ChatGPT Enterprise BAA: Cost, Minimum Seats & How to Get One

OpenAI publishes product-specific BAA eligibility. Its current guidance says sales-managed ChatGPT Enterprise or Edu customers may request a BAA and that ChatGPT Business is not eligible; separately, its HIPAA-eligible product list specifies ChatGPT for Enterprise with Regulated Workspace rather than ordinary Enterprise and does not list Edu as a standalone product (^[1]). Therefore Free, Go, Plus, Pro, and Business should not be used to send PHI to OpenAI when OpenAI would be acting as a business associate. That statement is narrower than saying those plans can never be involved with any health-related information: HIPAA applicability still depends on the regulated parties, purpose, data, authorizations, de-identification, and other exceptions.

OpenAI publishes product-specific BAA eligibility rather than a single rule for every account. For ChatGPT, its current guidance says sales-managed Enterprise or Edu customers may request a BAA; its separate HIPAA-eligibility guidance specifies Enterprise with Regulated Workspace and does not list Edu as a standalone eligible product, while distinct pathways apply to healthcare workspaces, verified clinicians, and API accounts provisioned with Modified Retention (^[1]) (^[2]). OpenAI does not publish ChatGPT Enterprise per-seat pricing or a minimum seat commitment. Buyers must contact sales for a quote, and the sales form asks for an estimated seat count and requirements; neither that request nor a third-party estimate establishes a universal minimum (^[3]). Accordingly, this article does not present unofficial price bands, seat floors, or annual-spend calculations as procurement facts.

Signing the BAA does not mean every ChatGPT feature is covered. OpenAI publishes an explicit allow list, current at time of writing, that includes chat with files, voice, web search and Deep Research (drawing only from OpenAI's own index rather than third-party providers like Bing), Canvas, image generation, Projects, GPTs, and the desktop and mobile clients, while any feature an administrator enables outside that list is, by OpenAI's own language, "intended only for uses that do not involve transmission, storage, or processing of PHI" (^[4]). API customers face a narrower slice still: the BAA only extends to endpoints eligible for Modified Retention, a list of roughly two dozen named endpoints (^[5]). OpenAI itself frames this against a broader trend: citing the American Medical Association, the company notes that physicians' use of AI "nearly doubled in a year" (^[6]), a pattern this report verifies independently below.

The competitive backdrop matters for anyone comparing vendors. Microsoft has offered a HIPAA BAA covering in-scope Microsoft 365 services, including Microsoft 365 Copilot and Copilot Chat, for years under its standard commercial online-services terms (^[7]). Google requires Workspace or Cloud Identity administrators to accept a BAA before any PHI touches in-scope products, and confirms separately that "the Gemini app also supports HIPAA workloads" once that BAA is in place (^[8]). Anthropic, OpenAI's most direct frontier-model competitor, added HIPAA-ready coverage to Claude Enterprise only in a self-serve, click-to-accept flow that a Primary Owner must explicitly activate, alongside a first-party API BAA with its own carve-outs (^[9]). None of the four vendors treats "signing a BAA" as equivalent to "every feature is HIPAA-safe"; all four publish granular, changeable coverage tables that buyers must re-check before every new feature rollout.

The demand side of this market is large and accelerating. OpenAI's own December 2025 enterprise survey found healthcare among the fastest-growing adoption sectors, alongside technology and manufacturing (^[10]), and the American Medical Association's 2026 physician survey of 1,692 respondents found that more than 80 percent of physicians now use AI professionally, roughly double the share in 2023 (^[11]). Grand View Research sizes the global AI-in-healthcare market at $36.7 billion in 2025, growing to $50.7 billion in 2026 at a 38.9 percent compound annual growth rate through 2033 (^[12]). For life sciences and healthcare organizations navigating this decision, the practical task is not simply asking "does ChatGPT sign a BAA," but mapping which specific product, feature set, and price band actually covers the intended use case, a mapping this report provides in full below.

The U.S. Department of Health and Human Services (HHS) requires a covered entity to obtain satisfactory written assurances from a business associate that will create, receive, maintain, or transmit PHI on its behalf, subject to the HIPAA Rules and their exceptions (^[13]). Whether a particular use of an AI service is permitted depends on the parties, the data, the purpose, the product configuration, and the governing agreement; de-identified information, patient-authorized disclosures, and uses by organizations that are not HIPAA regulated require separate analysis. A BAA supports compliance but does not by itself make every feature or workflow compliant.

