How does Concentrate do OpenRouter-style routing under a BAA?

You sign one BAA with Concentrate, and we turn on HIPAA mode for your organization. From then on, these settings are locked for every key ([HIPAA LLM gateway](https://concentrate.ai/hipaa-llm-gateway)): - Zero data retention is locked on, and request-content logging is locked off. - Uncovered routes are blocked, including fallbacks; if no covered route is left, the request is rejected. - Set the model to "auto" and the auto router only picks BAA-covered, zero-retention routes. - Bring-your-own-key is off, because the BAAs don't cover your own provider accounts. The API is OpenAI-compatible, so moving from OpenRouter usually means changing the base URL and key. See [migrating from OpenRouter](https://concentrate.ai/migrate/openrouter).

Which models can I route to under the BAA?

Today, BAA-covered routes on Concentrate include frontier and open models side by side (examples as of November 2026): | Model | BAA-covered providers | Input / output $/M | | --- | --- | --- | | [GPT-6.1 Sol](https://concentrate.ai/models/gpt-6.1-sol) | OpenAI, Azure | $2.00 / $10.00 | | Claude Sonnet 5.5 | Anthropic, Azure | $2.00 / $10.00 | | Gemini 4 Argon | Google Vertex AI | $2.00 / $10.00 | | DeepSeek V4.1 Flash 1017 | Baseten, Fireworks AI, Azure Fireworks | $0.30 / $1.20 | | GLM-5.3 | Baseten, Fireworks AI, Azure Fireworks | $1.40 / $4.40 | | GLM-5.3-Flash | Baseten, Fireworks AI, Azure Fireworks | $0.15 / $0.50 | | Kimi K3 | Baseten, Fireworks AI | $3.00 / $15.00 | | MiniMax M3 | Fireworks AI | $0.30 / $1.20 | | Qwen3.8 Max | Fireworks AI | $2.00 / $6.00 | Prices are the lowest covered provider rate. Every covered route is on the [HIPAA LLM gateway page](https://concentrate.ai/hipaa-llm-gateway); see [Model Fortress](https://concentrate.ai/models?baa=true) for the live list. We keep adding BAA-eligible providers.

How do the OpenRouter-style HIPAA options compare?

| Option | BAA for inference | Models | Availability | Fees | | --- | --- | --- | --- | --- | | Concentrate | Yes, signed by Concentrate | GPT, Claude, Gemini and open models (DeepSeek, GLM, Kimi, Qwen, MiniMax) on 7 BAA-eligible providers | Live today | $499/month with a BAA (no subscription fee without one); no per-request fees or token markup | | OpenRouter | No; SOC 2 Type II and DPA | Large catalog | Live | OpenRouter pricing | | OpenMed Router | Says it signs a BAA | Open source models only | Waitlist; onboarding design partners | Not published | | Aptible LLM Gateway | Yes, signed by Aptible | Anthropic, OpenAI and Bedrock-hosted models | Live | $200/month plus token usage | - **OpenRouter**: best for non-PHI workloads where you want the widest catalog ([OpenRouter enterprise](https://openrouter.ai/enterprise)). - **OpenMed Router** describes itself as "OpenRouter-style routing" for open source models and is "currently onboarding design partners" with a waitlist ([OpenMed Router](https://openmedrouter.com/)). Best for: teams that only want open models and can wait for general availability. - **Aptible** covers "Anthropic, OpenAI, and Bedrock-hosted models under a single BAA" ([Aptible pricing](https://www.aptible.com/pricing)). Best for: teams that only need those models. - **Concentrate**: best for teams that want GPT, Claude, Gemini and open models in one API under one BAA, with covered failover, available now.

Why do frontier and open models under one BAA matter?

Because most healthcare apps use both. A team might run Claude or GPT-6.1 for hard clinical reasoning and DeepSeek V4.1 Flash or GLM-5.3-Flash for high-volume summaries at a fraction of the cost. With one BAA, switching between them is a parameter change, not a new contract. Failover also stays covered: Claude between Anthropic and Azure, GPT-6.1 between OpenAI and Azure, and DeepSeek V4.1 Flash across four providers.

How do I get started?

