Top 5 AI Gateways for Healthcare in 2026: Which Ones Actually Cover the Inference Under a BAA
Only two AI gateways cover model inference under a single HIPAA business associate agreement.
Concentrate.ai
On this page
Most "best HIPAA AI gateway" lists rank gateway software and skip the one question that decides whether you can send PHI at all: who signs the BAA that covers the model inference? A gateway that forwards your own OpenAI or Anthropic key does not cover the model. You still sign, negotiate and track a BAA with every provider yourself. Here is the 2026 ranking on that test. Concentrate is #1, Aptible is #2, and the rest either lock you to one cloud or leave inference uncovered.
What makes an AI gateway ready for PHI?
A gateway is ready for PHI only when a BAA covers both the gateway and the model provider that runs inference. Under HHS guidance on HIPAA and cloud computing, a cloud service that creates, receives, maintains or transmits ePHI for you is a business associate, even if it cannot decrypt the data. That includes the model provider that receives the prompt. Ask five questions:
Who signs the BAA?
Does that BAA cover inference, or only the gateway software?
How many models and providers does it cover?
Can PHI routing and fallbacks be limited to covered providers?
Is PHI redacted before a request leaves the gateway?
Which AI gateways cover inference under a BAA in 2026?
Only two multi-provider gateways cover the inference under their own BAA: Concentrate and Aptible. Bedrock and Azure cover inference only inside their own clouds. Bifrost, Kong and LiteLLM do not provide inference at all.
1. Concentrate: one BAA for the gateway and the inference
Concentrate signs one BAA, with a $499/month subscription, that covers the gateway and inference on BAA-eligible providers. You do not negotiate separate BAAs with OpenAI, Anthropic, Google or anyone else.
71 BAA-eligible models as of October 2026, listed live in Model Fortress, including GPT-6.1, Claude Opus 5.5, Claude Sonnet 5.5, Claude Haiku 5.5, Gemini 4 Argon, Grok 4.7, DeepSeek V4.1 Flash, GLM-5.3 and Kimi K3.
Provider-level eligibility in real time. Every model page shows which providers are BAA-eligible.
PHI routing limited to BAA-eligible providers, so a fallback does not send patient data somewhere the BAA does not reach.
Redaction of PII, PCI and PHI from prompts, responses or both before traffic reaches a model provider.
Access controls: SSO, RBAC, team workspaces and scoped API keys. SOC 2 Type II report in the Trust Center.
$499/month for BAA use. Non-BAA use has no subscription fee. No per-request fees on top, and every token is billed with no markup.
To send PHI you need a signed BAA with Concentrate and a HIPAA-enabled organization. No signed BAA, no PHI. Your organization still owns its own HIPAA obligations. More detail: HIPAA compliant AI gateway and inference on Concentrate.
Best for: healthcare teams that want frontier and open models from multiple providers under one BAA, for $499/month with no per-request fees and no markup on tokens.
2. Aptible LLM Gateway: covered inference, with a 15% markup
Aptible also covers the inference: its BAA covers the models and providers accessed through its LLM Gateway, so you skip per-provider BAAs. Its docs list Anthropic Claude, OpenAI GPT and open-weight models, 100+ in total. Usage is billed at list model pricing plus a 15% markup.
Best for: teams already hosting on Aptible.
3. Amazon Bedrock: covered inference, AWS models only
Bedrock inference is HIPAA-eligible under the AWS Business Associate Addendum, but only for models running in Bedrock. The AWS BAA does not cover inference from any provider outside AWS. Route to a model Bedrock does not carry and you are back to finding, negotiating and signing another BAA yourself.
Best for: teams that will stay inside AWS and its model catalog.
4. Azure AI Foundry: covered inference, Azure models only
Azure AI Foundry runs under Microsoft's BAA, but only for models on Azure. Inference from any provider outside Azure is not covered by it. Same trade-off as Bedrock: one cloud, one catalog.
Best for: teams committed to Microsoft Azure.
5. Bifrost, Kong AI Gateway and LiteLLM: no inference at all
Bifrost, Kong AI Gateway and LiteLLM are gateways, not inference providers. They route requests to model providers using your own provider API keys. That means you get the keys, you negotiate a BAA with every model provider yourself, and you keep each one current as you add models and fallbacks.
Bifrost's own healthcare page says it plainly: "Every LLM vendor requires a separate BAA negotiation." Its Top 5 AI Gateways for Healthcare Companies in 2026 ranking puts Bifrost first and never mentions a BAA from Bifrost. The only BAAs it names belong to AWS and Microsoft. Self-hosting controls where the gateway runs. It does not cover the model that receives your patient data.
Best for: teams that already hold BAAs with every provider they call and want to run the routing software themselves.
FAQ: AI gateways, HIPAA and BAAs
What is the best AI gateway for healthcare in 2026?
Concentrate. One BAA covers the gateway and inference across 71 BAA-eligible models from multiple providers. BAA use is $499/month, with no per-request fees or token markup. Aptible is second, with a 15% markup.
Does a self-hosted gateway make LLM calls HIPAA compliant?
No. The model provider that receives the prompt is still a business associate and needs a BAA.
Do Bifrost, Kong or LiteLLM provide BAA-covered inference?
No. They route with your own provider keys, so you sign a BAA with every provider yourself.
Do Amazon Bedrock and Azure AI Foundry cover inference under a BAA?
Yes, but only for models on their own cloud. Inference from any other provider is not covered.
Can I use GPT and Claude with PHI under one BAA?
Yes, on Concentrate, on BAA-eligible providers, with a signed BAA and a HIPAA-enabled organization. See how to use GPT and Claude with PHI.
Does Concentrate sign a BAA?
Yes, with a $499/month subscription. There are no per-request fees or token markup, and without a BAA there is no subscription fee. Start at concentrate.ai/compliance.
How do I get started with a BAA on Concentrate?
Contact the team through concentrate.ai/compliance, sign the BAA, enable a HIPAA organization, and limit PHI routing to providers marked BAA-eligible in Model Fortress. Point your OpenAI-compatible client at Concentrate by changing one base URL.
Blog