ChatGPT's own trajectory illustrates why the question generates so much confusion. OpenAI launched ChatGPT Enterprise on August 28, 2023, describing it in its own announcement as bringing "enterprise-grade security and privacy, unlimited higher-speed GPT-4 access, longer context windows for processing longer inputs, advanced data analysis capabilities, customization options, and much more," with early customers including Block, Canva, Carlyle, Estee Lauder, PwC, and Zapier (^[14]). The plan also "comes with unlimited access to Advanced Data Analysis," a feature previously reserved for individual ChatGPT Plus subscribers (^[15]), and OpenAI signaled at the time that "future plans for ChatGPT Enterprise include a ChatGPT Business offering for smaller teams," a roadmap item that materialized years later as the Business tier examined in the next section (^[16]). TechCrunch's coverage of the same launch noted that ChatGPT Enterprise customers would receive priority access to GPT-4 "delivering performance that's twice as fast as the standard GPT-4," and that ChatGPT had already been "adopted by teams in more than 80% of Fortune 500 companies" within nine months of the consumer product's release, at a time when, by some estimates, "ChatGPT is costing OpenAI $700,000 a day to run" against fiscal year 2022 revenue of just "$30 million," a financial backdrop that helps explain OpenAI's urgency in monetizing enterprise-grade plans (^[17]). Reuters covered the same launch, noting that "ChatGPT Enterprise offers more security, privacy and higher-speed access to OpenAI's technology," with early customers including Block, Carlyle, and Estee Lauder Companies (^[18]); the same Reuters report added useful competitive context, noting that "Microsoft already offers businesses access to ChatGPT via its Azure OpenAI Service, though in order to use it businesses must be a customer of Azure, Microsoft's cloud computing platform" (^[19]), and separately reported that "many people in the U.S. have used ChatGPT to help with work-related tasks, even though their employers discourage it, a Reuters/Ipsos poll found" (^[20]). Notably, that original 2023 launch made no mention of HIPAA or a BAA at all; OpenAI told TechCrunch at the time that "while we aren't disclosing pricing, it'll be dependent on each company's usage and use cases" (^[21]). BAA eligibility for ChatGPT was added later, and early community forum threads on OpenAI's own developer community, dating to mid-2023, show buyers being pointed toward workarounds instead: one widely referenced thread advised that "the best current workaround is getting an AI Studio account from Microsoft Azure and piggybacking off them," before OpenAI's own BAA process had matured (^[22]), while another commenter on a related thread noted the topic had "been asked by many users many times with no conclusive result" (^[23]). By December 2023, OpenAI staff were clarifying more directly that the company was able to sign Business Associate Agreements to support customers' HIPAA compliance (^[24]).

Three years later, the landscape looks materially different. OpenAI has built a dedicated healthcare product line, achieved FedRAMP authorization for government use, and published a granular public list of which ChatGPT and API features fall inside the BAA and which do not. This report walks through every plan family in the current lineup (individual and Business plans, ChatGPT Enterprise, and the healthcare and API-specific pathways), quantifies what each costs and requires, compares OpenAI's approach against Microsoft, Google, and Anthropic, and closes with data on adoption, named case studies, and a forward-looking assessment. Throughout, this report treats IntuitionLabs' role as what it is: a life sciences and AI advisory firm and Veeva Vault CRM X-Pages partner that helps pharmaceutical and healthcare organizations navigate exactly this kind of vendor and compliance evaluation, not a vendor of the large language model platforms being compared, with its own services built around "built-in compliance with FDA, EMA, and global regulations" for regulated life-science clients (^[25]).

The consumer and small-team side of the ChatGPT lineup is, by OpenAI's own admission, entirely out of scope for HIPAA-covered work. As of mid-2026, ChatGPT is sold in six main tiers: Free, Go, Plus, Pro, Business, and Enterprise, with Business and Enterprise "priced per user per month," and monthly billing offered for Go, Plus, and Business while annual billing is offered for Business and Enterprise (^[26]). OpenAI's pricing FAQ further clarifies that "Go, Free, and Plus plans are designed to be used by individuals," while "Business and Enterprise are for businesses," a structural split that maps directly onto BAA eligibility (^[27]). None of Free, Go, Plus, or Pro includes SAML single sign-on (SSO), SCIM provisioning, a compliance API, or any BAA-eligible designation; OpenAI's own pricing and feature comparison page confirms this directly, listing "SAML SSO" as "No" for all four of the Free, Go, Plus, and Pro plans (^[28]), and separately listing "Admin console" as "No" across the same four tiers (^[29]), confirming these are individual-use, credit-card-billed plans by design rather than governed workspaces; OpenAI's own FAQ notes plainly that "you can purchase ChatGPT Go, Plus, Pro, or Business with any major credit card," with only Enterprise requiring a sales-managed invoicing relationship (^[30]). OpenAI's baseline security posture still applies to every tier regardless of BAA status: "all data is encrypted in transit (TLS 1.2)" and "data at rest is encrypted at rest (AES-256)," with "strict access controls" limiting who can view stored content (^[31]).

ChatGPT Business, formerly ChatGPT Team, is a self-service business plan with published pricing and a two-seat minimum, but OpenAI currently states that it does not offer a BAA for this product (^[1]). A workforce member entering PHI into a non-approved workspace may create an impermissible disclosure and compliance incident. The regulated entity should investigate, mitigate, document, and perform the Breach Notification Rule risk assessment rather than declare every accidental entry automatically to be a reportable breach (^[32]).

OpenAI’s current guidance answers the Team-versus-Enterprise question: it does not offer a BAA for ChatGPT Business, while eligible sales-managed Enterprise or Edu accounts may request one. This article does not infer the complete historical eligibility of the former Team plan from current documentation. Buyers should verify current eligibility and obtain the applicable written agreement before entering PHI.

