[ HIPAA · BAA · AI-BUILT APPS ]
A tool is usable with patient data only on the plans where the vendor signs a Business Associate Agreement. Claude: Enterprise with the HIPAA configuration, or a HIPAA-ready API organization. ChatGPT: eligible Enterprise and API customers. Supabase: Team plan with the HIPAA add-on. Vercel: Pro with the add-on, or Enterprise. Lovable: never. Free and consumer tiers: never. Checked 15 October 2026.
Review my app's HIPAA chainFree first call. Written verdict in three business days. The review fee is credited toward the fix.
Pick a tool. Every row is sourced and dated.
Only on two surfaces: Claude Enterprise with the HIPAA configuration turned on, and the first-party API in a HIPAA-ready organization or with zero data retention. Free, Pro, Max and Team carry no BAA.
Source: Anthropic help center: Covered Models under a Business Associate Agreement, checked 15 October 2026.
Vendor pages only. Your plan and your code on the call turn this into a verdict.
[ THE BAA TABLE ]
We add a tool when its post ships and re-check every row monthly. The date on each block is the last time a human read the vendor page.
Only on two surfaces: Claude Enterprise with the HIPAA configuration turned on, and the first-party API in a HIPAA-ready organization or with zero data retention. Free, Pro, Max and Team carry no BAA.
| Plan or surface | BAA | What that means |
|---|---|---|
| Claude Enterprise with the HIPAA configuration turned on | BAA | The Primary Owner turns it on and accepts the BAA; it is a one-way switch. Chat, projects, Claude Code in local mode and Cowork in local mode are covered. |
| Claude Free, Pro and Max | No BAA | Consumer plans. Not in the list of eligible services. No PHI. |
| Claude Team | No BAA | A seat plan without the HIPAA configuration. Not eligible. |
| Claude API, HIPAA-ready organization | BAA | Sales switches the organization on. Standard retention, every model. |
| Claude API with zero data retention | Conditional | Covered, but the newest Covered Models need 30-day retention and return an error from a ZDR organization. Pick the model or pick ZDR. |
| Claude Code | Conditional | Covered under Enterprise with the HIPAA configuration, or on an API organization with ZDR. Not on a regular API organization and not through a third-party cloud. |
| Cowork | Conditional | Desktop local mode under the Enterprise HIPAA configuration is covered. Cowork in the cloud is not, and the configuration cannot be applied to it. |
| Claude on Bedrock or Vertex | No BAA | Anthropic's BAA does not apply to services bought through a third-party cloud. The cloud provider's own BAA is a separate question. |
| Skills, connectors and MCP servers | No BAA | Skills are available but not covered. Data a connector sends to a third party is outside Anthropic's BAA even after an Owner turns it on; that party needs its own agreement with you. |
Source: Anthropic help center: Covered Models under a Business Associate Agreement, checked 15 October 2026. Our read: Claude, plan by plan.
Only where OpenAI signs a BAA: ChatGPT for Healthcare, ChatGPT Enterprise and the API, for eligible customers who ask. Free, Go, Plus and self-serve Business get no BAA.
| Plan or surface | BAA | What that means |
|---|---|---|
| ChatGPT for Healthcare and ChatGPT Enterprise | Conditional | Eligible customers apply for a BAA with OpenAI. It is not on by default and not every customer is eligible. |
| OpenAI API | Conditional | BAA on request for eligible API customers. Ask for it in writing before any PHI is sent. |
| ChatGPT Free, Go, Plus and self-serve Business | No BAA | No BAA is offered on consumer and self-serve tiers. No PHI. |
Source: OpenAI for Healthcare (official page), checked 15 October 2026. Our read: ChatGPT or Claude for PHI.
Only on the Team plan and up with the paid HIPAA add-on, for projects configured as high compliance. Free, Pro and self-hosted projects get no BAA.
| Plan or surface | BAA | What that means |
|---|---|---|
| Supabase Team plan and up with the HIPAA add-on | BAA | Only for projects configured as high compliance. Team is listed from $599 a month; the add-on is paid. |
| Supabase Free and Pro | No BAA | No BAA. A PHI table on a Pro project is a HIPAA problem the day it holds a real patient. |
| Supabase self-hosted | No BAA | Supabase signs nothing; the hosting provider and your own controls carry the obligation. |
Source: Supabase HIPAA documentation, read for our Supabase post, checked 2 October 2026. Our read: Supabase, Vercel and Lovable apps.
Only on Pro with the HIPAA add-on or on Enterprise, and only matters where Vercel actually processes PHI: serverless functions, logs and edge, not a static front end.
| Plan or surface | BAA | What that means |
|---|---|---|
| Vercel Pro with the HIPAA add-on, and Enterprise | BAA | The Pro add-on is listed at $350 a month. Only when Vercel actually handles PHI (serverless functions, logs, edge). |
| Vercel Hobby and Pro without the add-on | No BAA | No BAA. A static front end that never touches PHI can stay here; functions that do cannot. |
Source: Supabase HIPAA documentation, read for our Supabase post, checked 2 October 2026. Our read: Vercel, inside the Supabase post.
