What AI Is HIPAA Compliant? Every Model and Provider You Can Use With PHI Under a BAA (November 2026)

No AI model is HIPAA compliant on its own. What makes AI usable with protected health information (PHI) is the route: the specific provider serving the model has to be covered by a signed Business Associate Agreement (BAA), with the data handling that BAA requires. As of November 4, 2026, Concentrate covers 70 models across 7 serving providers under one BAA. The full list, by model maker and provider, is below.

What AI is HIPAA compliant?

An AI model can be used in a HIPAA-compliant way when every party that touches PHI has signed a BAA and the deployment follows it. Under HHS guidance, a cloud or AI service that handles ePHI for you is a business associate and must sign a BAA. That makes the provider as important as the model: the same model can be covered on one provider and not on another.

That is why this list names both. Each row below is a route that Concentrate marks as BAA-covered and running with zero data retention.

Which models and providers can I use with PHI under a BAA?

Today, BAA-eligible routes on Concentrate include models from OpenAI, Anthropic, Google, xAI, DeepSeek, Zhipu (GLM), Moonshot (Kimi), Qwen, MiniMax and NVIDIA, served by Anthropic, OpenAI, Azure, Google Vertex AI, Fireworks AI, Azure Fireworks and Baseten.

Model maker	BAA-eligible models (newest first)	BAA-eligible providers	Example price, input / output $/M
OpenAI	GPT-6.1 Sol, GPT-6.1 Terra, GPT-6 Astra, GPT-6 Sol, GPT-6 Luna, GPT 5.6 Sol, Terra and Luna, GPT 5.5, GPT 5.4 family, GPT 5.3 Codex, plus older GPT-5 and GPT-4 routes	OpenAI, Azure	GPT-6.1 Sol: $2.00 / $10.00
OpenAI (open-weight)	gpt-oss 120B	Azure, Fireworks AI	$0.15 / $0.60
Anthropic	Claude Opus 5.5, Claude Sonnet 5.5, Claude Haiku 5.5, Claude Opus 5, Sonnet 5, Opus 4.8, 4.7, 4.6, 4.5, Sonnet 4.6, 4.5, Haiku 4.5

List as of November 4, 2026. Prices are per million tokens at provider rates. Concentrate keeps adding BAA-eligible routes, so check Model Fortress or the HIPAA LLM gateway page for the live list.

Which providers are covered, and what do they serve?

Anthropic: Claude models.
OpenAI: GPT models.
Azure: GPT, Claude, Grok, DeepSeek, Kimi and gpt-oss.
Google Vertex AI: Gemini, plus Grok 4.7 and some Claude models.
Fireworks AI: open models including DeepSeek, GLM, Kimi, Qwen, MiniMax and Nemotron.
DeepSeek and GLM.

Why does the provider matter as much as the model?

Because the BAA covers a route, not a model name. A model can be served by a dozen providers, and only some of them are BAA-eligible. GLM-5.3, for example, is BAA-eligible on 3 of the 13 providers that serve it on Concentrate. If your app falls back to an uncovered provider during an outage, PHI leaves your BAA.

On a HIPAA organization, Concentrate blocks uncovered routes, including fallbacks. If no covered route is left, the request is rejected instead of sent to an uncovered provider.

What do you need to use these models with PHI?

A signed BAA with Concentrate. BAA access is $499/month. Inference is billed separately at provider rates, with no per-request fees and no markup on tokens. Without a BAA there is no subscription fee.
A HIPAA-enabled organization. Concentrate staff turn on HIPAA mode after the BAA is signed. It locks zero data retention on, keeps request-content logging off and turns off Bring Your Own Key.
Routing limited to BAA-eligible providers, which HIPAA mode enforces.

You still own your own HIPAA obligations, such as access controls and your risk analysis.

FAQ: HIPAA-compliant AI models and providers

What AI is HIPAA compliant?

None on its own. Models like Claude, GPT, Gemini, DeepSeek and GLM can be used with PHI when the provider serving them is covered by a signed BAA and the deployment follows it. The table above lists the covered routes on Concentrate.

Is ChatGPT HIPAA compliant?

Consumer ChatGPT plans such as Free, Plus and Pro are not covered by a BAA. GPT models can be used with PHI through a BAA-covered API route, such as GPT on OpenAI or Azure through Concentrate.

Can I use open models like DeepSeek or GLM with PHI?

Yes, on BAA-eligible providers. On Concentrate, DeepSeek and GLM are covered on Fireworks AI, Azure Fireworks and Baseten, and some DeepSeek models on Azure.

Does one BAA cover all of these models?

On Concentrate, yes. One BAA covers every model on a BAA-eligible provider.

Does Concentrate sign a BAA?

Yes. BAA use is $499/month, with no per-request fees and no markup on tokens. Non-BAA use has no subscription fee. Start at concentrate.ai/compliance.