ChatGPT Enterprise is, per OpenAI's own Help Center, "a managed ChatGPT plan for organizations" that "combines enterprise-grade privacy and security with centralized admin controls and access to advanced ChatGPT capabilities," including domain verification, SSO, SCIM, longer context windows, and advanced data analysis and customization options (^[33]). Crucially, "ChatGPT Enterprise is purchased at the organization level. Individual users do not sign up for Enterprise directly," meaning there is no self-service checkout path at all (^[34]). OpenAI's public pricing page confirms the same gate for cost: "Business plans are available starting at 2 users. Please contact sales to learn more about our Enterprise plan," and for payment terms, "For ChatGPT Enterprise, please contact sales for alternative payment options such as invoicing" (^[35]). The pricing FAQ also flags an important variable-cost dimension: "Enterprise and Business can purchase credits for more access" beyond included rate limits, an added cost buyers should model on top of the base per-seat figure (^[36]). The plan is also under active revision: OpenAI's Help Center notes that "on April 2, 2026, we updated some features of the ChatGPT Enterprise plan," introducing a new Codex-only seat type with its own flexible, credit-based pricing separate from standard seats (^[37]).

ChatGPT Enterprise pricing and seat commitments are quote-specific and are not published by OpenAI. OpenAI directs prospective Enterprise customers to its sales form and asks them to supply an estimated seat count, use case, timeline, and billing requirements (^[3]). OpenAI separately states that ChatGPT Business begins at two users, while Enterprise customers should contact sales; that Business threshold is not an Enterprise minimum and Business is not currently listed as BAA-eligible for ChatGPT (^[38]). Consumer ChatGPT Go is an individual plan, not an intermediate organizational Enterprise tier. A defensible budget therefore uses the actual OpenAI quote and contract scope, not unofficial price bands, alleged seat floors, or a supposed organizational Go offering.

How to get a BAA with OpenAI, mechanically, follows a defined process regardless of which product is involved. For ChatGPT Enterprise or Edu, the path is to contact OpenAI sales and request a BAA discussion as part of the sales-managed account setup; OpenAI states directly: "If you're interested in exploring a BAA for ChatGPT Enterprise or Edu, please contact sales" (^[39]). For the API, the process runs through a dedicated inbox: "If you require a BAA before you can use our API, email us at [email protected] with details about your company and use case. Our team will respond within 1-2 business days" (^[40]). Approval is not automatic, and reconsideration for a rejected use case requires working with an assigned account director. Buyers on OpenAI's own developer community independently corroborate that the process, once engaged through the correct channel, tends to move quickly: one commenter described going through the process personally and noted that OpenAI's counterparties "didn't have any oddities my lawyers hollered about at least," while suggesting that smaller organizations should "look at the public api pricing for a ballpark" before engaging sales, since "the specifics of each contract are too dependent to be able to tell you pricing to expect" in advance (^[41]).

Organizations that do not yet have an Enterprise quote should compare the product-specific eligibility paths that OpenAI actually publishes. OpenAI advertises nonprofit discounts for ChatGPT Business and Enterprise, offers education and healthcare products, and provides a verified-clinician pathway; eligibility, BAA availability, covered functionality, and commercial terms differ. Buyers should request a written quote and BAA scope for the intended workflow rather than assume a seat threshold.

Table 1 below summarizes OpenAI's current plan lineup, focused on the BAA-relevant facts a buyer needs before starting a procurement conversation.

Plan	Published Price	Minimum Seats	BAA Available	Billing Terms
ChatGPT Free / Go / Plus / Pro	$0 to individual Pro pricing, monthly	1 (individual)	No	Monthly, self-serve
ChatGPT Business (formerly Team)	$25/user/month monthly, $20/user/month annual	2 standard seats	No, explicitly excluded	Monthly or annual, self-serve
ChatGPT Enterprise / Edu	Not publicly listed; contact OpenAI sales for a quote ([3])	No universal minimum published by OpenAI	BAA eligibility is product- and account-specific; confirm current OpenAI guidance and contract	Contract terms are quote-specific
ChatGPT for Healthcare	Contact sales; not published ([42])	Organization-level	Yes, BAA plus Healthcare Addendum	Contracted
ChatGPT for Clinicians	Free at launch for verified U.S. clinicians	1 (individual clinician)	Yes, in-product self-serve BAA	Individual, in-app
OpenAI API (Modified Retention)	Usage-based, per-token	None required for API alone	Yes, on request via [email protected]	Usage-based, pay-as-you-go

BAA eligibility must be checked product by product against OpenAI’s current guidance; payment method is not a reliable legal test. OpenAI currently says ChatGPT Business is not eligible for a BAA and directs eligible sales-managed Enterprise or Edu accounts through its ChatGPT BAA process, while separate published pathways apply to eligible clinicians and API organizations. Buyers should rely on the eligibility page and executed agreement rather than infer coverage from whether a plan accepts a credit card or requires a sales conversation (^[1]).

Signing a BAA does not make an entire product HIPAA-safe by default; it activates a defined, and changeable, scope of covered functionality. OpenAI's Help Center is unusually explicit about this scope. As of this writing, OpenAI states: "OpenAI makes the following HIPAA eligible products available with a Business Associates Agreement (BAA): ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT FedRAMP, ChatGPT for Clinicians, API with Modified Retention, API FedRAMP with Modified Retention" (^[43]). Note the specificity: plain ChatGPT Enterprise is not on the list by itself; it must be provisioned as a "Regulated Workspace" to be HIPAA eligible.

