HIPAA, BAAs and AI in IME work
Short version: before any AI product sees PHI from an IME file, you need a signed BAA that names that product and plan, and the feature you use must be on the maker's covered list. Solo examiners can get one free from ChatGPT for Clinicians; Claude needs a 20 seat Enterprise plan; Gemini and Copilot ride on a Google Workspace or Microsoft 365 BAA.
Limits: We read each product's help pages, terms and pricing on 2026-11-12 and did not test how any product handles PHI. Plans, prices and laws change, and nothing here is legal advice for your state.
Which AI plans sign a BAA, as of 2026-11-12
The question for an examiner is not "is this AI HIPAA compliant?" Makers decide that plan by plan, and often feature by feature. The right question is "will this maker sign a BAA with me, for this plan, and does it cover what I am about to do?"
| Product, plan | BAA | Who can get it | Main exclusions or conditions | Source, captured |
|---|---|---|---|---|
| ChatGPT Free, Plus, Pro | No | Nobody | Content may train models unless you opt out | help.openai.com, 2026-11-12 |
| ChatGPT Business | No | Nobody | OpenAI: "We do not offer a BAA for ChatGPT Business." | help.openai.com, 2026-11-12 |
| ChatGPT for Clinicians | Yes | A verified US physician, NP, PA or pharmacist with an NPI; free | Individual use; no PHI to third-party GPTs or connected apps | help.openai.com, 2026-11-12 |
| ChatGPT for Healthcare, Enterprise with Regulated Workspace | Yes | Organizations, through sales | Only listed features; improved memory not covered | help.openai.com, 2026-11-12 |
| Claude Free, Pro, Max | No | Nobody | Training if the user allows it | privacy.claude.com, 2026-11-12 |
| Claude Enterprise, HIPAA-ready | Yes | Organizations; $20 per seat a month billed annually, 20 seat minimum, plus usage | Primary Owner must activate HIPAA settings; beta features such as Claude in Office excluded | privacy.claude.com, claude.com/pricing, 2026-11-12 |
| Gemini, personal Google account | No | Nobody | Human reviewers read some chats; reviewed chats kept up to 3 years | support.google.com, 2026-11-12 |
| Gemini app and Gemini in Workspace, work account | Yes | Workspace customers whose admin accepts the BAA | Gemini in Chrome and third-party add-ons excluded | workspace.google.com, 2026-11-12 |
| Microsoft 365 Copilot, Copilot Chat | Yes | Microsoft 365 commercial customers that are covered entities or business associates | BAA comes by default through the Online Services DPA | learn.microsoft.com, 2026-11-12 |
| OpenEvidence | Yes | Covered entities, under its standard BAA | Built for literature questions, not record files | openevidence.com, 2026-11-12 |
| Doximity Ask | Not stated; says users can include PHI | Free with a verified Doximity account | Ask Doximity for a BAA in writing before uploading a file | support.doximity.com, 2026-11-12 |
The IME record tools are in the tools table. IME Coach, Aequitas, InjuryMgmt, MediScan, easyIME and Dodonai say they sign BAAs.
How HIPAA reaches an IME file
IME work sits at an odd angle to HIPAA, and most AI guides skip it. 3 facts set the frame:
- The carrier may not be covered. HHS says the Privacy Rule does not apply to workers' compensation insurers, workers' comp agencies or employers, except where they are covered entities for other reasons.
- You probably are. A physician who bills health plans electronically in a treating practice is a covered entity, and that status does not switch off for IME days.
- HIPAA expects IMEs. 45 CFR 164.508(b)(4)(iii) lets a covered entity require an authorization before health care done solely to create PHI for a third party. That describes an IME.
The practical result: the records in your hands are PHI in your hands, whoever sent them. A cloud AI that stores or processes them on your behalf acts as your business associate, and needs a BAA. State law adds to this. Texas, for one, requires electronic health records under a covered entity's control to be stored in the United States from 2026-01-01, including records at a third-party cloud. The details are on the state rules page.
Why de-identifying an IME file does not work
HIPAA's Safe Harbor method treats data as de-identified once 18 identifier types are removed and you have no actual knowledge the rest could identify the person. Item C is "all elements of dates (except year)" tied to the individual: birth, admission, discharge, visit dates. An IME chronology is a list of dates. Strip them and the task goes with them.
Names are the easy part. The identifiers that survive a quick redaction in IME files are claim numbers (an account or other unique number), employer and street names (geography smaller than a state), provider fax headers, and the exam date in your own draft. If you need AI on the file itself, the honest route is a product under a BAA, not a redaction pass.
"Can I paste this?" checklist
Tick what applies. The answer updates as you go. It runs in your browser and stores nothing.
Source for the identifier list: HHS guidance on de-identification, captured 2026-11-12. Items are grouped; the HHS list has 18.
5 questions to ask before you sign any AI BAA
- Which products and features does it cover? OpenAI, Anthropic, Google and Microsoft each limit coverage to a list. Get the list.
- Who is the counterparty? An individual BAA (ChatGPT for Clinicians) covers you. An IME company needs one that covers every user.
- Where is the data stored and processed? Ask for model endpoint locations in writing, which matters in Texas.
- Is my data used to train models? Microsoft, ChatGPT for Clinicians, OpenEvidence and some IME tools, OctopusLM among them, say no. Get it in the contract, not a settings page.
- What happens to uploads and chat history after I delete them? Retention terms differ by plan; read them in the BAA or the maker's HIPAA guide.