Can my therapy practice use ChatGPT?

If anyone on your team has pasted a session summary, an intake note or a billing question into ChatGPT, your practice has a HIPAA question to answer. The short version comes first, then the reasoning.

The short answer

Patient information should not go into ChatGPT’s consumer plans, or into ChatGPT Business. OpenAI’s own HIPAA guide, posted July 9, 2026, says so directly: “ChatGPT services for consumers (e.g., Free, Plus, Pro) and ChatGPT Business are not Eligible Services.” The same section says that a customer who is not using an Eligible Service “may not upload, transmit, or process PHI with ChatGPT.”

Why a plan can be off limits

HIPAA applies to covered entities and their business associates. HHS describes a covered entity as a health plan, a health care clearinghouse, or a health care provider who conducts certain billing and payment related transactions electronically, and whether your practice is one is worth confirming with your counsel. HIPAA treats a company that handles patient information for a covered entity as a business associate. The federal definition covers a person who, on behalf of a covered entity, “creates, receives, maintains, or transmits protected health information” for a regulated function (45 CFR 160.103). A practice may let a business associate do that if it obtains “satisfactory assurance” that the information will be safeguarded, and the assurance must be documented in a written contract or other written agreement (45 CFR 164.502(e)).

That contract is the business associate agreement, or BAA. OpenAI’s guide states the consequence in one line: “If you do not have a BAA with OpenAI, you may not use the Services with Protected Health Information.” For OpenAI, that means no agreement that covers the service, no patient information in it.

Which ChatGPT products can be covered

The ChatGPT section of the guide applies when a customer has a BAA that includes “ChatGPT for Healthcare, ChatGPT for Clinicians, ChatGPT Enterprise / Education with the Regulated Workspace, or any other ChatGPT service identified as an Eligible Service in the BAA.” The agreement has to name the product. The guide says the same about OpenAI’s developer API: if the BAA “does not expressly specify OpenAI API Services are Eligible Services,” the customer may not process patient information through it.

We have not checked whether those products are sold to a practice of your size, or what they cost. The guide is not fixed either: it says OpenAI may update or revise it from time to time.

Signing one still leaves work on your side

The guide says it “does not constitute legal advice” and that following it “does not ensure compliance.” It assigns the customer a list of duties: configure single sign-on, monitor how staff use the service, set up backup and recovery for emergency access, and keep patient information out of support requests. OpenAI’s Healthcare Addendum adds that the customer must test the service for accuracy in its own use cases, and that only trained and qualified people who hold the licenses, certifications or other authorizations the work requires may use the service or its output for healthcare activities.

What your staff can do today

Until an agreement covers the tool, treat a consumer chat app as a place for no patient information at all. Writing a letter template, drafting a policy from scratch or asking what a billing code means involves none.

Removing a name does not take the patient out. HIPAA gives two routes to information that counts as de-identified. One needs an expert’s documented determination. The other requires removing eighteen kinds of identifier, including all elements of dates (except year) directly related to a person, and the practice must have no actual knowledge that what is left could identify them (45 CFR 164.514(b)).

Questions to put to any AI vendor

• Will you sign a BAA that names this exact product and plan?
• What does the agreement leave out? Ask about plug-ins, add-ons, connectors and early-access features in particular.
• How long are inputs and outputs kept, who can read them, and can retention be set to none?
• Can we export and delete everything we put in, with tools we control?
• May we put patient information in a support request? (OpenAI’s guide says its customers may not.)

This is general information, not legal advice. Ask your own counsel about your practice.

Where this comes from

Each passage in quotation marks is copied from one of these pages as we read it on October 23, 2026. Providers change their pages, so open the current version before you rely on a passage.

• OpenAI, HIPAA Implementation and Configuration Guide (posted July 9, 2026)
• OpenAI, Healthcare Addendum and BAA (version 111124)
• 45 CFR 160.103, definitions (business associate)
• 45 CFR 164.502(e), disclosures to business associates
• 45 CFR 164.514(b), de-identification
• HHS Office for Civil Rights, Guidance on HIPAA and Cloud Computing (content last reviewed December 23, 2022; we read the Internet Archive copy of December 31, 2025)