← Everyday AI for staff (ChatGPT, Copilot, Gemini...) compared
ChatGPT
OpenAI · General AI assistant · MedicalDentalTherapy
Verdict: Safe on specific plans only
BAA only on: Enterprise / Edu; ChatGPT for Healthcare; ChatGPT for Clinicians (free, verified US clinicians); API Platform.
BAA fine print (Free / Go / Plus / Pro (personal)): No BAA. Training on by default for personal plans unless you turn it off. Source: https://help.openai.com/en/articles/7730893-data-controls-faq, checked 2026-10-16
Practice fit: General-purpose tool (editorial category).
Not legal advice. Summarized from the vendor's own pages. Confirm with the vendor before entering PHI.
Free / Go / Plus / Pro (personal)
| Question | Answer | Source & date checked |
|---|---|---|
| BAA available? | NonoNot on OpenAI's list of HIPAA-eligible products (Healthcare, Enterprise w/ Regulated Workspace, FedRAMP, Clinicians, API). | https://help.openai.com/en/articles/20001069-hipaa-eligible-products-and-functionality checked 2026-10-16 |
| BAA self-serve? | n/a | Follows from the BAA answer |
| BAA fine print | StatedNo BAA. Training on by default for personal plans unless you turn it off. | https://help.openai.com/en/articles/7730893-data-controls-faq checked 2026-10-16 |
| Trains on your data by default? | Yesyes (opt-out)'Improve the model for everyone' setting controls training on personal plans; turn it off to stop. Temporary Chats are not used for training. | https://help.openai.com/en/articles/7730893-data-controls-faq checked 2026-10-16 |
| Retention | StatedTemporary chats up to 30 days; saved chats kept until deleted | https://help.openai.com/en/articles/7730893-data-controls-faq checked 2026-10-16 |
| SOC 2 | Nono (SOC 2 covers API and business products) | https://openai.com/security-and-privacy/ checked 2026-10-16 |
| ISO 42001 | YesyesOpenAI's ISO/IEC 42001 AIMS covers consumer and business products. | https://openai.com/security-and-privacy/ checked 2026-10-16 |
| HITRUST | UnverifiedunverifiedNot stated on the vendor pages we checked. | No first-party source found · checked 2026-10-16 |
| Starting price (as published) | UnverifiedunverifiedNo published price found on pages we fetched. | No first-party source found · checked 2026-10-16 |
Business
| Question | Answer | Source & date checked |
|---|---|---|
| BAA available? | Nono'We do not offer a BAA for ChatGPT Business.' | https://help.openai.com/en/articles/8660679-how-can-i-get-a-business-associate-agreement-baa-with-openai checked 2026-10-16 |
| BAA self-serve? | n/a | Follows from the BAA answer |
| BAA fine print | StatedOpenAI states plainly: no BAA for ChatGPT Business. | https://help.openai.com/en/articles/8660679-how-can-i-get-a-business-associate-agreement-baa-with-openai checked 2026-10-16 |
| Trains on your data by default? | Nono | https://openai.com/enterprise-privacy/ checked 2026-10-16 |
| Retention | StatedAdmin-controlled; deleted chats removed within 30 days | https://openai.com/enterprise-privacy/ checked 2026-10-16 |
| SOC 2 | Yesyes (Type 2) | https://openai.com/enterprise-privacy/ checked 2026-10-16 |
| ISO 42001 | Yesyes | https://openai.com/security-and-privacy/ checked 2026-10-16 |
| HITRUST | UnverifiedunverifiedNot stated on the vendor pages we checked. | No first-party source found · checked 2026-10-16 |
| Starting price (as published) | UnverifiedunverifiedNo published price found on pages we fetched. | No first-party source found · checked 2026-10-16 |
Enterprise / Edu
| Question | Answer | Source & date checked |
|---|---|---|
| BAA available? | Yesyes (sales-managed; Enterprise needs Regulated Workspace) | https://help.openai.com/en/articles/20001069-hipaa-eligible-products-and-functionality checked 2026-10-16 |
| BAA self-serve? | Nono (sales-managed) | https://help.openai.com/en/articles/20001069-hipaa-eligible-products-and-functionality checked 2026-10-16 |
| BAA fine print | UnverifiedunverifiedNo BAA fine print reviewed for this plan. | No first-party source found · checked 2026-10-16 |
| Trains on your data by default? | Nono | https://openai.com/enterprise-privacy/ checked 2026-10-16 |
| Retention | StatedAdmin-controlled; deleted chats removed within 30 days | https://openai.com/enterprise-privacy/ checked 2026-10-16 |
| SOC 2 | Yesyes (Type 2) | https://openai.com/enterprise-privacy/ checked 2026-10-16 |
| ISO 42001 | Yesyes | https://openai.com/security-and-privacy/ checked 2026-10-16 |