Within a HIPAA-eligible ChatGPT workspace, OpenAI publishes a granular allow list of covered functionality: "Admin features, SSO, Compliance API, RBAC, Chat with files, Chat Sharing, Voice (Speech to text/Advanced voice mode), Python Tool & File Download, Web Search & Deep Research... Canvas & Canvas Code Execution, ImageGen, Memory, Projects, Notifications, Apps / Connectors, GPTs, Desktop Clients: MacOS and Windows, Mobile App, Record, Work with Apps, ChatGPT for Excel and Sheets, Workspace Agents, Library, Codex Local... Study Mode (Available in ChatGPT for Edu only), Trusted Clinical Search (Available in ChatGPT for Healthcare only)" (^[44]). Notably, for web search and Deep Research specifically inside a HIPAA-eligible workspace, "OpenAI does not send queries to third-party search providers (e.g., Bing) when using a HIPAA eligible workspace," relying instead on OpenAI's own search index (^[45]), a meaningful architectural safeguard against inadvertently routing PHI-adjacent queries to an external, non-covered subprocessor.

Anything outside that allow list is deliberately excluded, and administrators can turn on non-covered features at their own risk: "A customer may, in its sole discretion, enable access to additional ChatGPT functionality that is not covered under BAA. These additional features are disabled by default" (^[46]). This is an important operational nuance for compliance officers: the BAA does not automatically extend to every toggle an admin console makes available, and RBAC group configuration becomes a genuine compliance control, not just a convenience feature. The individual-clinician product reinforces the same discipline: do not share PHI in ChatGPT for Clinicians unless a BAA is in place and the account is authorized to sign one.

The API side has its own, narrower gate. HIPAA eligibility for the API "is contingent on Customer's account being provisioned with Modified Retention," after which a defined set of endpoints can be used for processing PHI upon execution of the OpenAI BAA. The covered endpoints include chat completions, responses, assistants, threads, vector stores, images, embeddings, audio transcription and translation, files, fine-tuning jobs, batches, moderations, completions, and realtime, per OpenAI's published endpoint list, and an enterprise agreement is not required to sign an API BAA, meaning a startup or research group can obtain a HIPAA-eligible API relationship without ever purchasing ChatGPT Enterprise at all (^[47]). Older commentary from bastiongpt.com describes an earlier, more restrictive scoping in which the API BAA covered only Zero Data Retention (ZDR) endpoints, warning that "the exclusion of many advanced API features from ZDR eligibility restricts sophisticated healthcare workflows involving PHI" such as analyzing uploaded patient documents (^[48]); OpenAI's current live documentation shows this scope has since broadened materially under the Modified Retention model, underscoring that BAA coverage is a moving target buyers must re-verify at contract renewal, not a fact to memorize once.

OpenAI reinforces the legal backbone of all of this with baseline security certifications applicable regardless of BAA status: "Successfully completed a SOC 2 audit, confirming that our controls align with industry standards for security and confidentiality," with data encrypted at rest using AES-256 and in transit using TLS 1.2 or higher (^[49]), and separately confirms that ChatGPT Enterprise, Edu, and Healthcare "have each successfully completed a SOC 2 Type 2 audit" (^[50]). For government buyers specifically, OpenAI achieved "FedRAMP 20x Moderate authorization for ChatGPT Enterprise and API Platform" in April 2026 after its "Security and Engineering teams worked through KSI implementation, evidence collection, validation, review cycles, and assessment materials" (^[51]), a distinct authorization from a HIPAA BAA but relevant to public-sector health agencies that must satisfy both regimes simultaneously.

OpenAI's approach does not exist in isolation. The three other major enterprise AI assistants each take a structurally different route to the same HIPAA-BAA question, and the differences matter for procurement teams weighing vendors side by side.

Microsoft has the longest institutional track record here. Microsoft's own compliance documentation states: "To support our customers' compliance with HIPAA when utilizing Microsoft enterprise products and services, Microsoft enters into Business Associate Agreements with its covered entity and business associate customers" (^[52]), and directly confirms this in FAQ form: "Yes. Microsoft offers its covered entity and business associate customers a Business Associate Agreement that covers in-scope Microsoft services" (^[53]), and separately notes that "the HIPAA Business Associate Agreement is also available for in-scope Microsoft Professional Services," extending beyond pure cloud services into implementation engagements (^[54]). This BAA is available by default through Microsoft's Online Services Data Protection Addendum, and Microsoft's in-scope services list explicitly names "Microsoft 365 Copilot, Microsoft 365 Copilot Chat" among commercial in-scope services (^[7]). Microsoft is careful to note this does not confer automatic compliance: "there's currently no certification standard that the Department of Health and Human Services approves to demonstrate compliance with HIPAA or the HITECH Act by a business associate," and, unlike OpenAI or Anthropic, Microsoft will not adapt the agreement to an individual customer, stating that "Microsoft can't use a customer's Business Associate Agreement" because its hyperscale, multitenant services "must operate in a consistent manner" under a single standardized agreement (^[55]). Microsoft further backs this BAA with third-party attestation, noting that in-scope services "undergo audits conducted by accredited independent auditors for the Microsoft ISO/IEC 27001 certification and the HITRUST Common Security Framework (CSF) certification," and that "Microsoft Azure and Microsoft Azure Government received a Provisional Authority to Operate from the FedRAMP Joint Authorization Board" as a separate federal authorization (^[56]). Microsoft 365 Copilot itself is sold as a per-user add-on at roughly $30 per user per month on top of a qualifying Microsoft 365 license, a price IntuitionLabs' own prior research on Copilot licensing documents directly from Microsoft's published pricing pages (^[57]).

