← Everyday AI for staff (ChatGPT, Copilot, Gemini...) compared
Claude
Anthropic · General AI assistant · MedicalDentalTherapy
Verdict: Safe on specific plans only
BAA only on: Enterprise (HIPAA-ready); API (first-party).
BAA fine print (Enterprise (HIPAA-ready)): Connectors, Skills, Claude in Chrome, cloud Cowork and beta features are NOT covered. Source: https://privacy.anthropic.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers, checked 2026-10-16
Practice fit: General-purpose tool (editorial category).
Not legal advice. Summarized from the vendor's own pages. Confirm with the vendor before entering PHI.
Free / Pro / Max (personal)
| Question | Answer | Source & date checked |
|---|---|---|
| BAA available? | UnverifiedunverifiedAnthropic names its API, Claude in Microsoft Foundry and Enterprise as HIPAA-ready; consumer plans are not listed. No explicit 'no' statement found. | No first-party source found · checked 2026-10-16 |
| BAA self-serve? | Unverifiedunverified | No first-party source found · checked 2026-10-16 |
| BAA fine print | UnverifiedunverifiedNo BAA fine print reviewed for this plan. | No first-party source found · checked 2026-10-16 |
| Trains on your data by default? | User choiceuser choice (asked at signup)Since Aug/Oct 2025 users must pick whether chats train models. Flagged-for-safety chats may be used regardless. | https://www.anthropic.com/news/updates-to-our-consumer-terms checked 2026-10-16 |
| Retention | Stated30 days if training is off; 5 years if training is on | https://www.anthropic.com/news/updates-to-our-consumer-terms checked 2026-10-16 |
| SOC 2 | UnverifiedunverifiedAnthropic's certification page covers commercial products only. | No first-party source found · checked 2026-10-16 |
| ISO 42001 | UnverifiedunverifiedCertification page covers commercial products only. | No first-party source found · checked 2026-10-16 |
| HITRUST | UnverifiedunverifiedNot stated on the vendor pages we checked. | No first-party source found · checked 2026-10-16 |
| Starting price (as published) | UnverifiedunverifiedNo published price found on pages we fetched. | No first-party source found · checked 2026-10-16 |
Team
| Question | Answer | Source & date checked |
|---|---|---|
| BAA available? | UnverifiedunverifiedNot listed among HIPAA-ready services. | No first-party source found · checked 2026-10-16 |
| BAA self-serve? | Unverifiedunverified | No first-party source found · checked 2026-10-16 |
| BAA fine print | UnverifiedunverifiedNo BAA fine print reviewed for this plan. | No first-party source found · checked 2026-10-16 |
| Trains on your data by default? | Nono | https://privacy.anthropic.com/en/articles/7996868-is-my-data-used-for-model-training checked 2026-10-16 |
| Retention | StatedKept in product until deleted; deleted chats purged within 30 days | https://privacy.anthropic.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data checked 2026-10-16 |
| SOC 2 | Yesyes (Type I & II) | https://privacy.claude.com/en/articles/10015870-what-certifications-has-anthropic-obtained checked 2026-10-16 |
| ISO 42001 | Yesyes | https://privacy.claude.com/en/articles/10015870-what-certifications-has-anthropic-obtained checked 2026-10-16 |
| HITRUST | UnverifiedunverifiedNot stated on the vendor pages we checked. | No first-party source found · checked 2026-10-16 |
| Starting price (as published) | UnverifiedunverifiedNo published price found on pages we fetched. | No first-party source found · checked 2026-10-16 |
Enterprise (HIPAA-ready)
| Question | Answer | Source & date checked |
|---|---|---|
| BAA available? | Yesyes (Primary Owner turns on HIPAA in settings and accepts BAA)Connectors, Skills, Claude in Chrome, cloud Cowork and beta features are not covered. | https://privacy.anthropic.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers checked 2026-10-16 |
| BAA self-serve? | Yesyes (Primary Owner accepts BAA in settings) | https://privacy.anthropic.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers checked 2026-10-16 |
| BAA fine print | StatedConnectors, Skills, Claude in Chrome, cloud Cowork and beta features are NOT covered. | https://privacy.anthropic.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers checked 2026-10-16 |
| Trains on your data by default? | Nono | https://privacy.anthropic.com/en/articles/7996868-is-my-data-used-for-model-training checked 2026-10-16 |
| Retention | StatedKept until deleted; deletes purged within 30 days; 'Covered Models' need 30-day retention | https://privacy.anthropic.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data checked 2026-10-16 |
| SOC 2 | Yesyes (Type I & II) | https://privacy.claude.com/en/articles/10015870-what-certifications-has-anthropic-obtained checked 2026-10-16 |
| ISO 42001 | Yesyes | https://privacy.claude.com/en/articles/10015870-what-certifications-has-anthropic-obtained checked 2026-10-16 |
| HITRUST | UnverifiedunverifiedNot stated on the vendor pages we checked. | No first-party source found · checked 2026-10-16 |
| Starting price (as published) | UnverifiedunverifiedNo published price found on pages we fetched. | No first-party source found · checked 2026-10-16 |
API (first-party)
| Question | Answer | Source & date checked |
|---|---|---|
| BAA available? | Yesyes (sign BAA, then sales enables HIPAA)Batch, Files, Skills, Code Execution, Computer Use and Web Fetch are not covered. | https://privacy.anthropic.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers checked 2026-10-16 |
| BAA self-serve? | Partlypartly (sign BAA, then sales enables HIPAA) | https://privacy.anthropic.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers checked 2026-10-16 |
| BAA fine print | StatedBatch, Files, Skills, Code Execution, Computer Use and Web Fetch are NOT covered. | https://privacy.anthropic.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers checked 2026-10-16 |
| Trains on your data by default? | Nono | https://privacy.anthropic.com/en/articles/7996868-is-my-data-used-for-model-training checked 2026-10-16 |
| Retention | StatedDeleted within 30 days by default; ZDR by agreement | https://privacy.anthropic.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data checked 2026-10-16 |
| SOC 2 | Yesyes (Type I & II) | https://privacy.claude.com/en/articles/10015870-what-certifications-has-anthropic-obtained checked 2026-10-16 |
| ISO 42001 | Yesyes | https://privacy.claude.com/en/articles/10015870-what-certifications-has-anthropic-obtained checked 2026-10-16 |
| HITRUST | UnverifiedunverifiedNot stated on the vendor pages we checked. | No first-party source found · checked 2026-10-16 |
| Starting price (as published) | UnverifiedunverifiedNo published price found on pages we fetched. | No first-party source found · checked 2026-10-16 |