ChatGPT: which plan do I need for patient data?
Short answer
Plans with a BAA: Enterprise / Edu; ChatGPT for Healthcare; ChatGPT for Clinicians (free, verified US clinicians); API Platform.
No BAA: Free / Go / Plus / Pro (personal); Business.
Only a plan with a signed BAA should be used with PHI. Staff on other plans, including personal accounts, shouldn't enter patient data.
| Plan | BAA? | How you get the BAA | Trains on your data? | Retention | Fine print |
|---|---|---|---|---|---|
| Free / Go / Plus / Pro (personal) | Nono[source] | n/a | Yesyes (opt-out)[source] | Temporary chats up to 30 days; saved chats kept until deleted[source] | No BAA. Training on by default for personal plans unless you turn it off.[source] |
| Business | Nono[source] | n/a | Nono[source] | Admin-controlled; deleted chats removed within 30 days[source] | OpenAI states plainly: no BAA for ChatGPT Business.[source] |
| Enterprise / Edu | Yesyes (sales-managed; Enterprise needs Regulated Workspace)[source] | Nono (sales-managed)[source] | Nono[source] | Admin-controlled; deleted chats removed within 30 days[source] | Unverified |
| ChatGPT for Healthcare | Yesyes[source] | Unverified | Nono[source] | Admin-controlled; deleted chats removed within 30 days[source] | Improved memory, event-triggered tasks, Sites and Codex cloud are NOT covered by the BAA.[source] |
| ChatGPT for Clinicians (free, verified US clinicians) | Yesyes (individual, self-serve in Settings > Agreements)[source] | Yesyes (Settings > Agreements)[source] | Nono[source] | Unverified | Single-user BAA for the verified clinician only; does not cover staff or the practice.[source] |
| API Platform | Yesyes (self-serve for eligible orgs; requires Modified Retention)[source] | Yes for eligible orgsyes for eligible orgs[source] | Nono[source] | Up to 30 days for abuse monitoring; zero data retention for eligible endpoints[source] | Requires Modified/Zero Data Retention on the API; only eligible endpoints are covered.[source] |
Full detail and certifications: ChatGPT. Checked 2026-10-16.
Not legal advice. From the vendor's own pages on the date shown. Confirm the current terms with the vendor.