The document states that OpenAI can execute Business Associate Agreements with HIPAA-covered entities and business associates requiring contractual HIPAA protections for their use of OpenAI services.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that OpenAI offers BAA execution as a contractual mechanism for healthcare sector customers subject to HIPAA, which is a prerequisite for lawful processing of protected health information through OpenAI services.
Interpretive note: The scope of covered services under the BAA and the specific PHI categories addressed are not disclosed on this page; full compliance assessment requires review of the BAA instrument.
The updated policy now states that workspace admins 'can control' data retention rather than 'control' it, introducing subtle ambiguity about whether retention control is a guaranteed right or a permitted option. Additionally, the removal of the word 'workspace' before 'data' broadens the scope of data potentially subject to admin control beyond workspace-specific information. These changes could affect how enterprise customers understand the extent of their administrative authority over data retention practices.
View change record →The updated terms establish that workspace admins, rather than individual end users, control how long workspace conversation data is retained and authorize admins to view, access, export, and delete end user conversations. Previously, the policy stated that each user controlled whether their conversations were retained and that only end users could view their own conversations. The revised terms also permit OpenAI to retain deleted or unsaved conversations beyond the standard 30-day deletion window if retention is required by law or reasonably necessary to protect OpenAI's services or third parties from harm. Workspace users should review their organization's data governance policies to understand what access and retention practices their admins have implemented.
View change record →This generic HIPAA provision was replaced by the more specific 'ChatGPT for Healthcare' product-specific provision that embeds HIPAA compliance into a dedicated workspace offering.
View full change record →This new provision enables healthcare and covered entity customers to achieve HIPAA compliance through BAA availability, significantly expanding enterprise use cases.
View full change record →Organizations subject to HIPAA that process protected health information through OpenAI's services can request a Business Associate Agreement, which the document states is available; without such an agreement, processing PHI through OpenAI services would not have the required contractual HIPAA protections in place.
How other platforms handle this
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
When you are asked to provide information, you may decline to do so; but if you choose not to provide information that is necessary to provide some of our Services, you may not be able to use those Services.
to object to profiling activities based on our own legitimate interests
"We support HIPAA compliance. OpenAI can enter into a Business Associate Agreement (BAA) with covered entities and business associates that require one for their use of our services.Excerpt from OpenAI's API Data Usage Policies [RETIRED: redirects to /enterprise-privacy/ (CA-D-000825)]
1) REGULATORY LANDSCAPE: This provision engages HIPAA's Privacy and Security Rules, which require covered entities and their business associates to execute BAAs before disclosing protected health information to service providers.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that OpenAI offers BAA execution as a contractual mechanism for healthcare sector customers subject to HIPAA, which is a prerequisite for lawful processing of protected health information through OpenAI services.
Organizations subject to HIPAA that process protected health information through OpenAI's services can request a Business Associate Agreement, which the document states is available; without such an agreement, processing PHI through OpenAI services would not have the required contractual HIPAA protections in place.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.