemini, DeepSeek, GLM and more.
Is Claude HIPAA compliant?
Claude is not HIPAA compliant out of the box; HIPAA compliance belongs to how you deploy it. Under HHS guidance, a cloud or AI service that creates, receives, maintains or transmits ePHI for you is a business associate and must sign a BAA. So the real question is which Claude products a BAA covers, and what you have to configure.
Claude Free, Pro, Max and Team: no BAA. Do not put PHI in them.
Claude Enterprise: Anthropic offers a HIPAA-ready Enterprise plan. The Primary Owner has to activate HIPAA in the organization settings and accept the BAA, and not every feature is covered.
Claude API (Anthropic direct): Anthropic says its BAA covers its first-party API, but your Primary Owner has to sign it and then contact Anthropic sales to turn it on, and not all API features are covered.
LLM Gateway
Instant access to every model
Change models, providers, add fallbacks, and more by running all AI usage through one platform.
Claude API through Concentrate: Concentrate signs the BAA, routes Claude only to BAA-covered providers with zero data retention, and adds GPT, Gemini, DeepSeek, GLM and other models under the same BAA.
Can I use the Claude API with PHI without a Claude Enterprise plan?
Yes. A Claude Enterprise plan covers the Claude apps your staff chat in; developers building a product call the Claude API, which is a separate contract. You can get API coverage from Anthropic directly or through a gateway that provides BAA-covered inference.
The trade-off is scope. A direct Anthropic BAA covers Claude on Anthropic's API only. If your app also uses GPT, Gemini or an open model like DeepSeek, you need a BAA with each of those providers too, and your failover has to stay inside those contracts. On Concentrate, one BAA covers every model on a BAA-eligible provider, and fallbacks only go to covered routes.
Which Claude models can I use with PHI on Concentrate?
Today, every current Claude model is BAA-eligible on Concentrate, served by Anthropic and Azure, with Claude Opus 4.6 and Claude Sonnet 4.6 also covered on Google Vertex AI.
Claude Opus 5, Sonnet 5, Opus 4.8, Opus 4.7, Opus 4.5, Sonnet 4.5, Haiku 4.5
Anthropic, Azure
Varies
Varies
Claude Opus 4.6, Sonnet 4.6
Anthropic, Azure, Google Vertex AI
Varies
Varies
Prices are per million tokens at provider rates, as of November 2026. See Model Fortress for the live list of BAA-eligible models and providers.
What do you need to use Claude with PHI on Concentrate?
A signed BAA with Concentrate. BAA access is $499/month. Inference is billed separately at provider rates, with no per-request fees and no markup on tokens. Without a BAA there is no subscription fee.
A HIPAA-enabled organization. Concentrate staff turn on HIPAA mode after the BAA is signed. It is not self-serve.
Routing limited to BAA-eligible providers. HIPAA mode enforces this for you.
You still own your own HIPAA obligations, such as access controls, workforce policies and your risk analysis.
How does Concentrate keep Claude requests on covered routes?
HIPAA mode locks the settings that matter for PHI across the organization and every key under it, as described on the HIPAA LLM gateway page:
Zero data retention stays on. A route has to support zero data retention or Concentrate will not use it.
Request-content logging stays off. Prompt and response bodies are not stored in Concentrate request logs.
Uncovered routes are blocked. If Anthropic has an outage, a fallback only goes to another covered route, such as Claude on Azure. If no covered route is left, the request is rejected.
Bring Your Own Key is off, because the BAAs do not cover your own provider accounts.
Anthropic direct vs Concentrate for HIPAA Claude API access
Anthropic direct
Concentrate
Who signs the BAA
Anthropic
Concentrate, backed by its BAAs with the serving providers
Models covered
Claude on Anthropic's API
Claude, GPT, Gemini, DeepSeek, GLM, Kimi, Grok and more on BAA-eligible providers
Failover
You build it, and each new provider needs its own BAA
Built in, limited to covered routes (for Claude: Anthropic, Azure, and Vertex for some models)
How you get started
Sign the BAA, then contact Anthropic sales to turn it on
Request a BAA; Concentrate turns on HIPAA mode
Fees
Anthropic API pricing
$499/month with a BAA (no subscription fee without one); no per-request fees or token markup
Not by default. Claude can be used with PHI when the product is covered by a signed BAA and configured as that BAA requires: a HIPAA-ready Claude Enterprise plan for the apps, or a BAA-covered Claude API through Anthropic or Concentrate.
Is Claude Pro or Claude Max HIPAA compliant?
No. Free, Pro, Max and Team plans have no BAA, so they should not be used with PHI.
Can I get a BAA for the Claude API?
Yes. Anthropic signs BAAs for its first-party API, and Concentrate signs a BAA that covers Claude on Anthropic and Azure plus other models.
Does Concentrate sign a BAA?
Yes. BAA use is $499/month, with no per-request fees and no markup on tokens. Non-BAA use has no subscription fee. Start at concentrate.ai/compliance.
Blog