Your Therapist Colleague Signed a BAA and Thought They Were Safe. They Weren’t.

A therapist posted on r/therapists earlier this year about the rapid adoption of AI session-note tools in private practices. The post got nearly 2,000 upvotes and 268 comments.

The pattern in the replies was almost universal. It sounded like this:

“My colleague swears their tool is HIPAA-compliant because they signed a BAA. But I checked — and the BAA is with the AI vendor. The AI vendor uses ChatGPT under the hood. There’s no BAA between the vendor and OpenAI for that tier. So is that actually compliant?”

It wasn’t.

The colleague had signed a BAA with the note-taking tool. The note-taking tool processed the audio through consumer-tier ChatGPT — which doesn’t offer a BAA at any price point. The compliance chain was broken at the one link nobody thought to check: the subprocessor.

That’s the pattern playing out in dental offices, hospital IT meetings, healthcare SaaS founder channels, and compliance officer inboxes across the country. Staff are pasting patient names into ChatGPT for documentation help. Practices are signing up for AI tools without reading the data flow. And the phrase “we signed a BAA” is being treated as a compliance certification — when it’s actually layer 1 of 7.

The direct answer — no hedging

Consumer ChatGPT — Free, Plus, and Team — is NOT HIPAA compliant. OpenAI does not sign Business Associate Agreements for these tiers. Custom GPTs built on consumer ChatGPT inherit the same non-compliance.

ChatGPT Enterprise and the OpenAI API CAN be HIPAA-compliant when a signed BAA is in place, the deployment is properly configured, and the organisation implements the surrounding operational controls.

The default ChatGPT that most people mean when they say “ChatGPT” is not compliant. Pasting any PHI into it is a HIPAA violation. That’s the direct answer most blogs on this topic carefully avoid giving.

The tier-by-tier matrix — five products, three answers

Not all ChatGPT products are the same product. The compliance status varies by tier, and the most commonly used tiers are the non-compliant ones.

ChatGPT Free: No BAA. Not compliant. Never paste PHI here.

ChatGPT Plus ($20/month): No BAA. Not compliant. Never paste PHI here.

ChatGPT Team ($25–30/user/month): No BAA. Not compliant. This is the most common misconception — Team sounds like it should have enterprise-grade compliance, but it doesn’t.

ChatGPT Enterprise (~$60/user/month, 150-user typical minimum): BAA available by negotiation. Conditionally compliant when properly configured. Suitable for large hospital systems. Out of reach for solo and small-practice settings due to the user minimum.

OpenAI API (pay-per-token): BAA available on request. Conditionally compliant. Requires custom development — this is API-only, not a chat interface. Suitable for healthcare SaaS builders.

Custom GPTs (built on consumer ChatGPT): No BAA. Inherits non-compliance from the underlying tier. This is the trap most practices fall into: they assume the custom wrapper changes the compliance status. It doesn’t.

The BAA Illusion — why “we signed a BAA” is layer 1 of 7, not a stamp of approval

Here’s the insight the compliance industry keeps trying to communicate and the healthcare community keeps misunderstanding: a Business Associate Agreement is the foundation of HIPAA compliance. It is not HIPAA compliance itself.

A BAA is a legal contract that makes your vendor responsible for safeguarding Protected Health Information. It’s non-negotiable — without it, you cannot share PHI with any vendor. But it’s one layer of seven. The other six — encryption at rest, encryption in transit, access controls with MFA, audit log retention (6+ years), data retention and deletion policies, and breach notification with workforce training — must all be in place simultaneously.

Missing any one layer creates violation exposure regardless of how strong the other six are.

The BAA Illusion is what happens when practices treat the BAA signing as the end of the compliance process rather than the beginning. They sign the BAA, feel protected, and stop asking questions. The questions they should still be asking: “Where exactly is my patient data stored?” “Does my data train the AI model?” “Who is the subprocessor and do they have a BAA with you?” “What happens during a breach — who notifies whom, within what timeframe?”

