Is ChatGPT HIPAA Compliant? What Colorado Medical Practices Need to Know

Somewhere in your practice right now, someone is probably using ChatGPT. Maybe your front desk lead is polishing a patient email. Maybe a provider is summarizing visit notes. Maybe your billing team is drafting an appeal letter.

That’s not a bad thing. AI can give your team real time back. But if any of that work includes patient information, there’s an important question to answer first: is ChatGPT HIPAA compliant?

The short answer: the version most people use is not. The good news is there are safe ways to bring AI into your practice. Here’s what Colorado medical practices, dental offices, and other healthcare organizations need to know.

The Short Answer: It Depends on Which ChatGPT

ChatGPT isn’t one product. It comes in several versions, and whether you can use one with patient data comes down to one document: a Business Associate Agreement (BAA).

A BAA is a contract where a vendor agrees to protect patient data the way HIPAA requires. The U.S. Department of Health and Human Services requires one before any outside vendor handles your protected health information (PHI). No BAA means no PHI in the tool.

In January 2026, OpenAI launched ChatGPT for Healthcare, a workspace built for clinical and administrative teams. It includes a BAA, role-based access controls, and audit logs, and OpenAI says it doesn’t train its models on your content. According to The HIPAA Journal, OpenAI still won’t sign a BAA for its Free, Plus, or Team plans.

One important detail: even with a BAA, no tool is “HIPAA compliant” out of the box. It still has to be set up with the right access controls, user management, and policies. Compliance is something your practice does, not something you buy.

OpenAI’s terms have changed quickly, so always confirm current BAA availability with OpenAI before you sign up. Not sure which AI platform fits your team? Our comparison of ChatGPT, Claude, and Copilot for business breaks it down.

Why It Matters: What Counts as Patient Data

PHI is broader than most people expect. It’s any health information that can be tied to a specific person, including:

• Names, addresses, phone numbers, and email addresses
• Dates of birth, appointment dates, and admission or discharge dates
• Medical record numbers, insurance IDs, and account numbers
• Diagnoses, treatment notes, lab results, and prescriptions
• Photos, voice recordings, or anything else that identifies a patient

So “Write a follow-up email to Jane Smith about her MRI results” includes PHI. “Write a friendly template reminding patients to schedule their annual physical” does not.

The stakes are real. In January 2026, HHS raised HIPAA civil penalties for inflation. Fines now range from $145 to more than $73,000 per violation, with annual caps above $2.1 million for the most serious category. For a 40-person clinic, even one avoidable incident can mean months of cleanup, patient notifications, and lost trust. For a closer look at budgeting, see what HIPAA compliance really costs Colorado organizations.

The Bigger Risk: Shadow AI

For most small and mid-sized practices, the biggest risk isn’t the AI tool you chose. It’s the ones you don’t know about.

Shadow AI means staff using AI tools that leadership hasn’t approved. A January 2026 Wolters Kluwer survey of 518 healthcare professionals found:

• 40% had come across unauthorized AI tools at work
• Nearly 20% had used one themselves
• 1 in 10 had used one for direct patient care
• Half said they did it to get work done faster

That last point matters. Your team isn’t being careless. They’re busy, and AI helps. The answer isn’t to ban AI. It’s to give people a safe, approved option and clear guidelines so they don’t have to guess. If you’re not sure where your team stands, start with how to find out how your employees are using AI.

What’s Changing for Colorado Practices

Two regulatory shifts make now a good time to get your AI house in order.

1. The HIPAA Security Rule is getting its first major update in years. HHS has pushed the final rule to July 2027. The proposed changes include required multifactor authentication, encryption, a technology asset inventory, regular security testing, and yearly verification that your vendors (AI vendors included) have the right safeguards. That gives practices time to prepare instead of scrambling. Our guide to HIPAA compliance for Denver healthcare organizations is a good place to start.

2. Colorado replaced its AI law. In May 2026, Governor Polis signed SB 26-189, which repeals and replaces the original Colorado AI Act. It takes effect January 1, 2027, and healthcare is one of the areas it covers. If your practice uses AI that helps make important decisions about patients (some patient intake tools, for example), you may need to tell patients when AI is involved and offer a way to request human review. We covered the details in what SB 26-189 means for Colorado businesses. Talk to your legal counsel about how it applies to your practice.

6 Steps to Use AI Safely in Your Practice

You don’t need a big IT budget to do this right. Here’s where we recommend practices with 20 to 100 employees start:

1. Find out what’s already in use. Ask your team which AI tools they use and what for. Keep it judgment-free and you’ll get more honest answers.
2. Pick an approved tool. Choose an AI platform that will sign a BAA, or one built into tools you already trust. For example, Microsoft 365 Copilot can fall under Microsoft’s HIPAA BAA on eligible business plans. For extra control, some practices choose a private AI environment.
3. Get the BAA signed before anyone enters patient data. No exceptions, and no “we’ll sort it out later.”
4. Write a simple AI acceptable use policy. One or two pages is plenty. Cover which tools are approved, what data can and can’t go in, and who to ask when unsure. Here’s how to write an AI policy for ChatGPT at work, plus tips specific to AI policies for regulated businesses.
5. Train your team with real examples. Show the difference between a safe prompt and a risky one. Five minutes at a staff meeting goes a long way, and our AI training for Colorado businesses can help.
6. Lock down the basics. Multifactor authentication, user access controls, and audit logs protect you today and prepare you for the 2027 HIPAA changes.

Tip: When in doubt, remove identifiers. “Draft a letter to a patient about rescheduling a procedure” gets you the same helpful draft as including their name, without the risk.

For a deeper look at day-to-day rules for your staff, read Can Healthcare Staff Use ChatGPT? HIPAA Compliance Rules for 2026.

Frequently Asked Questions

Is ChatGPT HIPAA compliant?

The Free, Plus, and Team versions are not, because OpenAI won’t sign a BAA for them. ChatGPT for Healthcare, launched in January 2026, includes a BAA for qualifying organizations, but it still has to be set up and managed correctly.

Can I use ChatGPT if I remove patient names?

You can use it with properly de-identified information. But removing a name alone often isn’t enough. Dates, locations, and rare conditions can still identify someone. Follow HHS de-identification guidance, or use an approved tool with a BAA.

Does OpenAI sign a BAA?

Yes, for ChatGPT for Healthcare and for some Enterprise and API customers. Not for personal or small-team plans. Confirm current terms with OpenAI directly.

What happens if a staff member puts PHI into ChatGPT?

It may count as a HIPAA breach. Talk with your privacy officer right away to assess the incident and decide whether notification is required.

Are other AI tools HIPAA compliant?

Some are, when used with a BAA and the right setup. Microsoft 365 Copilot, for example, can be covered under Microsoft’s BAA on eligible business plans. The same rule applies to every tool: BAA first, then setup, then training. An AI governance plan keeps it all organized.

Bring AI Into Your Practice With Confidence

AI can give your team hours back every week. You just need the right guardrails in place first.

At eCreek, we’re Your IT Department, and we help Colorado healthcare practices adopt AI safely. We’ll help you find out what’s already in use, choose tools that fit HIPAA, set up the right compliance and cybersecurity controls, and get your team comfortable using them. And when you need us, a real Colorado-based tech responds in under 15 minutes.

Curious where your practice stands today? Take our AI maturity quiz or explore our AI services.

Book a free consultation with our team →