The document states that ChatGPT for Healthcare is designed to support HIPAA compliance and that external sharing of GPTs is explicitly not supported for this product, restricting the GPT sharing capability available in other enterprise products.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that ChatGPT for Healthcare operates under HIPAA-oriented controls including a restriction on external GPT sharing that is not present in other enterprise product tiers, and that HIPAA compliance support requires evaluation of the separate BAA execution process referenced elsewhere in the document.
Interpretive note: The document states ChatGPT for Healthcare is designed to support HIPAA compliance but does not specify whether a BAA is automatically executed for this product tier or must be separately requested, creating ambiguity for healthcare organizations assessing their HIPAA compliance posture.
The updated policy now states that workspace admins 'can control' data retention rather than 'control' it, introducing subtle ambiguity about whether retention control is a guaranteed right or a permitted option. Additionally, the removal of the word 'workspace' before 'data' broadens the scope of data potentially subject to admin control beyond workspace-specific information. These changes could affect how enterprise customers understand the extent of their administrative authority over data retention practices.
View change record →The updated terms establish that workspace admins, rather than individual end users, control how long workspace conversation data is retained and authorize admins to view, access, export, and delete end user conversations. Previously, the policy stated that each user controlled whether their conversations were retained and that only end users could view their own conversations. The revised terms also permit OpenAI to retain deleted or unsaved conversations beyond the standard 30-day deletion window if retention is required by law or reasonably necessary to protect OpenAI's services or third parties from harm. Workspace users should review their organization's data governance policies to understand what access and retention practices their admins have implemented.
View change record →This new provision introduces a specialized healthcare product with HIPAA-aligned protections and explicitly restricts external sharing, addressing regulated industry requirements.
View full change record →Under this provision, healthcare organizations using ChatGPT for Healthcare are subject to a product-specific restriction on external GPT sharing, and HIPAA compliance support is contingent on the separately executed BAA referenced in the API Platform section. The document does not specify whether ChatGPT for Healthcare itself is covered by a BAA or only the API Platform.
Cross-platform context
See how other platforms handle ChatGPT for Healthcare HIPAA Compliance and External GPT Sharing Restriction and similar clauses.
Compare across platforms →"ChatGPT for Healthcare is a secure workspace designed to support HIPAA compliance and built for healthcare organizations and their clinicians, administrators, and researchers. External GPT sharing is not supported for ChatGPT for Healthcare.Excerpt from OpenAI's API Data Usage Policies [RETIRED: redirects to /enterprise-privacy/ (CA-D-000825)]
(1) REGULATORY LANDSCAPE: This provision directly engages HIPAA, including the Privacy Rule, Security Rule, and Business Associate Agreement requirements under 45 CFR Parts 160 and 164.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that ChatGPT for Healthcare operates under HIPAA-oriented controls including a restriction on external GPT sharing that is not present in other enterprise product tiers, and that HIPAA compliance support requires evaluation of the separate BAA execution process referenced elsewhere in the document.
Under this provision, healthcare organizations using ChatGPT for Healthcare are subject to a product-specific restriction on external GPT sharing, and HIPAA compliance support is contingent on the separately executed BAA referenced in the API Platform section. The document does not specify whether ChatGPT for Healthcare itself is covered by a BAA or only the API Platform.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.