Registry / HIPAA BAA

Which AI providers offer a HIPAA BAA?

As of 3 October 2026, of 16 AI model offerings tracked, 3 have clear public evidence, 11 are conditional or gated, 1 is a confirmed no, and 1 has no public evidence.

Clear public evidence: Claude via Google Vertex AI, Gemini via Vertex AI, Llama via Azure AI
Conditional, sales-gated, or partial: OpenAI API, Azure OpenAI Service, Anthropic API, Claude via AWS Bedrock, AWS Bedrock (platform), Mistral La Plateforme, Mistral via Azure AI, Cohere via AWS Bedrock, Llama via AWS Bedrock, xAI API, DeepSeek via Fireworks AI
Confirmed not offered: Cohere API
No public evidence: DeepSeek API (first-party)

Business Associate Agreement availability across major AI model offerings, with sources and verification dates. The cell answers: Will they sign a HIPAA Business Associate Agreement covering this offering? Statuses below are evidence grades, not endorsements, “no public evidence” means we could not verify it from public sources, not that the answer is no.

OpenAI API first-party API

◐Yes, sales-gated confidence: high · verified 2026-09-30

OpenAI states a BAA for the API is available but must be requested via email, making it sales‑gated.

source · full cell

Azure OpenAI Service OpenAI model, served by Microsoft Azure

◐Yes, sales-gated confidence: high · verified 2026-09-29

Microsoft states Azure OpenAI is covered by its BAA, but the BAA is only accessible through the gated Service Trust Portal, so the agreement is sales‑gated.

source · full cell

Anthropic API first-party API

◐Yes, sales-gated confidence: high · verified 2026-10-02

Anthropic’s own trust‑portal page confirms a BAA is offered for the API but must be signed by the organization’s Primary Owner and enabled via a sales contact, matching yes_sales_gated.

source · full cell

Claude via AWS Bedrock Anthropic model, served by AWS Bedrock

◐Yes, sales-gated confidence: high · verified 2026-10-02

AWS lists Amazon Bedrock as HIPAA‑eligible but requires customers to first sign an AWS Business Associate Agreement, which is only available through the gated AWS Artifact portal.

source · full cell

Claude via Google Vertex AI Anthropic model, served by Google Cloud Vertex AI

●Yes, public confidence: high · verified 2026-09-29

Google's own HIPAA page and BAA support page publicly offer a self-serve Business Associate Addendum (review-and-accept in the Cloud Console), covering Google Cloud infrastructure including Vertex AI, so the BAA for Claude via Vertex AI is publicly verifiable, not absent or sales-gated.

source · full cell

Gemini via Vertex AI Google model, served by Google Cloud Vertex AI

●Yes, public confidence: high · verified 2026-10-02

The Google Cloud HIPAA compliance page publicly lists Gemini Enterprise as a product covered by the Business Associate Addendum, confirming a public BAA applies to Gemini via Vertex AI.

source · full cell

AWS Bedrock (platform) platform row

◐Yes, sales-gated confidence: high · verified 2026-09-29

Bedrock is listed as a HIPAA‑eligible service and the page requires an AWS BAA, which is obtained through the gated AWS Artifact portal, making the agreement sales‑gated.

source · full cell

Mistral La Plateforme first-party API

◐Yes, sales-gated confidence: medium · verified 2026-10-01

Mistral's own Trust Center (trust.mistral.ai/resources) publicly confirms a HIPAA BAA exists, but it is only for "qualifying services" and access is requested via the Trust Center/sales rather than publicly available, which is yes_sales_gated rather than unclear.

source · full cell

Mistral via Azure AI Mistral AI model, served by Microsoft Azure

◔Partial confidence: high · verified 2026-09-29

Microsoft provides a HIPAA BAA for Azure services, but no explicit public confirmation that Azure AI Foundry, which serves Mistral, is in scope, so only part of the requirement is satisfied.

source · full cell

Cohere API Cohere model, served by Cohere (first-party)

✕No, verified confidence: high · verified 2026-10-02

Provider's own trust center states the BAA does not cover the hosted API, confirming they will not sign a HIPAA BAA for this offering.

source · full cell

Cohere via AWS Bedrock Cohere model, served by AWS Bedrock

◐Yes, sales-gated confidence: high · verified 2026-09-30

AWS lists Bedrock as HIPAA‑eligible and states a BAA with AWS is required, which covers the Cohere model accessed through Bedrock.

source · full cell

Llama via AWS Bedrock Meta model, served by AWS Bedrock

◐Yes, sales-gated confidence: high · verified 2026-10-03

Amazon Bedrock is listed as a HIPAA‑eligible service, and AWS requires a Business Associate Agreement to use any such service, which is only available through a gated, account‑based process.

source · full cell

Llama via Azure AI Meta model, served by Microsoft Azure (Azure AI Foundry / Models-as-a-Service)

●Yes, public confidence: high · verified 2026-09-28

Microsoft's own compliance page states the HIPAA BAA requires no separate contract or sales step — it is included by default in the Microsoft Product Terms for all covered-entity/business-associate customers using in-scope Azure services (including Azure AI Foundry, which hosts Llama) — so the offer

source · full cell

xAI API xAI model, served by xAI (first-party)

◐Yes, sales-gated confidence: high · verified 2026-09-30

The provider offers a BAA request form but does not publish the agreement publicly, indicating the BAA is available only behind a sales gate.

source · full cell

DeepSeek API (first-party) first-party API

○No public evidence confidence: high · verified 2026-09-28

No public DeepSeek page mentions offering a HIPAA BAA, and the privacy policy states the service is not intended for health data, indicating no publicly available BAA.

source · full cell

DeepSeek via Fireworks AI DeepSeek model, served by Fireworks AI

◐Yes, sales-gated confidence: high · verified 2026-09-30

The provider’s FAQ states a BAA can be supplied upon request, indicating a gated HIPAA agreement for the DeepSeek offering.

source · full cell