Google operates on a similar default-BAA model within Google Workspace: "Administrators must review and accept a BAA before using PHI in Google services," and once accepted, that BAA covers whichever Workspace products appear on Google's published HIPAA Included Functionality list (^[58]). Critically, Google is explicit that customers who have not signed remain out of compliance if they use PHI at all: "Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services" (^[59]). Gemini's own FAQ confirms coverage directly at the product level: "Google Workspace with Gemini can support HIPAA workloads," and "the Gemini app also supports HIPAA workloads," though "some features might be blocked for customers who have signed the HIPAA Business Associate Amendment" (^[60]). Google is similarly granular at the individual-feature level; its compliance documentation states that "the help me write, contextual smart replies, and side-panel features are covered as part of Google Workspace with Gemini in HIPAA Included Functionality" (^[61]), and separately warns that connected third-party tools sit outside the agreement entirely: "third-party applications including add-ons are not included in the Included Functionality covered by the BAA" (^[62]).

Anthropic sits closest to OpenAI's model in one respect (a Claude API BAA available on request) but is stricter than both Microsoft and Google in another: Claude Enterprise's HIPAA coverage is opt-in and irreversible at the organization level. "Standard Claude Enterprise plans do not include BAA coverage without action from a Primary Owner," who must explicitly "activate HIPAA compliance in the HIPAA-ready Claude Enterprise organization settings" and accept the BAA (^[63]); eligible organizations "can enable HIPAA-ready configuration directly from organization settings," with the BAA itself accepted through a click-to-agree flow, and Anthropic notes separately that "requests from domains matching existing customer accounts are approved automatically" when a customer requests the detailed Implementation Guide (^[64]). Once accepted, "this is a one-way decision. Once HIPAA is enabled and the BAA is accepted, the change can't be reversed from organization settings" (^[65]), and "Team plans and individual plans (Free, Pro, and Max) can't enable HIPAA" at all, mirroring OpenAI's exclusion of Business (^[66]). Anthropic notes that organizations with a pre-existing API-only agreement are not automatically covered on Enterprise: "if your organization signed a BAA for Claude API usage before December 2, 2025, that agreement only covers API usage" and a new agreement is required to add Enterprise coverage (^[67]). Even within the covered feature set, connectors carry a caveat: Anthropic states that "sending data to 3rd parties via this feature isn't covered under Anthropic's BAA," mirroring OpenAI's treatment of third-party connectors and apps, and on the API side, Anthropic's published BAA coverage table marks the Batch API, Files API, Skills API, Code Execution, Computer Use, and Web Fetch as "not covered under Anthropic BAA and not accessible for HIPAA-Ready API users" (^[68]).

Table 2 compares the four platforms on the dimensions that matter most to a HIPAA buyer.

Vendor / Product	BAA Mechanism	Lowest Eligible Tier	Notable Coverage Gaps
OpenAI / ChatGPT Enterprise, Healthcare, Clinicians, API	Sales-managed contract (Enterprise/API); in-app self-serve (Clinicians)	Free clinician tier (individual); Enterprise/Edu for organizations	Non-allow-listed features disabled by default; API limited to Modified Retention endpoints
Microsoft / 365 Copilot	Default BAA via Online Services DPA for in-scope services ([69])	Any qualifying M365 license plus Copilot add-on	BAA does not equal automatic compliance; requires underlying qualifying M365 license
Google / Gemini for Workspace	Admin-accepted BAA covering Included Functionality list	Qualifying Workspace plan	Some Gemini features "might be blocked" post-BAA acceptance; third-party add-ons excluded
Anthropic / Claude Enterprise, API	Self-serve, irreversible activation by Primary Owner (Enterprise); sales-assisted (API) ([70])	Enterprise plan only; not Free, Pro, Max, or Team	Claude Code only covered with Zero Data Retention enabled; Cowork and several betas excluded

The pattern across all four vendors is consistent: a BAA is never a blanket guarantee, it is a scoped legal instrument layered onto a specific, named subset of product functionality, and that subset changes with product updates. For life sciences and healthcare organizations evaluating any of these platforms, a consultancy's role is not to recommend one large language model vendor over another as if selecting a product from a shelf, but to help the organization translate its actual clinical, regulatory, and data-governance requirements into the specific configuration, RBAC policy, and contractual language that a given BAA will and will not cover. IntuitionLabs, which describes its own work as "strategic guidance on digital transformation, AI adoption, and technology roadmapping" for pharmaceutical and life sciences organizations, and which separately offers to "leverage AI, GenAI, and advanced analytics for KOL segmentation, chatbots, sales operations, and more" for the same client base (^[71]), approaches this evaluation from that advisory position rather than as a reseller of any of the platforms discussed above.