| HITRUST | UnverifiedunverifiedNot stated on the vendor pages we checked. | No first-party source found · checked 2026-10-16 |
| Starting price (as published) | UnverifiedunverifiedNo published price found on pages we fetched. | No first-party source found · checked 2026-10-16 |
ChatGPT for Healthcare
| Question | Answer | Source & date checked |
|---|---|---|
| BAA available? | YesyesSome features (improved memory, event-triggered tasks, Sites, Codex cloud) are NOT covered. | https://help.openai.com/en/articles/20001069-hipaa-eligible-products-and-functionality checked 2026-10-16 |
| BAA self-serve? | Unverifiedunverified | No first-party source found · checked 2026-10-16 |
| BAA fine print | StatedImproved memory, event-triggered tasks, Sites and Codex cloud are NOT covered by the BAA. | https://help.openai.com/en/articles/20001069-hipaa-eligible-products-and-functionality checked 2026-10-16 |
| Trains on your data by default? | Nono | https://openai.com/enterprise-privacy/ checked 2026-10-16 |
| Retention | StatedAdmin-controlled; deleted chats removed within 30 days | https://openai.com/enterprise-privacy/ checked 2026-10-16 |
| SOC 2 | Yesyes (Type 2) | https://openai.com/enterprise-privacy/ checked 2026-10-16 |
| ISO 42001 | Yesyes | https://openai.com/security-and-privacy/ checked 2026-10-16 |
| HITRUST | UnverifiedunverifiedNot stated on the vendor pages we checked. | No first-party source found · checked 2026-10-16 |
| Starting price (as published) | UnverifiedunverifiedNo published price found on pages we fetched. | No first-party source found · checked 2026-10-16 |
ChatGPT for Clinicians (free, verified US clinicians)
| Question | Answer | Source & date checked |
|---|---|---|
| BAA available? | Yesyes (individual, self-serve in Settings > Agreements)MD/DO, NP, PA, pharmacists with NPI. Single-user BAA only. | https://help.openai.com/en/articles/20001202-chatgpt-for-clinicians checked 2026-10-16 |
| BAA self-serve? | Yesyes (Settings > Agreements) | https://help.openai.com/en/articles/20001202-chatgpt-for-clinicians checked 2026-10-16 |
| BAA fine print | StatedSingle-user BAA for the verified clinician only; does not cover staff or the practice. | https://help.openai.com/en/articles/20001202-chatgpt-for-clinicians checked 2026-10-16 |
| Trains on your data by default? | Nono | https://help.openai.com/en/articles/20001202-chatgpt-for-clinicians checked 2026-10-16 |
| Retention | UnverifiedunverifiedNot stated on the vendor pages we checked. | No first-party source found · checked 2026-10-16 |
| SOC 2 | UnverifiedunverifiedNot stated on the vendor pages we checked. | No first-party source found · checked 2026-10-16 |
| ISO 42001 | Yesyes | https://openai.com/security-and-privacy/ checked 2026-10-16 |
| HITRUST | UnverifiedunverifiedNot stated on the vendor pages we checked. | No first-party source found · checked 2026-10-16 |
| Starting price (as published) | StatedFree (verified US clinicians) | https://help.openai.com/en/articles/20001202-chatgpt-for-clinicians checked 2026-10-16 |
API Platform
| Question | Answer | Source & date checked |
|---|---|---|
| BAA available? | Yesyes (self-serve for eligible orgs; requires Modified Retention) | https://help.openai.com/en/articles/8660679-how-can-i-get-a-business-associate-agreement-baa-with-openai checked 2026-10-16 |
| BAA self-serve? | Yes for eligible orgsyes for eligible orgs | https://help.openai.com/en/articles/8660679-how-can-i-get-a-business-associate-agreement-baa-with-openai checked 2026-10-16 |
| BAA fine print | StatedRequires Modified/Zero Data Retention on the API; only eligible endpoints are covered. | https://help.openai.com/en/articles/8660679-how-can-i-get-a-business-associate-agreement-baa-with-openai checked 2026-10-16 |
| Trains on your data by default? | Nono | https://openai.com/enterprise-privacy/ checked 2026-10-16 |
| Retention | StatedUp to 30 days for abuse monitoring; zero data retention for eligible endpoints | https://openai.com/enterprise-privacy/ checked 2026-10-16 |
| SOC 2 | Yesyes (Type 2) | https://openai.com/enterprise-privacy/ checked 2026-10-16 |
| ISO 42001 | Yesyes | https://openai.com/security-and-privacy/ checked 2026-10-16 |
| HITRUST | UnverifiedunverifiedNot stated on the vendor pages we checked. | No first-party source found · checked 2026-10-16 |
| Starting price (as published) | UnverifiedunverifiedNo published price found on pages we fetched. | No first-party source found · checked 2026-10-16 |