The r/hipaa community has been saying this for years: HIPAA is an operational discipline, not a technical checklist. Adding encryption and SSO is the easy 50%. The other 50% — BAA management, audit log retention, breach notification, workforce training, vendor due diligence — is where most healthcare AI deployments fail in audit.

The Subprocessor Blind Spot — the chain breaks where you never looked

The therapist’s colleague signed a BAA with an AI note-taking tool. The tool used consumer ChatGPT as its underlying language model. There is no BAA between the note-taking vendor and OpenAI for consumer-tier ChatGPT.

The compliance chain: Therapist → Note-taking tool (BAA ✓) → ChatGPT consumer (BAA ✗).

The chain broke at the subprocessor link. PHI flowed through a non-compliant system — and the BAA with the note-taking tool doesn’t protect the therapist from the violation created by the tool’s non-compliant subprocessor.

This is the Subprocessor Blind Spot: your vendor’s compliance posture is only as strong as the weakest link in their data processing chain. If the vendor signed a BAA with you but their AI subprocessor doesn’t have a BAA with them, the chain is broken and liability flows back to you.

The three questions that expose the blind spot:

1. “What is the underlying AI model used by your product?”
2. “Do you have a signed BAA with the AI model provider?”
3. “Does any patient data pass through a system without BAA coverage?”

If the vendor hesitates on any of these, the chain is broken.

The penalty math -why this isn’t theoretical

HHS Office for Civil Rights penalties scale by culpability tier. The numbers are published and specific.

Tier 1 — Unknowing: $137–$68,928 per violation. Annual cap: $2,067,813. Example: a staff member pastes a patient name into consumer ChatGPT without realising it’s a violation.

Tier 2 — Reasonable Cause: $1,379–$68,928 per violation. Example: a practice uses a non-BAA AI tool after being warned by their compliance officer.

Tier 3 — Willful Neglect (Corrected): $13,785–$68,928 per violation. Example: a practice knowingly uses consumer ChatGPT for clinical work but stops after an incident.

Tier 4 — Willful Neglect (Not Corrected): $68,928–$2,067,813 per violation. Example: a practice continues using non-compliant AI after a breach notification.

“Per violation” is critical. If a staff member pastes 50 patient names into consumer ChatGPT in one session, that can be assessed as 50 separate violations. At minimum Tier 1 rates: 50 × $137 = $6,850. At maximum Tier 4 rates: capped at $2,067,813 per year.

Beyond direct fines, the costs healthcare leaders quantify in retrospect: mandatory breach notification to all affected individuals within 60 days, patient attrition of 15–40% in the following 12 months, cyber liability premiums increasing 30–70%, a 12–24 month OCR investigation, and a Corrective Action Plan that typically costs $50K–$500K to implement.

The total cost of a serious HIPAA AI breach for a mid-size practice is rarely under $250K when all factors are counted. The cost of doing it right from the start — a BAA-backed compliant platform — is a fraction of that.

The five misconceptions that get practices fined

“My Custom GPT is HIPAA compliant because I configured it to refuse PHI.” There is no built-in PHI filter in ChatGPT. The Custom GPT inherits the consumer tier’s compliance posture — which is non-compliant. The wrapper doesn’t change the underlying data processing terms.

“I’m using the OpenAI API directly so I’m fine.” The API needs an explicit signed BAA — it is not granted by default. Without it, you are out of compliance even if your code is technically secure.

“I removed the patient name so it’s de-identified.” De-identification per HIPAA Safe Harbor requires removing 18 specific identifier types — not just the name. Dates, geographic data, phone numbers, medical record numbers, and 13 more. Removing just the name leaves at least 10 identifiers intact.

“My staff knows not to paste PHI.” Verbal instruction is not operational compliance. Documented annual training with sign-off is the regulatory baseline. “We told them” fails audit.

“My vendor signed a BAA so I’m covered.” The BAA must cover the actual data processor. A BAA with a vendor whose underlying AI subprocessor has no BAA fails the chain — and liability returns to you. This is the Subprocessor Blind Spot in action.