Three independent data points frame how large and how fast this market is moving, and why the BAA question has shifted from a niche compliance footnote to a board-level procurement decision.

First, adoption within the healthcare workforce itself has accelerated sharply. The American Medical Association's 2026 Physician Survey on Augmented Intelligence, fielded January 15 to February 2, 2026 among 1,692 physicians across specialties, practice settings, and career stages, found that "Over 80% of physician respondents currently use AI in a professional context, double the share reported in 2023," and that "the number of use cases has also grown, with respondents now utilizing 2.3 use" cases on average; the survey "builds on prior waves conducted in 2023 and 2024," and results "are based on self-reported data, and percentages reflect respondents answering each question" (^[72]). A separate, Microsoft-sponsored IDC study cited within Grand View Research's healthcare AI market analysis found that "79% of healthcare organizations are presently utilizing AI technology" as of March 2024, with the return on investment "realized within 14 months, generating USD 3.20 for every USD 1 invested in AI" (^[73]). This growth in usage, largely occurring outside formally sanctioned, BAA-covered channels, is precisely the compliance exposure that drives organizations toward Enterprise, Healthcare, or API deployments with a signed BAA in the first place: informal adoption tends to run ahead of governance, and a rising base rate of unsanctioned use raises the urgency of a sanctioned, covered alternative.

Second, OpenAI's own usage telemetry confirms healthcare is scaling inside its enterprise customer base specifically. The company's state of enterprise AI report, drawing on real usage data from enterprise customers and a survey of 9,000 workers across almost 100 enterprises, found that "Technology, healthcare, and manufacturing" are "the fastest growing sectors" for AI adoption, and that "over the past year weekly messages in ChatGPT Enterprise increased roughly 8x, and the average worker is sending 30% more messages" (^[74]). The same report notes ChatGPT overall "now serves more than 800 million users every week," that "usage of structured workflows such as Projects and Custom GPTs has increased 19x year-to-date," and that the most engaged "frontier workers (95th percentile) send 6x more messages than the median employee and engage more intensively across advanced capabilities" (^[75]). International momentum is outpacing the U.S. specifically: "the fastest-growing business customer bases include Australia, Brazil, the Netherlands, and France, each exceeding 140% year-over-year growth," while "international API customer growth has exceeded 70% over the last six months, with Japan having the largest number of corporate API customers outside of the U.S." (^[76]).

Third, the addressable market itself is large and growing quickly on independent research firm estimates. Grand View Research values "the global artificial intelligence in healthcare market" at "USD 36.7 billion in 2025" and projects growth "from USD 50.7 billion in 2026 to USD 505.6 billion by 2033, at a CAGR of 38.9% from 2026 to 2033," with the "U.S." holding "the largest market share in 2025" within a North America region that alone accounted "for the largest revenue share of over 54% in 2025" (^[77]). By end use, "pharmaceutical and biotechnology" is the largest segment, holding "the largest revenue share of over 30% in 2025," while by component, "the software solution segment dominated the market with the largest revenue share of over 46% in 2025," by technology "the machine learning segment held the largest market share of over 35 % in 2025," and looking ahead, "the context-aware computing segment is expected to grow at the fastest CAGR over the forecast period" as systems increasingly integrate real-time patient data (^[78]). A separate study cited within the same analysis found that "approximately 80% of professionals in the pharmaceutical and life sciences sectors utilize AI in drug discovery" (^[79]), a figure OpenAI's own life sciences partnerships with Amgen, Thermo Fisher, and Moderna help illustrate in practice. This forecast independently corroborates OpenAI's own healthcare investment: the company reported it partnered "with a global network of more than 260 licensed physicians across 60 countries of practice to evaluate model performance," a group that "has reviewed more than 600,000 model outputs spanning 30 areas of focus" as part of building ChatGPT for Healthcare and its clinical benchmarks (^[80]).

Because OpenAI does not publish Enterprise per-seat pricing or a universal seat minimum, this report intentionally excludes secondary price bands and buyer-forum anecdotes from its conclusions. Procurement teams should obtain a current written quote and verify the BAA, eligible functionality, retention setting, and any workspace restrictions in the executed documents.

Boston Children's Hospital: Moving From Custom Pilot to a Governed Platform

Boston Children's Hospital was among the named early adopters of ChatGPT for Healthcare when OpenAI launched the product on January 8, 2026, alongside AdventHealth, Baylor Scott & White Health, Cedars-Sinai Medical Center, HCA Healthcare, Memorial Sloan Kettering Cancer Center, Stanford Medicine Children's Health, and UCSF (^[81]). John Brownstein, SVP and Chief Innovation Officer at Boston Children's Hospital, framed the move as a graduation from an earlier custom deployment: "Our early work with a custom OpenAI-powered solution allowed us to move quickly, prove value in a secure environment, and establish strong governance foundations. ChatGPT for Healthcare offers a path toward operational scale, providing an enterprise-grade platform that can support broad, responsible adoption across clinical, research, and administrative teams" (^[82]). This case illustrates a common pattern this report sees repeated across healthcare systems: an initial custom, API-based BAA arrangement used for a narrow pilot, followed by migration to a broader, product-level BAA once the organization is ready to scale usage across clinical and administrative teams simultaneously.

