Claude: which plan do I need for patient data?
Short answer
Plans with a BAA: Enterprise (HIPAA-ready); API (first-party).
Not confirmed: Free / Pro / Max (personal); Team.
Only a plan with a signed BAA should be used with PHI. Staff on other plans, including personal accounts, shouldn't enter patient data.
| Plan | BAA? | How you get the BAA | Trains on your data? | Retention | Fine print |
|---|---|---|---|---|---|
| Free / Pro / Max (personal) | Unverified | Unverified | User choiceuser choice (asked at signup)[source] | 30 days if training is off; 5 years if training is on[source] | Unverified |
| Team | Unverified | Unverified | Nono[source] | Kept in product until deleted; deleted chats purged within 30 days[source] | Unverified |
| Enterprise (HIPAA-ready) | Yesyes (Primary Owner turns on HIPAA in settings and accepts BAA)[source] | Yesyes (Primary Owner accepts BAA in settings)[source] | Nono[source] | Kept until deleted; deletes purged within 30 days; 'Covered Models' need 30-day retention[source] | Connectors, Skills, Claude in Chrome, cloud Cowork and beta features are NOT covered.[source] |
| API (first-party) | Yesyes (sign BAA, then sales enables HIPAA)[source] | Partlypartly (sign BAA, then sales enables HIPAA)[source] | Nono[source] | Deleted within 30 days by default; ZDR by agreement[source] | Batch, Files, Skills, Code Execution, Computer Use and Web Fetch are NOT covered.[source] |
Full detail and certifications: Claude. Checked 2026-10-16.
Not legal advice. From the vendor's own pages on the date shown. Confirm the current terms with the vendor.