Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document states that ChatGPT for Healthcare is designed to support HIPAA compliance and that external sharing of GPTs is explicitly not supported for this product, restricting the GPT sharing capability available in other enterprise products.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that ChatGPT for Healthcare operates under HIPAA-oriented controls including a restriction on external GPT sharing that is not present in other enterprise product tiers, and that HIPAA compliance support requires evaluation of the separate BAA execution process referenced elsewhere in the document.
Interpretive note: The document states ChatGPT for Healthcare is designed to support HIPAA compliance but does not specify whether a BAA is automatically executed for this product tier or must be separately requested, creating ambiguity for healthcare organizations assessing their HIPAA compliance posture.
The updated policy now states that workspace admins 'can control' data retention rather than 'control' it, introducing subtle ambiguity about whether retention control is a guaranteed right or a permitted option. Additionally, the removal of the word 'workspace' before 'data' broadens the scope of data potentially subject to admin control beyond workspace-specific information. These changes could affect how enterprise customers understand the extent of their administrative authority over data retention practices.
View change record →The updated terms establish that workspace admins, rather than individual end users, control how long workspace conversation data is retained and authorize admins to view, access, export, and delete end user conversations. Previously, the policy stated that each user controlled whether their conversations were retained and that only end users could view their own conversations. The revised terms also permit OpenAI to retain deleted or unsaved conversations beyond the standard 30-day deletion window if retention is required by law or reasonably necessary to protect OpenAI's services or third parties from harm. Workspace users should review their organization's data governance policies to understand what access and retention practices their admins have implemented.
View change record →This new provision introduces a specialized healthcare product with HIPAA-aligned protections and explicitly restricts external sharing, addressing regulated industry requirements.
View full change record →Under this provision, healthcare organizations using ChatGPT for Healthcare are subject to a product-specific restriction on external GPT sharing, and HIPAA compliance support is contingent on the separately executed BAA referenced in the API Platform section. The document does not specify whether ChatGPT for Healthcare itself is covered by a BAA or only the API Platform.
Cross-platform context
See how other platforms handle ChatGPT for Healthcare HIPAA Compliance and External GPT Sharing Restriction and similar clauses.
Compare across platforms →Monitoring
OpenAI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"ChatGPT for Healthcare is a secure workspace designed to support HIPAA compliance and built for healthcare organizations and their clinicians, administrators, and researchers. External GPT sharing is not supported for ChatGPT for Healthcare.Excerpt from OpenAI's API Data Usage Policies [RETIRED: redirects to /enterprise-privacy/ (CA-D-000825)]
(1) REGULATORY LANDSCAPE: This provision directly engages HIPAA, including the Privacy Rule, Security Rule, and Business Associate Agreement requirements under 45 CFR Parts 160 and 164. HHS OCR is the relevant enforcement authority. Healthcare organizations using ChatGPT for Healthcare to process PHI should confirm BAA execution status, as this document references BAA availability for the API Platform but does not specify whether a separate BAA is required or available for the ChatGPT for Healthcare product tier. (2) GOVERNANCE EXPOSURE: High for healthcare organizations that have not confirmed BAA execution for their specific product tier. The document's reference to HIPAA compliance support without clearly specifying the BAA instrument and coverage scope for ChatGPT for Healthcare creates ambiguity requiring direct confirmation with OpenAI and legal review. (3) JURISDICTION FLAGS: All U.S. covered entities and business associates under HIPAA are directly affected. State healthcare privacy laws that may impose additional obligations beyond HIPAA, including California's Confidentiality of Medical Information Act, should be assessed for interactions with ChatGPT for Healthcare deployment. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams at healthcare organizations must confirm that a BAA has been executed and that it covers the ChatGPT for Healthcare product specifically, not solely the API Platform. Vendor assessments should include review of the SOC 2 Type 2 audit scope to confirm that healthcare-specific controls are addressed. The external GPT sharing restriction should be documented as an operational limitation in procurement records. (5) COMPLIANCE CONSIDERATIONS: Healthcare compliance teams should assess whether ChatGPT for Healthcare deployments are consistent with their HIPAA risk analysis and risk management plans. The restriction on external GPT sharing should be reflected in internal acceptable use policies for ChatGPT for Healthcare. Organizations should confirm that the authorized employee and contractor access provisions applicable to ChatGPT for Healthcare are consistent with HIPAA minimum necessary access standards and BAA terms.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes that ChatGPT for Healthcare operates under HIPAA-oriented controls including a restriction on external GPT sharing that is not present in other enterprise product tiers, and that HIPAA compliance support requires evaluation of the separate BAA execution process referenced elsewhere in the document.
Under this provision, healthcare organizations using ChatGPT for Healthcare are subject to a product-specific restriction on external GPT sharing, and HIPAA compliance support is contingent on the separately executed BAA referenced in the API Platform section. The document does not specify whether ChatGPT for Healthcare itself is covered by a BAA or only the API Platform.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.