Is Claude HIPAA Compliant? What Doctors Need to Know in 2026
Short answer: only some versions, and only with a signed BAA. Anthropic will sign a Business Associate Agreement for qualifying business customers, and in January 2026 it launched Claude for Healthcare with HIPAA-ready options. But the everyday Claude app most doctors try first (Free, Pro, or Max on claude.ai) is not covered. If you paste a patient's details into a personal Claude account, that is a HIPAA problem.
Which Claude products can be covered
- Claude Free, Pro, and Max (personal accounts): no BAA. Do not put PHI here.
- Anthropic's business offerings (API and enterprise plans): Anthropic signs BAAs through its sales team, typically as part of an enterprise agreement. Coverage depends on the product and configuration you sign for.
- Claude through a cloud provider: Claude is also sold through AWS (Amazon Bedrock), Google Cloud (Vertex AI), and Microsoft Azure. If your organization already has that cloud's BAA, Claude can run inside it.
The honest reading: Claude is HIPAA-eligible in the right setup. It is not HIPAA compliant out of the box, and nothing about a personal subscription changes that.
What HIPAA actually requires
Under HIPAA, a medical practice can only hand protected health information (PHI) to a vendor that has signed a Business Associate Agreement (BAA). A BAA is the contract where the vendor promises to protect PHI, report breaches, and accept HIPAA obligations. Two details trip practices up: the BAA has to cover the exact product and plan you use, and it does not make you compliant by itself. You still need the right settings, access controls, and staff habits.
The real gap: Claude is a model, not a practice
Even with a BAA, Claude is a brilliant assistant you have to build around. Someone still has to connect it to your EHR, your phones, your scheduling, your fax line, and your billing, and then keep all of that compliant. That is a software project, not a subscription. Most small and mid-size practices do not have an engineer to run it.
PhiClaw signs a Business Associate Agreement (BAA) with your practice and runs on HIPAA-eligible infrastructure, with BAAs in place with our subprocessors AWS (including Amazon Bedrock) and Convex. HIPAA-compliant calls run through our voice partner Retell AI, also under BAA.
What PhiClaw does differently
PhiClaw is a HIPAA AI employee for medical practices. It signs a BAA with every practice on every plan, before any patient data moves. It answers patients on the phone, WhatsApp, iMessage, the web, and its iOS and Android apps, books and reschedules visits in your EHR, runs intake, scribes the SOAP note, handles e-prescribing (including controlled substances), billing, fax, and even your website and social posts. It works with 30+ major EHRs directly and 300+ more through Keragon, or ships its own HIPAA EHR and CRM.
Think of it this way: Claude is the engine. PhiClaw is the whole car, already registered and insured for healthcare. PhiClaw is priced at $1,500 a month flat (4,320 questions/tasks included, unlimited users and locations, month-to-month), with a BAA on every plan.
Checklist before using any AI chatbot with patient data
- Get a signed BAA that names the exact product and plan, not just the company.
- Confirm your data is not used to train models.
- Turn off or limit chat history and retention where possible.
- Use business accounts with individual logins, never a shared personal account.
- Keep a licensed clinician as the decision-maker on anything clinical.
Key takeaway: Claude can be used with PHI only under a signed Anthropic BAA (or inside a cloud you already have a BAA with). Personal Claude accounts are not covered. If you want an AI that already runs the practice under a BAA, that is what PhiClaw is.
Frequently asked questions
Is Claude Pro HIPAA compliant?
No. Claude Free, Pro, and Max are personal plans with no BAA. Do not enter patient names, dates of birth, or any other PHI into them.
Does Anthropic sign a BAA?
Yes, for qualifying business customers, usually through its sales team as part of an enterprise agreement. Claude is also available through AWS Bedrock, Google Cloud, and Azure, which have their own BAAs.
What is Claude for Healthcare?
Anthropic launched Claude for Healthcare in January 2026 with HIPAA-ready options for healthcare and life-sciences organizations. It still requires a business agreement and BAA; it is not a setting you switch on in a personal account.
Can I use Claude if I remove patient names?
Only if the data is truly de-identified under HIPAA's rules, which removes far more than names (dates, locations, record numbers, and more). In practice most clinical questions still contain PHI, so get a BAA or use a tool that already has one.
What does PhiClaw do that Claude does not?
PhiClaw is a finished HIPAA AI employee: it signs a BAA on every plan and already answers patients, books visits in your EHR, scribes notes, e-prescribes, bills, and faxes. Claude is a model you would have to build all of that around.
Want AI that already runs a practice under a BAA?
PhiClaw signs a Business Associate Agreement (BAA) with your practice and runs on HIPAA-eligible infrastructure, with BAAs in place with our subprocessors AWS (including Amazon Bedrock) and Convex. HIPAA-compliant inbound and outbound calls are handled by our voice partner Retell AI, which is also under BAA.
Book a 20-min demo