No. Lovable's data processing agreement has customers agree not to provide PHI, on every plan. A Lovable healthcare app needs its PHI backend somewhere a BAA exists.
| Plan or surface | BAA | What that means |
|---|---|---|
| Lovable, every plan | No BAA | Lovable's data processing agreement has customers agree not to provide PHI. The app has to move its PHI backend off Lovable Cloud. |
Source: Supabase HIPAA documentation, read for our Supabase post, checked 2 October 2026. Our read: Why vibecoded healthcare apps fail HIPAA.
Not here yet: Cursor and Claude Code as a dev workflow, Firebase, n8n, Twilio and the email vendors. Each gets a row the week its post ships. If your vendor is missing, ask on the call and we check it with you.
[ THE CHAIN ]
1
IntakeQ includes a BAA on every plan. Healthie, SimplePractice, athenahealth and the big EHRs gate it behind plans, developer programmes or paper.
2
The table above. Only Enterprise with the HIPAA configuration, a HIPAA-ready API organization, or an API organization with zero data retention. Never a consumer plan.
3
Database, host, email, SMS, analytics, error tracking, the automation tool. Each one signs, or it never sees PHI. One unsigned vendor is one breach.
4
Builds run in your accounts, so the agreements are yours. If we ever host a service that touches PHI, we sign as your business associate first.
The sentence we will not write on any page: "nothing leaves your environment". With a hosted model, PHI goes to the vendor for inference. The defensible sentence is: training disabled and zero data retention, under a signed BAA, on a surface the vendor lists as eligible. We deleted the other sentence from five of our own pages.
[ TWO WAYS TO USE THIS ]
The table above, the tool posts below, and the HIPAA checklist for AI-generated code. Enough to find the unsigned vendor and the key in the client bundle on your own. Nobody at Oktopeak sees anything.
Open the checklistThe first call is free. Then a paid review of the codebase and the vendor chain, credited in full toward the fix if you build with us. A written verdict within three business days: what stays, what gets hardened, what is rewritten, and which BAA is missing. You keep the report either way, and you can hand it to any developer.
Book my free first callFile by file and vendor by vendor. The verdict names what stays, what gets hardened, what is rewritten, and which agreement is missing. Hardening or a phased rebuild in weeks, in your accounts, with acceptance criteria per milestone. Fixed price after the review, never before.
[ TOOL BY TOOL ]
Enterprise with the HIPAA configuration, the API, what Cowork and Claude Code need, and why the newest models cannot run on ZDR.
Team plan plus the add-on, high-compliance projects, the Vercel add-on, and the isolated PHI backend pattern for AI-built apps.
Which vendor signs what, and what a practice can do today without a BAA at all.
Four parties in the chain, who signs, who refuses, and what to build when nobody will.
The 20 percent the generator never adds: access control, audit log, encryption at rest, a BAA-backed backend.
What to grep for before a clinic sees the demo.
The 12-point checklist we run on our own connectors.
The patient-facing side, built so an audit passes on the first pass.
Connecting Claude to the EHR once the chain exists is healthcare AI integration; moving or wiring the EHR itself is EHR integration; a prototype that needs to become a product is vibe code rescue.
[ FAQ ]
Strictly, nothing is HIPAA compliant on its own. A tool becomes usable with protected health information when the vendor signs a Business Associate Agreement for the plan and surface you use, and when your own build adds the controls the rule requires: encryption, access control, an audit log, retention and breach handling. The table on this page answers the first half, vendor by vendor and plan by plan, with the source and the date we checked. The review answers the second half for your code.
No. The BAA covers the vendor's side of the relationship. A Supabase project under a BAA with a PHI table readable by the anonymous key is still a breach. The agreement is the entry ticket; your schema, roles, logging and the rest of the chain decide the outcome.
De-identified under the Safe Harbor or Expert Determination method, yes, because it is no longer PHI. In practice most "we removed the names" datasets still carry dates, locations and free text that identify a patient. Our rule for clients: consumer plans never see a chart, a transcript or a note. Structural work, drafting templates and public documents are fine.
The first call is free. Then a paid review of the codebase and the vendor chain, credited in full toward the fix if you build with us. A written verdict within three business days: what stays, what gets hardened, what is rewritten, and which BAA is missing. You keep the report either way, and you can hand it to any developer.
A fixed fee, stated on the free first call once we know the size of the codebase and the number of vendors in the chain, credited in full toward the fix if you build with us. We do not publish a number because the honest one depends on what we are reading. The build that follows is fixed price after the review, never before.
Builds run in your cloud accounts, under your vendor agreements, so for a build there is nothing for us to sign as a business associate: we do not hold your PHI. If we ever operate a hosted service that touches PHI on your behalf, we sign a BAA before the first record flows. Our open-source connectors run in your environment and keep their audit log there.
Four to eight weeks for most AI-built apps: the UI and the data model usually stay, the authentication, access control, audit logging and the PHI backend are rebuilt or moved. A full phased rebuild is scoped as its own project with a date in writing.
[ THE FIRST CALL IS FREE ]
Thirty minutes, both founders. We tell you which link in the chain is missing and whether the fix is a plan change, a hardening sprint or a rebuild. Then the written review, credited toward whatever comes next.
Review my app's HIPAA chainPrefer to read first? Start with Claude, plan by plan.
