Is OpenAI Dots HIPAA Compliant? (What Doctors Need to Know)
Short answer: not on the plan you probably have. OpenAI’s Dots, the always-on agents added to ChatGPT on September 29, 2026, come with ChatGPT Pro and Business Premium, and neither plan is eligible for OpenAI’s Business Associate Agreement. On Enterprise and ChatGPT for Healthcare, where a BAA exists, Dots are an off-by-default beta that OpenAI has not published as inside BAA scope. Until that is in writing, a medical practice cannot put protected health information (PHI) through a Dot.
What Dots are
Dots are OpenAI’s always-on agents inside ChatGPT, announced at DevDay on September 29, 2026. Each dot runs on GPT-6 Astra with its own cloud computer and browser, connects to 4,000+ apps through plugins, and keeps working between conversations. You reach your dot in the ChatGPT apps, on the web, in Slack or Microsoft Teams, or by voice call. An activity area shows what it is doing now, what is scheduled, and what is finished. It comes back to you with results or with a decision it needs from you.
Two design choices stand out. When idle, a dot does “proactive research” using read-only tools only. And an auto-review step checks any action that could affect your accounts or share information, with sensitive tasks always left to you. The first dot is included with ChatGPT Pro and Business Premium in eligible markets. Enterprise, Edu, and Healthcare workspaces get Dots as an admin-enabled beta that is off by default. Specialist dots exist only through enterprise pilots with OpenAI engineers.
What HIPAA actually requires
Under HIPAA, a medical practice (a “covered entity”) can only hand protected health information (PHI) to a vendor that has signed a Business Associate Agreement (BAA). A BAA is the contract where the vendor promises to safeguard PHI, report breaches, and accept HIPAA obligations. No BAA means no PHI, full stop, no matter how good the product is.
It is not enough that the company signs BAAs somewhere. The BAA has to cover the product you are using, on the plan you are on, and every subprocessor underneath it. OpenAI is explicit that its BAA is tied to specific products, which is exactly why plan and scope matter so much here.
What OpenAI has said
- BAA: OpenAI offers a BAA to ChatGPT for Healthcare and API healthcare customers, and to sales-managed Enterprise and Edu contracts. Plus, Pro, Team, and Business are not eligible.
- Dots availability: included with Pro and Business Premium in eligible markets (Pro excludes the EEA, Switzerland, and the UK). Enterprise, Edu, and Healthcare workspaces get Dots as an admin-enabled beta, off by default.
- Training: Business, Enterprise, and Edu workspace content is not used to train models by default. Personal plans are user-controlled. Proactive research and dot notes are not trained on directly, though information from them may be used in eligible conversations depending on settings, and limited human review can occur for safety.
- Dots and the BAA: no published statement that the Dots beta is covered.
The honest reading: possible someday on an Enterprise or Healthcare contract, not today on the plans most clinics have, and not without written confirmation.
Why the design makes it harder
Even with a BAA, three things matter for a clinic. A dot can connect to 4,000+ apps, and the BAA with OpenAI does not cover what those apps do with the data. While idle, a dot runs proactive read-only research across its connectors, so it reads your inbox and calendar even when no task asked it to. And with permission it can work directly on your laptop, which brings a consumer-grade agent onto a machine that holds patient records.
The HIPAA alternative that works the same way
What makes Dots tempting is the experience: an agent that keeps working between conversations, lives in the apps you use, and comes back only for decisions. PhiClaw is that experience built for medical practices.
Here is the part most buyers miss: PhiClaw is the same kind of product. It is the HIPAA build of OpenClaw, the open-source agent that Grok Bot and Muse are so often compared to. So you get the same shape of experience:
- Always on. PhiClaw runs in the cloud 24/7, answers patients at 2 a.m., and keeps working when the office is closed.
- Message it like a coworker. Talk to it on WhatsApp, iMessage, Slack, Telegram, the web, or the iOS and Android apps.
- Memory and routines. It remembers your practice, your preferences, and your patients’ context, and it runs scheduled jobs such as no-show follow-ups, recall reminders, and weekly reports.
- Does multi-step work. Intake, scheduling, insurance questions, SOAP-note scribing, e-prescribing, billing, fax, website updates, and social posts, end to end.
- Sub-agents. A front-desk agent, a back-office agent, and a marketing agent coordinate under one roof.
What changes is everything around the agent. PhiClaw signs a BAA with every practice on every plan. It runs on HIPAA-eligible AWS (including Amazon Bedrock for the model) and Convex, both under BAA, with calls through Retell AI, also under BAA. Your data is never used to train a model. PHI stays inside the HIPAA-compliant PhiClaw app, encrypted and audit-logged, while consumer chat apps are used only for non-PHI convenience. And it ships with its own HIPAA EHR and CRM, plus connections to 30+ major EHRs and 300+ integrations through Keragon.
PhiClaw signs a Business Associate Agreement (BAA) with your practice and runs on HIPAA-eligible infrastructure, with BAAs in place with our subprocessors AWS (including Amazon Bedrock) and Convex. HIPAA-compliant calls run through our voice partner Retell AI, also under BAA.
Checklist before using any AI agent with patients
- Get a BAA signed for the exact product and plan, not just the company.
- Confirm every subprocessor and every connected app is also under BAA or carries no PHI.
- Confirm your data is never used for model training.
- Make sure PHI is encrypted, audit-logged, and tied to staff roles.
- Keep a licensed clinician as the decision-maker on anything clinical.
Key takeaway: OpenAI signs BAAs, but Dots arrive on Pro and Business plans that have none, and the Dots beta is not published as in scope on the plans that do. PhiClaw gives a practice the same always-on AI employee with a signed BAA on every plan, HIPAA-eligible infrastructure, and medical workflows ready to go.
Frequently asked questions
Does OpenAI sign a BAA?
Yes, for ChatGPT for Healthcare, sales-managed Enterprise and Edu, and the API. Not for Plus, Pro, Team, or Business, which is where Dots are included.
If my hospital has ChatGPT Enterprise with a BAA, are Dots covered?
Not automatically. Dots are an admin-enabled beta on Enterprise and Healthcare workspaces, and OpenAI has not published that the beta falls under the BAA. Ask your OpenAI account team for written confirmation before enabling it for PHI work.
Is a Dot the same as ChatGPT?
No. ChatGPT is the chat product. A Dot is a persistent agent with its own cloud computer and browser that keeps working between conversations and connects to outside apps. Compliance statements about one do not automatically apply to the other.
What does PhiClaw do differently?
PhiClaw signs a BAA with every practice on every plan, runs on HIPAA-eligible AWS and Convex under BAA, never trains on your data, keeps PHI inside its encrypted and audit-logged app, and ships with an EHR, CRM, intake, scribing, e-prescribing, billing, fax, and patient messaging.
How much does PhiClaw cost?
PhiClaw is flat and predictable: Starter at $300/mo for a single clinic, or Enterprise at 30% of what we save you, with a BAA on every plan.
Want a Grok Bot or Muse-style AI employee for your practice — without the HIPAA risk?
PhiClaw signs a Business Associate Agreement (BAA) with your practice and runs on HIPAA-eligible infrastructure, with BAAs in place with our subprocessors AWS (including Amazon Bedrock) and Convex. HIPAA-compliant inbound and outbound calls are handled by our voice partner Retell AI, which is also under BAA.
Book a 20-min demo