Penda Health: Quantified Clinical Impact Under an API-Based Deployment

Penda Health, a primary-care provider operating 16 clinics in Nairobi, Kenya since 2012, built a clinician copilot called AI Consult on top of the OpenAI API, and OpenAI published the results of a large-scale study in July 2025. Across a study of 39,849 patient visits, "clinicians with AI Consult had a 16% relative reduction in diagnostic errors and a 13% reduction in treatment errors compared to those without" (^[83]). The effect was concentrated where it mattered most clinically: in visits where the tool would have issued a safety-critical "red" alert, "AI reduced diagnostic errors by 31% and treatment errors by 18%" (^[84]). In absolute terms, OpenAI estimates "the introduction of AI Consult would avert diagnostic errors in 22,000 visits and treatment errors in 29,000 visits annually at Penda alone" (^[85]). To assess quality, "108 independent physicians (29 from Kenya) rated the final documentation and decisions from 5666 randomly selected visits" to identify these errors (^[86]), and on patient safety specifically, OpenAI reports that across all safety events reviewed during the study, "in no case did AI Consult recommendations lead to harm," with several cases where the tool's advice "could potentially have prevented harm if available or heeded" (^[87]). The study, approved by AMREF Health Africa's Ethical and Scientific Review Committee and the Kenyan Ministry of Health, underscores that a properly scoped API deployment, built on de-identified documentation sent to the OpenAI API at defined workflow points, can deliver measurable clinical benefit even outside a full ChatGPT Enterprise seat-based contract, provided the underlying API relationship carries appropriate data-handling and, where PHI is involved, BAA coverage.

Klarna and Early ChatGPT Enterprise Adopters: The Non-Healthcare Baseline

Not every ChatGPT Enterprise customer is healthcare-specific, and understanding the general commercial baseline helps healthcare buyers calibrate expectations. At the original August 2023 launch, Sebastian Siemiatkowski, CEO of Klarna, stated: "At Klarna, we are constantly seeking innovative solutions to strengthen our employees' abilities and enable them to best serve our 150 million active users across the globe. With the integration of ChatGPT Enterprise, we're aimed at achieving a new level of employee empowerment, enhancing both our team's performance and the customer experience" (^[88]). Early customers named in the original Reuters coverage of the launch included Block, Carlyle, and Estee Lauder Companies (^[89]), none of which are healthcare organizations. This confirms an important structural point: ChatGPT Enterprise itself was never designed as a healthcare-first product, and its BAA eligibility, when granted, is layered onto a general-purpose enterprise platform rather than a clinically native one, which is precisely the gap ChatGPT for Healthcare and ChatGPT for Clinicians were built to close nearly two and a half years later.

A Multi-Site Health System Evaluating Enterprise Versus Healthcare (Hypothetical Example)

Consider a regional health system deciding which staff need a HIPAA-eligible workspace. The defensible model starts with workflow and data mapping: identify which roles will handle PHI, confirm which OpenAI product and features are contractually eligible, restrict access by role, and price the resulting scope using OpenAI’s written quote. A narrower deployment for staff who genuinely need PHI-capable workflows may create a different cost and risk profile than organization-wide access, but the difference cannot be calculated responsibly from an unpublished seat rate.

Several trends are worth watching as this market matures. First, OpenAI's product segmentation is trending toward greater specialization rather than a single undifferentiated Enterprise SKU. The company launched ChatGPT for Healthcare on January 8, 2026, and ChatGPT for Clinicians on April 22, 2026, as distinct, named products rather than folding every healthcare use case into generic Enterprise (^[90]; OpenAI: Clinicians). Product eligibility, contracting, and BAA requirements should be evaluated separately for the specific service and use case. Expect this pattern, narrow, purpose-built, BAA-eligible workspaces layered on top of the general Enterprise chassis, to continue into other regulated verticals such as financial services and government, mirroring the FedRAMP-specific product line already in market.

Second, feature coverage under existing BAAs is a moving target across every vendor examined in this report, not just OpenAI. Anthropic's own BAA documentation flags that features covered are versioned by acceptance date ("Covered under versions of the BAA accepted after 12/2/25"), meaning an organization that signed a BAA a year ago may not automatically receive expanded coverage for newly released features without re-acceptance or an updated agreement (^[91]). Compliance and procurement teams should build periodic BAA and feature-coverage re-review into their governance calendar, not treat the signed agreement as a one-time event.

Third, price transparency varies by product. OpenAI does not publish standard per-seat pricing for ChatGPT Enterprise, while Microsoft and Google publish per-user pricing for offerings that include Microsoft 365 Copilot and Gemini, respectively. Google also lists the Gemini app and Gemini in Workspace as HIPAA Included Functionality under the applicable BAA. Organizations with meaningful negotiating leverage, either through seat volume, multi-year commitment, or existing cloud-platform relationships (an existing Azure OpenAI Service relationship, for example, materially changes the BAA and procurement equation from a direct OpenAI contract), should expect to negotiate below headline estimates.

