The question is almost never "which AI is best." For a healthcare practice, law firm, accounting firm or any business that holds sensitive data, the real question is: which plan, under which contract, configured which way. The same brand can be safe on one plan and a violation on another.
The rule that matters most: consumer vs business plans
All four vendors sell consumer plans (free or paid by an individual) and business plans (bought by an organization, with admin controls and contract terms). Business plans generally do not use your data to train models by default and offer retention controls. Consumer plans may, and none of them come with a HIPAA Business Associate Agreement (BAA).
| Vendor | Plans that can be covered by a BAA* | Plans not covered by a BAA |
|---|---|---|
| OpenAI (ChatGPT) | ChatGPT Enterprise and ChatGPT for Healthcare (sales-managed); API for eligible customers | Free, Plus, Pro, Team / self-serve Business |
| Microsoft (Copilot) | Microsoft 365 Copilot on commercial tenants, under Microsoft's BAA; Azure OpenAI | Copilot on personal or family Microsoft accounts |
| Google (Gemini) | Gemini in Google Workspace business and enterprise editions, under Google's BAA; Vertex AI | Gemini app on personal Google accounts |
| Anthropic (Claude) | Claude API for eligible customers; HIPAA-ready Enterprise plan (sales-assisted) | Free, Pro, Max, Team, self-serve Enterprise |
*Status as published by the vendors and summarized in 2026 industry guides. BAA eligibility changes often and usually needs a signed agreement and specific settings. Always confirm with the vendor before any protected data goes in.
How to choose for your business
- Already on Microsoft 365? Microsoft 365 Copilot keeps data inside your existing tenant and permissions. It is often the simplest governed option, but it will surface anything a user already has access to, so fix oversharing first.
- Already on Google Workspace? Gemini for Workspace is the parallel path, under your existing Workspace agreement.
- Need a standalone assistant? ChatGPT Enterprise or Claude Enterprise on sales-managed contracts give admin controls and, where eligible, a BAA.
- Not healthcare? You still need the same discipline. Law firms answer to confidentiality rules, financial firms to the FTC Safeguards Rule and Reg S-P. The safe plans are the same ones.
Your approved tool is rarely the problem. The problem is the employee using a personal ChatGPT, Gemini or Claude account on their phone because the approved one is slower. An AI policy, a short training and an approved tool that is actually easy to use close that gap.
Five checks before you approve any AI tool
- Is it a business plan bought by the organization, not an individual?
- Is training on your data off, and what is the retention period?
- If you handle PHI, is a BAA signed for this exact product and configuration?
- Can admins control users, sharing and connectors, and see logs?
- Is the tool listed in your AI acceptable use policy and your risk assessment?
Is ChatGPT HIPAA compliant?
Only specific business arrangements can be covered by a BAA: ChatGPT Enterprise and ChatGPT for Healthcare on sales-managed contracts, and the API for eligible customers. Free, Plus, Pro and self-serve Business plans are not covered, so patient information must not be entered into them.
Which AI tool is safest for a small regulated business?
The safest choice is usually the business version of the platform you already use: Microsoft 365 Copilot for Microsoft 365 customers or Gemini for Google Workspace customers, configured with your existing agreements. Whatever you choose, use an organization-owned business plan, confirm data training and retention settings, sign a BAA if you handle PHI, and cover the tool in a written AI policy.