HIPAA LLM Gateway

HIPAA data on Claude, GPT, Gemini, and many more

Zero data retention stays locked on. Logging stays off. Every request goes only to BAA-covered routes, including the ones our auto router picks.

Request BAA-covered accessView covered models

Example HIPAA organization

  • HIPAA modeOn
  • Zero data retentionLocked on
  • Request-content loggingLocked off
  • Provider routesBAA-covered only
  • Auto routerCovered and ZDR only
  • Bring Your Own KeyOff

What HIPAA mode locks

These settings apply to the organization and every key under it. Nobody on your team can turn them off. PHI redaction is a separate setting. See data redaction and model access policies.

Zero data retention stays on
The organization cannot turn it off. A route has to support zero data retention or Concentrate will not use it.
Request-content logging stays off
Prompt and response bodies are not written to request logs. The organization cannot turn that storage back on.
Uncovered routes are blocked
A provider without a BAA is skipped, including when it is listed as a fallback. If no covered route is left, the request is rejected.
The auto router stays covered
Set the model to “auto” and Concentrate picks one. It only picks BAA-covered routes with zero data retention.
Bring Your Own Key is off
The BAAs do not cover your own provider accounts, so requests use Concentrate’s covered routes.

Covered models and providers

Every route below is covered by a BAA and runs with zero data retention. Caching is supported. Web search depends on the search tool, so check with us before using it with PHI. Click a model or provider to open it in Model Fortress.

Prices per 1M tokens at provider rates

ModelInputOutput

BAA-eligible models in Model FortressEvery model

Data handling

What Concentrate keeps and what it does not. More detail is in the zero data retention docs and the pages for request logs and audit logs.

Provider retention
Every covered route is one the provider marks as zero data retention. That is a separate check from Concentrate’s own logs.
Prompt and response storage
Concentrate does not store prompt or response bodies for a HIPAA organization.
Operational metadata
Concentrate still records the model, provider, token usage, cost, key, status, and elapsed time, so you can see spend and request outcomes.
Audit records
Audit logs record settings and access changes, such as members, keys, and teams. They do not store prompt content.

Getting started

HIPAA mode is not self-service. It is turned on after the BAA is signed.

  1. 01

    Sign the BAA

    Request a BAA. We review the models, endpoints, and features your app needs.

  2. 02

    We turn on HIPAA mode

    Concentrate staff activate your organization. The locks above apply from that point. We confirm activation before you send PHI.

  3. 03

    Test with synthetic data

    Sign in and send text that is not real patient information, using a key on that organization.

  4. 04

    Go to production

    Send PHI only through the activated organization and its keys.

Synthetic test request

curl https://api.concentrate.ai/v1/responses \
  -H "Authorization: Bearer $CNAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "beam-1.0-501b-a23b",
    "input": "Summarize this synthetic note. Patient name: Example Patient. This text is not a real medical record."
  }'

Pricing

$499 a month
Access to all of our BAAs.
Inference
Billed separately at provider rates, with no markup.

For details on the API and inference, see HIPAA Inference.

Security evidence

HIPAA does not certify AI gateways. The BAAs set the terms, and the locked settings keep traffic on covered routes. You remain responsible for your own HIPAA obligations.

Frequently asked questions

How much does the HIPAA-compliant gateway cost?
$499 a month. That gets you access to all of our BAAs: yours with Concentrate, and ours with the providers that serve covered routes. Inference is billed separately at provider rates, with no markup. For details on the API and inference, see HIPAA Inference.
Which models and provider routes are covered?
Routes the catalog marks as BAA-covered and eligible for zero data retention. Coverage depends on the serving provider, endpoint, and enabled features. The full list is in covered models and in the BAA-eligible filter in Model Fortress.
What happens to prompts and responses?
Request-content logging is locked off, so prompt and response bodies are not stored in Concentrate request logs. Concentrate still keeps the model, provider, token usage, cost, key, status, and elapsed time. Audit logs record settings and access changes, not prompt content.
What happens during a provider outage?
If you set fallbacks, Concentrate tries the next route only when it is also BAA-covered and eligible for zero data retention. If no permitted route is left, the request is rejected. A fallback never sends PHI to an uncovered provider.
Is there an auto router?
Yes. Set the model to “auto” and Concentrate picks the model. On a HIPAA organization it only picks BAA-covered routes with zero data retention, and moves to the next covered model if one is unavailable.
Can I use search, caching, or BYOK?
Web search depends on how it runs. On a HIPAA organization, Concentrate’s search runs Exa in its HIPAA mode, with zero data retention on Exa’s side and fast search only. If that mode is unavailable, the search fails instead of running without it. A model’s own search tool runs on the provider, so coverage depends on that provider. Confirm your search setup with us before sending PHI. Caching is supported. Bring Your Own Key is unavailable, because the BAAs do not cover your own provider accounts.
How do we activate the organization?
You sign the BAA with Concentrate. Concentrate staff then turn on HIPAA mode for your organization. It is not available from signup or the dashboard. The steps are on getting started.
How does this compare with other gateways?
Aptible costs more once provider list rates pass about $2,000 a month. Price, prompt storage, and notes on OpenRouter, Kong, and Bifrost are on the Aptible comparison page.