1. Contact us through [concentrate.ai/compliance](https://concentrate.ai/compliance). 2. Start the $499/month BAA subscription and sign the BAA. There are no per-request fees and no markup on tokens. 3. We turn on HIPAA mode for your organization and confirm before you send PHI. 4. Point your OpenAI-compatible client at Concentrate and call any covered model, or set the model to "auto".

Blog

OpenRouter-Style HIPAA / BAA Routing on Concentrate

Need OpenRouter-style routing with a HIPAA BAA? Concentrate routes GPT, Claude, Gemini, DeepSeek, GLM and Kimi to BAA-covered providers for $499/month.

Concentrate.aiNov 10, 2026

On this page

Yes, you can get OpenRouter-style routing with a HIPAA BAA. OpenRouter itself doesn't offer a BAA, but Concentrate gives you the same one-API, swap-the-model-name experience and signs a BAA that covers the inference: 69 models across 7 BAA-eligible providers today, including GPT-6.1, Claude 5.5, Gemini 4 Argon, DeepSeek V4.1, GLM-5.3, Kimi K3 and Qwen3.8 Max. HIPAA mode keeps every request, fallback and auto-routed call on BAA-covered routes.

Does OpenRouter sign a BAA?

No. OpenRouter's enterprise page lists SOC 2 Type II and a DPA, and does not mention a BAA or HIPAA. Under HHS guidance, a cloud or AI service that handles ePHI for you must sign a BAA, so PHI should not go through OpenRouter. If you like how OpenRouter works, the answer is a router that does the same thing under a BAA.

What is OpenRouter-style HIPAA routing?

It is one API key and one endpoint for many models, where you switch models by changing a single parameter, with a BAA that covers every route the router can use. Three things make it HIPAA-ready:

A signed BAA that covers the inference, not just the gateway software.
Routing limited to providers that are BAA-covered and zero data retention, including fallbacks.
No storage of prompt and response content in request logs.

OpenRouter-Style HIPAA / BAA Routing on Concentrate

Does OpenRouter sign a BAA?

What is OpenRouter-style HIPAA routing?

Instant access to every model

How does Concentrate do OpenRouter-style routing under a BAA?

Which models can I route to under the BAA?

How do the OpenRouter-style HIPAA options compare?

Why do frontier and open models under one BAA matter?

How do I get started?

FAQ: OpenRouter, HIPAA and BAA routing

Model	BAA-covered providers	Input / output $/M
GPT-6.1 Sol	OpenAI, Azure	$2.00 / $10.00
Claude Sonnet 5.5	Anthropic, Azure	$2.00 / $10.00
Gemini 4 Argon	Google Vertex AI	$2.00 / $10.00
DeepSeek V4.1 Flash 1017	Baseten, Fireworks AI, Azure Fireworks	$0.30 / $1.20
GLM-5.3	Baseten, Fireworks AI, Azure Fireworks	$1.40 / $4.40
GLM-5.3-Flash	Baseten, Fireworks AI, Azure Fireworks	$0.15 / $0.50
Kimi K3	Baseten, Fireworks AI	$3.00 / $15.00
MiniMax M3	Fireworks AI	$0.30 / $1.20
Qwen3.8 Max	Fireworks AI	$2.00 / $6.00

Option	BAA for inference	Models	Availability	Fees
Concentrate	Yes, signed by Concentrate	GPT, Claude, Gemini and open models (DeepSeek, GLM, Kimi, Qwen, MiniMax) on 7 BAA-eligible providers	Live today	$499/month with a BAA (no subscription fee without one); no per-request fees or token markup
OpenRouter	No; SOC 2 Type II and DPA	Large catalog	Live	OpenRouter pricing
OpenMed Router	Says it signs a BAA	Open source models only	Waitlist; onboarding design partners	Not published
Aptible LLM Gateway	Yes, signed by Aptible	Anthropic, OpenAI and Bedrock-hosted models	Live	$200/month plus token usage

Does OpenRouter sign a BAA?

What is OpenRouter-style HIPAA routing?

Instant access to every model

How does Concentrate do OpenRouter-style routing under a BAA?

Which models can I route to under the BAA?

How do the OpenRouter-style HIPAA options compare?

Why do frontier and open models under one BAA matter?

How do I get started?

FAQ: OpenRouter, HIPAA and BAA routing

Related