Is Grok Bot HIPAA Compliant? (What Doctors Need to Know)

Short answer: not that anyone can prove. As of October 2026, xAI has not published a HIPAA statement or a Business Associate Agreement that covers Grok Bot, the always-on agent it launched in beta in August. Until that exists in writing, a medical practice cannot put protected health information (PHI) through it.

What Grok Bot is

Grok Bot is xAI’s always-on agent product, released in beta in August 2026. Each Bot gets its own cloud computer with a browser, a file system, and a terminal, so it keeps working after you close your laptop. You message a Bot like a coworker from your phone or desktop, it signs into the tools you already use (including websites with no API), and it comes back only when something needs your approval. Show it a workflow once and it saves the steps as a routine it can run on a schedule. Several Bots can run at the same time, and one Bot can manage the others.

Access is bundled into SuperGrok and Cursor subscriptions rather than sold on its own, with enterprise access on a waitlist. There is no self-hosting and no choice of model. Every Bot on your account shares the same files, browser sessions, and logins on a machine that runs in Cursor’s cloud.

What HIPAA actually requires

Under HIPAA, a medical practice (a “covered entity”) can only hand protected health information (PHI) to a vendor that has signed a Business Associate Agreement (BAA). A BAA is the contract where the vendor promises to safeguard PHI, report breaches, and accept HIPAA obligations. No BAA means no PHI, full stop, no matter how good the product is.

It is not enough for the model to be “secure.” The vendor that stores, processes, or transmits PHI must sign the BAA, and so must every company underneath it that touches the data (the “subprocessors”). For Grok Bot that chain includes xAI and Cursor, whose cloud runs the Bot’s computer.

What xAI and Cursor have said

• xAI’s Grok Bot launch page makes no HIPAA, SOC 2, or BAA claim about the Bot. The site has general BAA and security pages, but nothing ties them to Grok Bot.
• xAI’s API BAA, as described by third-party compliance guides, applies to the API with zero-data-retention enabled, which is a separate product from the consumer app and from Grok Bot.
• Cursor signs BAAs on Enterprise for “eligible services.” A practice manager who asked on Cursor’s forum whether Grok Bot could be HIPAA compliant was referred to sales with no answer.

The honest reading: nobody has said yes in writing. Treat it as a no.

Why the design makes it harder

Even if a BAA appears later, two design choices matter for a clinic. First, every Bot on your account shares one cloud computer with the same files, browser sessions, and saved logins, so there is no separation between a marketing task and a task that read a patient email. Second, the Bot works inside websites by looking at the screen and typing, which means it can see whatever is on screen, including PHI in your inbox or scheduling tool, even when the task did not need it.

The HIPAA alternative that works the same way

The reason Grok Bot is tempting is the experience: an always-on AI employee you message like a coworker, that remembers your business and runs routines on a schedule. PhiClaw is that experience built for medical practices.

Here is the part most buyers miss: PhiClaw is the same kind of product. It is the HIPAA build of OpenClaw, the open-source agent that Grok Bot and Muse are so often compared to. So you get the same shape of experience:

• Always on. PhiClaw runs in the cloud 24/7, answers patients at 2 a.m., and keeps working when the office is closed.
• Message it like a coworker. Talk to it on WhatsApp, iMessage, Slack, Telegram, the web, or the iOS and Android apps.
• Memory and routines. It remembers your practice, your preferences, and your patients’ context, and it runs scheduled jobs such as no-show follow-ups, recall reminders, and weekly reports.
• Does multi-step work. Intake, scheduling, insurance questions, SOAP-note scribing, e-prescribing, billing, fax, website updates, and social posts, end to end.
• Sub-agents. A front-desk agent, a back-office agent, and a marketing agent coordinate under one roof.

What changes is everything around the agent. PhiClaw signs a BAA with every practice on every plan. It runs on HIPAA-eligible AWS (including Amazon Bedrock for the model) and Convex, both under BAA, with calls through Retell AI, also under BAA. Your data is never used to train a model. PHI stays inside the HIPAA-compliant PhiClaw app, encrypted and audit-logged, while consumer chat apps are used only for non-PHI convenience. And it ships with its own HIPAA EHR and CRM, plus connections to 30+ major EHRs and 300+ integrations through Keragon.

Checklist before using any AI agent with patients

• Get a BAA signed for the exact product, not just the model API.
• Confirm every subprocessor (cloud host, model provider, telephony) is also under BAA.
• Confirm your data is never used for model training.
• Make sure PHI is encrypted, audit-logged, and tied to staff roles, not one shared login.
• Keep a licensed clinician as the decision-maker on anything clinical.

Frequently asked questions

Does xAI sign a BAA?

Third-party guides describe an xAI BAA process for its API with zero-data-retention enabled. That does not cover the consumer Grok app, and xAI has not stated that it covers Grok Bot. Ask xAI and Cursor for written confirmation before any PHI is involved.

Can I use Grok Bot if I never type patient names into it?

Only if the Bot is not logged into anything that contains PHI. Because it signs into your email, calendar, and browser, it will see patient data in the background. For a practice, that is the risk.

Is Grok Bot the same as Grok?

No. Grok is xAI's chatbot and API. Grok Bot is the always-on agent product with its own cloud computer, bundled with SuperGrok and Cursor subscriptions. Compliance statements about one do not automatically apply to the other.

What does PhiClaw do differently?

PhiClaw signs a BAA with every practice on every plan, runs on HIPAA-eligible AWS and Convex under BAA, never trains on your data, keeps PHI inside its encrypted and audit-logged app, and ships with an EHR, CRM, intake, scribing, e-prescribing, billing, fax, and patient messaging.

How much does PhiClaw cost?

PhiClaw is flat and predictable: Starter at $300/mo for a single clinic, or Enterprise at 30% of what we save you, with a BAA on every plan.