AI vendors that sign HIPAA Business Associate Agreements

AI vendors that publicly offer a HIPAA Business Associate Agreement, enabling lawful processing of Protected Health Information.

For healthcare buyers — providers, health plans, clearinghouses — a signed HIPAA Business Associate Agreement is a hard prerequisite for any AI vendor that may touch PHI. The vendors below publicly offer a BAA. That alone is necessary but not sufficient: the BAA must cover sub-processors (most AI vendors route through OpenAI, Anthropic, Google, or Mistral), specify breach reporting, and address PHI handling end-to-end. Ask for the BAA template before signing the master agreement.

Vendors with HIPAA BAA

Buyer checklist

• Confirm the BAA covers sub-processors (which upstream model APIs see your data).
• Verify that breach reporting timeline meets your covered entity's policy.
• Confirm the vendor will return or destroy PHI at termination.
• Check whether the BAA is included at all pricing tiers or only enterprise.
• Run a mock incident-response tabletop covering the vendor as a business associate.