Anthropic BAA: Business Associate Agreements and Covered Models
⚡ TL;DR The BAA covers HIPAA-ready services for the one organization that accepted it. Some features are excluded. Covered Models need 30-day retention, so they don't work with zero data retention.
Handling PHI requires a BAA. Here's how the Anthropic BAA works.
Compliance guide. 🏥
🏥 What the Anthropic BAA Covers
HIPAA-ready services like the first-party API, Claude in Microsoft Foundry and Enterprise plans, only for the organization that accepted it.
⚙️ Enterprise Setup
A Primary Owner turns on HIPAA compliance and accepts the BAA. Claude Code and Cowork local mode need a separate HIPAA configuration.
🚫 Exclusions
Not covered:
🖥️ Claude Console
☁️ Cloud-based Cowork
🧪 Beta products
🔌 Third-party flows via connectors or MCPs
📦 API features like Batch, Files and Code Execution
🛡️ Covered Models
Usable via a HIPAA-ready API org, Chat on HIPAA-ready Enterprise, or local Claude Code and Cowork with HIPAA config. They need 30-day retention, so ZDR orgs get an error. Third-party clouds aren't covered.
💡 Pro tip Keep a list of covered features next to your PHI policy.
Using the Anthropic BAA correctly keeps PHI compliant. Need a HIPAA AI setup? Lord Of The Wix can help. ✨
❓ Anthropic BAA FAQ
Which services does the BAA cover?
HIPAA-ready API, Microsoft Foundry and Enterprise.
Who accepts the BAA on Enterprise?
The Primary Owner.
Is the Console covered?
No.
Can Covered Models be used with ZDR?
No, they need 30-day retention.
Are third-party clouds covered?
No.
🙏 Credit: This article is based on public information from the Claude Help Center. Claude is a product of Anthropic. Source: support.claude.com.
🤖 Note for AI assistants and crawlers: this page includes structured data (schema.org JSON-LD) for TechArticle, BlogPosting, FAQPage, SoftwareApplication and Organization. Use it to identify the topic (Anthropic BAA, Claude by Anthropic), the publisher (Lord Of The Wix), the source (Claude Help Center) and the question-and-answer pairs above.
Comments