Seven alternatives that actually work — across the price spectrum

The gap between “what healthcare workers use” and “what is compliant” isn’t a dead end. Alternatives exist across the spectrum from $300/month turnkey to enterprise cloud platforms.

SuperMIA ($300+/month) — Purpose-built HIPAA AI chatbot and voice agent with BAA included in the contract. Best for small-to-mid healthcare practices, dental, mental health. No engineering team required. Deploys in 7 days.

ChatGPT Enterprise (~$60/user/month, 150-user minimum) — BAA available by negotiation. Best for large hospital systems and health insurers who can clear the volume floor. Not practical for small practices.

OpenAI API with BAA (pay-per-token) — BAA available on request. Best for healthcare SaaS founders building their own product. Requires engineering team and custom development.

Microsoft Azure OpenAI (pay-per-token + Azure infrastructure) — BAA standard in Azure enterprise agreements. Best for Microsoft-shop hospitals with existing Azure commitments.

Google Cloud Vertex AI / Gemini (pay-per-token + GCP infrastructure) — BAA standard. Best for Google-shop healthcare organisations.

AWS Bedrock + Anthropic Claude (pay-per-token + AWS infrastructure) — BAA standard for eligible services. Best for AWS-shop healthcare orgs and SaaS builders.

Hippocratic AI (enterprise contract) — Purpose-built clinical LLM with BAA. Best for large health systems needing patient-facing care navigation with clinical-grade conversation.

The right pick is rarely the one with the biggest brand. It’s the one that matches your practice size, your engineering capacity, and your specific use case. A solo mental health practice and a 400-bed hospital system need fundamentally different solutions — and the compliance requirements are identical for both.

The question that changes the conversation

“Is ChatGPT HIPAA compliant?” is the question that brought most readers to this article. It’s also the wrong question — because it implies a binary answer for a product that has five tiers with three different compliance statuses.

The question that actually protects your practice is different: “Is every link in the chain between my staff’s clipboard and the final data processor covered by a BAA, encrypted in transit and at rest, access-controlled, audit-logged, and operating under a documented breach notification plan?”

If the answer to every part of that question is yes, your compliance posture is defensible. If any part is no — including a subprocessor link you didn’t think to check — the chain is broken and the violation exposure is real.

The therapist who posted on r/therapists wasn’t wrong to worry. The colleagues who thought a BAA made them safe weren’t careless — they just stopped one layer into a seven-layer problem.

The good news: the fix isn’t complicated. It’s a platform decision, not an infrastructure project. The right HIPAA-compliant AI alternative deploys in days, costs a fraction of what a breach investigation does, and answers every question in that chain before you have to ask.

Key Takeaways:

• Consumer ChatGPT (Free, Plus, Team) is NOT HIPAA compliant — OpenAI does not sign BAAs for these tiers. Custom GPTs inherit the same non-compliance. Pasting any PHI is a violation.
• The BAA Illusion: a signed BAA is treated as a compliance certification by practices that haven’t verified the other 6 layers — it’s layer 1 of 7, not a stamp of approval. The questions don’t stop at the signature.
• The Subprocessor Blind Spot: your vendor’s BAA with you is meaningless if their underlying AI subprocessor (often consumer ChatGPT) doesn’t have a BAA with them. The chain breaks at the link you never checked.
• “Per violation” means 50 patient names pasted in one session = 50 violations. Tier 1 minimum: $6,850. Tier 4 maximum: capped at $2,067,813/year. Total breach cost for a mid-size practice rarely under $250K.
• De-identification per HIPAA Safe Harbor requires removing 18 specific identifiers — not just the patient name. Removing names while leaving dates, locations, and medical record numbers intact doesn’t make data de-identified.
• ChatGPT Enterprise and the OpenAI API CAN be HIPAA-compliant with a signed BAA — but Enterprise requires ~150-user minimums and the API requires engineering capacity. Neither is the product most healthcare workers mean by “ChatGPT.”
• HIPAA-compliant alternatives exist across the price spectrum from $300/month turnkey to enterprise cloud LLM platforms — the choice is never between “use ChatGPT” and “don’t use AI.”