Anthropic BAA (Business Associate Agreement) for Claude
Anthropic offers a HIPAA Business Associate Agreement (BAA) for Claude API usage. This page explains what the Anthropic BAA is, why HIPAA requires it before Claude can touch patient data, how to get coverage — directly from Anthropic or through a covered platform like Chat Data — and what it costs. You can also read the actual signed agreement.
What Is a BAA and Why HIPAA Requires One for Claude
A Business Associate Agreement (BAA) is a legal contract required by HIPAA between a covered entity — such as a healthcare provider — and a business associate that handles Protected Health Information (PHI) on its behalf. It establishes permitted uses of PHI, requires safeguards, and defines breach notification procedures.
Large language models are no exception. If patient messages, intake details, or any other PHI reach the Claude API, HIPAA requires that usage to be covered by a BAA before the data is processed. Sending PHI to an LLM API without one exposes the covered entity to HIPAA violations, no matter how capable or private the model itself is. That makes the Anthropic BAA the foundational document for any healthcare use of Claude — whether in a patient-facing chatbot, an intake workflow, or an internal clinical assistant.
How to Get Anthropic BAA Coverage
There are two legitimate routes to BAA-covered Claude usage. The right one depends on whether you are building your own application on the Claude API or want a working, compliant AI agent without assembling the compliance stack yourself.
Route 1: Directly with Anthropic
Anthropic arranges BAAs for Claude API usage through its sales team, typically as part of an enterprise agreement, and does not publish list pricing for them (as of July 2026). Going direct gives you a first-party agreement, but the BAA only covers Anthropic's side: you still own the rest of the compliance chain — encryption, access controls, audit logging, breach procedures, and separate BAAs with every other vendor that touches PHI in your application.
Best for: teams building their own software on the Claude API with in-house compliance resources.
Route 2: Through a Covered Platform (Chat Data)
Chat Data holds a signed BAA with Anthropic — the PDF is published here — and signs a BAA with your organization on eligible paid plans. The platform supplies the surrounding safeguards (AES-256 encryption at rest and in transit, audit logs, access controls, and configurable US or Swiss data residency), so you get BAA-covered Claude inside a working AI agent instead of a raw API.
Best for: practices and healthcare businesses that want a compliant chatbot without building infrastructure.
How the BAA Chain Works
This BAA chain is designed to support HIPAA compliance from the AI model through to your practice.
What the Anthropic BAA Covers
Like any HIPAA Business Associate Agreement, the Anthropic BAA addresses three core obligations. Rather than paraphrase the contract, we publish the signed agreement itself — read the Anthropic HIPAA BAA (PDF) for the exact terms.
Permitted uses of PHI
Defines how Protected Health Information sent to the Claude API may be used and disclosed, restricting processing to the services being provided.
Required safeguards
Obligates the business associate to apply administrative, physical, and technical safeguards that protect PHI, in line with the HIPAA Security Rule.
Breach notification procedures
Sets out how and when the business associate must report a breach of unsecured PHI, so the covered entity can meet its own notification duties.
Claude is not the only HIPAA-eligible model on Chat Data: select OpenAI models are also covered — see the OpenAI HIPAA agreement (PDF) and the full HIPAA compliant AI chatbot overview.
Anthropic BAA Cost
Direct with Anthropic: Anthropic does not publish list pricing for direct BAAs. Coverage is negotiated through its sales team, so the cost depends on your usage and agreement — budget for an enterprise-style conversation rather than a checkbox at signup.
Through Chat Data: BAA coverage is available at no additional cost on eligible paid plans starting at $18.99/month — no hidden compliance fees. The Standard plan at $95/month adds workflow automation and live-chat escalation for practices that need them. For healthcare-specific deployments, the dedicated medical AI product at medical.chat-data.com is free to start, with plans from $18.99/month.
Related reading: HIPAA compliant AI chatbot · Medical ChatGPT alternative · AI doctor chat.
Anthropic BAA FAQs
Quick answers about the Anthropic Business Associate Agreement for Claude.
What is the Anthropic BAA (Business Associate Agreement)?
The Anthropic BAA is a HIPAA Business Associate Agreement that Anthropic signs for Claude API usage. A BAA is a legal contract required by HIPAA between a covered entity and a business associate that handles Protected Health Information (PHI). It establishes permitted uses of PHI, requires safeguards, and defines breach notification procedures. You can read the Anthropic HIPAA BAA signed with Chat Data as a PDF on this page.
Does Anthropic offer a HIPAA BAA for Claude?
Yes. Anthropic offers a HIPAA Business Associate Agreement for Claude API usage. Healthcare organizations can pursue a BAA directly with Anthropic, or use Claude through a covered platform such as Chat Data, which holds a signed BAA with Anthropic and offers BAA coverage to customers on eligible paid plans.
How much does an Anthropic BAA cost?
As of July 2026, Anthropic does not publish list pricing for direct BAAs; coverage is arranged through its sales team, typically as part of an enterprise agreement. Through Chat Data, BAA coverage is available at no additional cost on eligible paid plans starting at $18.99/month, and the dedicated medical AI product at medical.chat-data.com is free to start with plans from $18.99/month.
Is Claude HIPAA compliant?
Claude can be used in HIPAA-compliant deployments when its API usage is covered by a Business Associate Agreement and the surrounding application applies the required safeguards, such as encryption, access controls, and audit logs. HIPAA compliance describes the whole deployment, not the model alone, so BAA coverage across every vendor that touches PHI is essential.
How do I get a BAA for Claude?
There are two routes: contact Anthropic directly to negotiate an enterprise BAA for your own Claude API usage, or build on a platform that already holds one. Chat Data has a signed BAA with Anthropic and signs a BAA with your organization on eligible paid plans, completing the HIPAA chain from Anthropic to Chat Data to your practice.
Use Claude Under BAA Coverage Today
Skip the enterprise negotiation. Chat Data's signed Anthropic BAA plus a BAA with your organization on eligible paid plans gets your Claude-powered agent covered from day one.