Is ChatGPT HIPAA Compliant for Therapists?
Quick Answer
No — not on ChatGPT Free, Plus, Pro, or self-serve Team/Business, the versions almost every solo therapist would actually have. OpenAI does offer a Business Associate Agreement, but only through ChatGPT Enterprise (sales-managed), ChatGPT Edu, the newer ChatGPT for Healthcare program, or the OpenAI API with specific data-retention settings enabled — none of which a typical solo practice signs up for on its own.
Written & fact-checked by the Therapy HIPAA Hub editorial team — see our editorial standards.
Verified October 2026 against HIPAA Journal's 2026 analysis of ChatGPT and HIPAA compliance
BAA Available?
Yes
On Which Plan
ChatGPT Enterprise, Edu, or Healthcare; or the OpenAI API with zero data retention configured — not Free, Plus, Pro, or self-serve Team
Never paste client names, session content, or any identifying detail into ChatGPT on a Plus or Team account to help draft a note — there is no BAA protecting that conversation. The API route is technically BAA-eligible, but it requires a developer to configure zero data retention, which isn't realistic for most solo practices to set up themselves.
What to Use Instead for Client Work
SimplePractice's built-in AI Note Taker is purpose-built for exactly this and is covered under SimplePractice's existing BAA — no separate contract, API key, or technical configuration needed. Recordings are deleted immediately after transcription, and transcripts are retained only until the note is signed (or 7 days, whichever is shorter).
Affiliate link — we may earn a commission at no extra cost to you.
Why the Version You Actually Have Doesn't Qualify
The ChatGPT most therapists use — Free or Plus, sometimes a self-serve Team plan — is excluded from OpenAI's BAA program entirely. OpenAI's HIPAA-eligible offerings are built for large organizations: Enterprise requires a sales process, Edu is for academic institutions, and the newer ChatGPT for Healthcare program (launched for health systems) is enterprise-scale. None of these are things a solo therapist signs up for with a credit card.
Why a Purpose-Built Tool Beats the API Workaround
OpenAI's API does support a BAA when zero data retention is configured — but that requires generating an API key, writing integration code or using a third-party wrapper, and correctly setting retention policies, which is a software engineering task, not something most clinicians will do themselves safely. A note-taking tool built into your EHR and already covered under its BAA accomplishes the same goal — AI-assisted documentation — without any of that technical risk.
Trusted by 225,000+ Therapists
50% Off Your First 4 Months of SimplePractice
SimplePractice is the #1 HIPAA-compliant practice management platform for therapists. Includes a signed BAA, encrypted messaging, telehealth, and full insurance billing.
Limited-time summer offer · No credit card required for trial
Need HIPAA-compliant email only? See Hushmail for Healthcare →
FAQ — ChatGPT and HIPAA
Can I use ChatGPT Plus to help write progress notes if I remove the client's name?
This is risky and not recommended. Even without a name, session details, dates, and clinical specifics can make a client identifiable, which still counts as PHI exposure. Without a BAA on your ChatGPT Plus account, there's no compliant way to use it for anything derived from a real client session.
Does ChatGPT Team or Business include a BAA?
No. Self-serve Team and Business plans are not BAA-eligible. Only ChatGPT Enterprise (a sales-managed agreement), Edu, Healthcare, or the API with zero data retention configured qualify — none of which match a typical self-serve signup.
Is SimplePractice's AI Note Taker actually covered by a BAA?
Yes — it's covered under SimplePractice's existing Business Associate Agreement, confirmed as of October 2026. Session recordings are deleted right after transcription, and transcripts are kept only briefly. Note: SimplePractice may retain a de-identified version of transcript data to improve its AI tools — this is not PHI, but it's worth knowing.