Which AI providers offer a HIPAA BAA?

OpenAI provides a BAA for the API only after a gated email request and review, matching the yes_sales_gated definition.

source · full cell

Microsoft’s official Q&A page confirms that Azure OpenAI Service is HIPAA‑eligible, and Microsoft’s HIPAA offering states they will sign a BAA for in‑scope services.

source · full cell

Anthropic’s own privacy page confirms a BAA exists for the API but can only be activated after the primary owner signs it and coordinates with sales, satisfying the sales‑gated criteria.

source · full cell

AWS offers a BAA through its Artifact portal and lists Amazon Bedrock as a HIPAA‑eligible service, so a HIPAA BAA can be signed for Claude via Bedrock, but access is gated behind the sales/account process.

source · full cell

Google's own support page shows the HIPAA BAA is accepted self-serve in the Cloud console (Review and Accept / I Accept), so it is publicly available with no sales gate — not yes_sales_gated. The cited cloud.google.com/security/compliance/hipaa page itself states "Google will enter into Business Ass

source · full cell

Google's own compliance page states it "will enter into Business Associate Agreements with customers as necessary under HIPAA" and lists Vertex AI among BAA-covered products, so no_public_evidence is wrong; execution is routed through an account manager per Google's FAQ, making it yes_sales_gated ra

source · full cell

AWS lists Amazon Bedrock as a HIPAA‑eligible service and explicitly requires a Business Associate Agreement, which is only available through the gated AWS Artifact portal.

source · full cell

Mistral's own trust center publicly lists a "HIPAA Compliance with Mistral AI" document stating it offers a BAA for qualifying services, so there is public evidence the BAA exists but it is gated behind a qualification/access-request process (yes_sales_gated), not no_public_evidence.

source · full cell

Public HIPAA page lists Azure services in scope but does not explicitly include Mistral, and a Microsoft staff answer states compliance is not guaranteed, leaving coverage unclear.

source · full cell

Verified verbatim on Cohere's own security page that a standard BAA can be executed, but qualification requires contacting a sales representative, matching yes_sales_gated.

source · full cell

AWS lists Amazon Bedrock (excluding Fable and Mythos) as HIPAA‑eligible and requires entering into an AWS BAA, which applies to Cohere models served via Bedrock.

source · full cell

AWS lists Amazon Bedrock as a HIPAA‑eligible service and explicitly requires a signed AWS Business Associate Agreement before use.

source · full cell

The provider’s own Q&A explicitly states it cannot confirm model‑by‑model HIPAA coverage, so coverage for Llama is not publicly verified.

source · full cell

The provider offers a BAA request form, indicating the agreement is available but gated behind a sales/approval process.

source · full cell

DeepSeek's privacy policy states the service is not intended for health data and provides no public BAA information, so no public evidence of a HIPAA BAA exists.

source · full cell

The provider’s own FAQ confirms a BAA can be provided but only after a sales request, matching the definition of yes_sales_gated.

source · full cell