Fourth, ungoverned workforce use creates a material compliance risk. If staff enter PHI into a service that is not approved and appropriately contracted for the workflow, the organization should treat the event as a potential impermissible disclosure: stop further use, notify the privacy or security officer, preserve the facts, mitigate where possible, and conduct the required breach assessment. Whether the event is a HIPAA violation or reportable breach depends on the regulated party, permitted-use rules, exceptions, and documented risk assessment—not on a forum commenter’s categorical label (^[32]).

How do I get a BAA with OpenAI? For ChatGPT, sales-managed Enterprise or Edu customers may contact OpenAI sales to request a BAA. Before processing PHI, Enterprise customers must also obtain the applicable BAA and a Regulated Workspace; OpenAI’s HIPAA-eligible product list does not identify Edu as a standalone eligible product, so Edu customers should confirm the required configuration and scope in writing. Self-serve plans, including Business, are ineligible. For the API, email [email protected] with company and use-case details and expect a response within one to two business days (^[92]). Individual verified clinicians can sign an in-app BAA directly inside ChatGPT for Clinicians under Settings, Agreements (^[93]).

Is ChatGPT Enterprise HIPAA compliant? ChatGPT Enterprise can be made HIPAA eligible, but only when provisioned specifically as a "Regulated Workspace" with an executed BAA, not by default (^[94]). Coverage extends only to a published allow list of features; anything an administrator enables outside that list is not covered, and independent research corroborates that Enterprise "could potentially be used compliantly" only once that conditional BAA is executed (^[95]).

What is ChatGPT Enterprise pricing per seat? OpenAI does not publish a per-seat price for ChatGPT Enterprise. Obtain a current written quote from OpenAI sales and treat its price, billing term, seat commitment, and BAA scope as customer-specific (^[3]).

What is the minimum seat count for ChatGPT Enterprise? OpenAI does not publish a universal ChatGPT Enterprise minimum seat count. Its sales guidance asks prospective customers for an estimated seat count and requirements, and its public pricing page directs Enterprise buyers to contact sales. Treat the minimum, price, billing term, and BAA scope as quote-specific until they appear in a written OpenAI proposal and contract (^[3]) (^[38]).

What is an OpenAI Business Associate Agreement? It is the contract required under HIPAA before OpenAI, acting as a business associate, can lawfully receive, process, or store protected health information on behalf of a covered entity or another business associate, consistent with the general HHS definition of a business associate contract (^[96]). OpenAI refers to its specific contract as the "Business Associate and Healthcare Addendum" (^[97]).

Is ChatGPT Team (Business) HIPAA compliant? OpenAI currently states that it does not offer a BAA for ChatGPT Business, formerly ChatGPT Team. Organizations that need OpenAI to handle PHI as a business associate should use a currently eligible product and execute the applicable agreement before sending PHI (^[1]).

What is ChatGPT Enterprise for healthcare and life sciences? For healthcare specifically, OpenAI now recommends ChatGPT for Healthcare, a dedicated workspace with trusted clinical search, evidence citations, and BAA coverage, over generic ChatGPT Enterprise (^[98]). For broader life sciences use cases such as drug discovery, commercial operations, or R&D that do not center on PHI, plain ChatGPT Enterprise or the API remains the applicable product, and OpenAI has separately publicized work with life sciences organizations including Amgen, Thermo Fisher, and Moderna (^[99]).

Does the ChatGPT API sign a BAA? Yes. The OpenAI API can be covered by a BAA independent of any ChatGPT plan, provided the organization's account is provisioned with Modified Retention and the request is approved by emailing [email protected]; no enterprise agreement is required to obtain an API-only BAA.

Does OpenAI offer BAA coverage for its FedRAMP-authorized products? Yes. OpenAI's HIPAA-eligible product list separately names "ChatGPT FedRAMP" and "API FedRAMP with Modified Retention" alongside the commercial ChatGPT Enterprise and API pathways (^[100]), reflecting OpenAI's FedRAMP 20x Moderate authorization for ChatGPT Enterprise and the API Platform achieved in April 2026 (^[101]).

The answer to “does OpenAI offer BAAs for ChatGPT and API use?” is product- and account-specific. OpenAI publishes eligibility and covered-functionality guidance, and buyers should verify the current product name, account type, retention setting, feature list, and executed contract before processing PHI. ChatGPT Enterprise pricing and minimum seats remain unpublished, so the reliable procurement answer is to contact OpenAI sales and evaluate the written quote—not to rely on third-party price bands or an alleged universal seat floor.

None of the four major enterprise AI vendors examined in this report, OpenAI, Microsoft, Google, or Anthropic, treats a signed BAA as a blanket compliance guarantee. Each publishes its own granular, evolving list of covered versus non-covered features, and each places the ultimate compliance burden on the customer's own governance, training, and RBAC configuration. For life sciences and healthcare organizations, the operationally important task is therefore not choosing a vendor in the abstract, but mapping a specific intended use case, whether clinical documentation, drug discovery research, commercial analytics, or patient-facing communication, against the precise feature list each vendor's current BAA actually covers, then building the RBAC, retention, and audit configuration to match. That mapping exercise, revisited at every contract renewal and every major product update, is the real work behind the question "chatgpt enterprise baa," and it is where specialized life sciences AI advisory support, distinct from any single vendor's own sales process, tends to add the most durable value.