LLMs Under BAA: Which AI Models a US Healthcare Founder Can Actually Use in 2026

A digital health founder walked into a hospital security review last spring with a working demo. Intake notes in, clean clinical summary out, eleven seconds flat.

The CISO watched it once and asked two questions. Which model is behind this? And do you have a BAA that covers it?

He had built on a consumer AI account. The pilot died in that room. Not because the product was weak, but because the contract underneath it did not exist.

That conversation is happening in health systems every week now. The AMA’s 2026 Physician Survey on Augmented Intelligence found that 81% of physicians now use AI in practice, up from 38% in 2023. Shipping an AI feature is no longer the differentiator.

Shipping it on a model you are legally permitted to send protected health information to is. This guide maps exactly which LLMs under BAA you can build on in 2026, and where the coverage quietly stops.

What “LLMs Under BAA” Actually Means

A Business Associate Agreement is a signed contract in which your model vendor accepts HIPAA obligations. They agree to safeguard PHI, limit how they use it, restrict subcontractors, and report breaches to you.

Without that signature, sending a patient’s chart into an API is an unauthorized disclosure. The model quality is irrelevant at that point. So is your encryption.

Founders who understand what a HIPAA BAA covers before picking a model save themselves a rebuild later.

• HIPAA-Eligible Is Permission, Not Protection

Every hyperscaler uses the phrase “HIPAA-eligible” on its compliance page. It means the service can hold PHI once your BAA is executed and configured correctly.

It does not mean the service is compliant as shipped. Vendors grant eligibility for LLMs under BAA. You build the compliance yourself, out of architecture, access control, and audit trails.

• The Agreement Names Services, Not Brands

This is where most founders get it wrong. A BAA never covers “OpenAI” or “Claude” or “Gemini” as a company.

It covers an enumerated list of products, endpoints, and features. Everything outside that list is excluded, even when it runs on the same login. Working with LLMs under BAA means reading that list, not the marketing page.

LLMs Under BAA in 2026: The Vendor-by-Vendor Reality

Here is the current landscape for LLMs under BAA, and the specific gap in each path.

• OpenAI

OpenAI moved decisively into healthcare in 2026. It launched ChatGPT for Healthcare in January and ChatGPT for Clinicians in April, alongside an API track for developers.

BAAs are available for eligible enterprise accounts, generally paired with zero data retention on the API. Free, Plus, Pro, and standard Business workspaces are never covered.

One detail engineers miss: only a subset of endpoints can carry PHI. Files, Batch, and fine-tuning retain application state, and enabling zero retention does not change that.

• Anthropic

Anthropic sits among the more tightly scoped LLMs under BAA. It offers coverage for the Claude API and for HIPAA-ready Enterprise plans, both requiring specific configuration. Since April 2026, eligible organizations can run a HIPAA-configured API org without full zero data retention.

The exclusions are explicit. The Console, the Workbench, Cowork, and most beta features fall outside the agreement. Web search is not covered either.

Newer Mythos-class models carry mandatory safety retention, so full zero retention is unavailable on them.

• Google Cloud

Gemini reaches PHI workloads through one route: Google Cloud, under the self-serve Cloud BAA accepted in the console. Consumer Gemini and Google AI Studio have no coverage at all.

Google has also reorganized its AI naming, folding Vertex AI into the Gemini Enterprise Agent Platform. A 2023-era memory of “Vertex AI is covered” no longer maps cleanly to the enumerated list.

Check the current covered-products page before you assume a service name still appears on it.

• AWS Bedrock

Bedrock is the fastest paperwork path to LLMs under BAA. One self-serve agreement through AWS Artifact covers Claude, Llama, Mistral, Titan, and Nova inside your own account.

Bedrock and Bedrock AgentCore both sit on the HIPAA Eligible Services Reference. Prompts are not stored or used for training.

The caveat matters though. That reference list carries model-level exclusions, and the newest frontier models often arrive before eligibility does. Verify the exact model ID, not just the platform.

• Microsoft

Azure OpenAI Service remains the standard route to GPT-family LLMs under BAA inside a Microsoft agreement. Inference stays in your Azure tenant, which security teams like.

Microsoft Foundry broadens model choice, but partner-hosted and community models are treated as non-Microsoft products. Those typically fall outside BAA scope, so confirm before routing PHI through them.

• Self-Hosted Open Weights

Running Llama, Mistral, or Qwen on infrastructure you control removes the model vendor from the equation entirely. There is no AI BAA to negotiate because no third party sees the data.

Your cloud BAA covers the compute layer. Against vendor-hosted LLMs under BAA, you trade contractual simplicity for operational load. Everything else, from GPU cost to eval pipelines to drift monitoring, becomes your team’s job. Serious ML Development capacity is the prerequisite here, not an optional extra.

Where Founders Actually Get Burned

The paperwork is rarely the failure point. Configuration is. Four patterns account for most findings in real audits of LLMs under BAA.

• Shadow AI in the workforce. A clinician pastes a discharge summary into a personal account. Your enterprise BAA is irrelevant to that session. This is the most common breach vector in HIPAA-compliant AI deployments, and policy alone will not stop it.
• Non-eligible features inside a covered account. Code execution, web search, file stores, and batch jobs are frequently excluded even when the base API is covered.
• The subprocessor chain. Your vector database, transcription service, and LLM observability tool all see prompt text. Each one needs its own agreement.
• Model launches outrunning eligibility lists. A new model appears in your SDK weeks before it appears on the covered list. Pinning model versions is a compliance control, not just an engineering preference.

How to Ship LLMs Under BAA Without Stalling Your Roadmap

• Step 1: Map every PHI touchpoint before choosing a model

Trace the actual path a patient record takes through your product. Note where it enters, what enriches it, where it rests, and what leaves in the response.

Most teams discover PHI in places they never designed for, including logs, error traces, and analytics events. Do this mapping first, because it determines which vendors are even viable.

Teams planning to integrate AI into an existing EHR system usually find the integration layer leaks more identifiers than the model call itself.

• Step 2: Get the paperwork before the prototype

AWS and Google Cloud offer self-serve BAAs you can accept in minutes. OpenAI and Anthropic route enterprise agreements through sales, which takes weeks.

Start that conversation the same week you start building. Founders routinely lose a month waiting on legal review they could have run alongside development.

Ask for the implementation guide alongside the BAA. That document, not the contract, tells your engineers which features are actually usable.

• Step 3: Configure to the eligible feature list

Once signed, treat the vendor’s eligible-features table as a build spec for LLMs under BAA. Turn on zero data retention or the HIPAA organization flag. Disable everything outside scope.

Restrict the deployment to approved regions. Pin specific model versions rather than floating aliases. Scope API keys per project so one team cannot accidentally send PHI through an uncovered surface.

Anthropic now returns a hard error when a HIPAA-enabled org requests a non-eligible feature. Treat that as the pattern to design for.

• Step 4: Put a gateway between your app and the model

Never let application code call a model provider directly. Route everything through an internal service that enforces redaction, logging, and model allowlists in one place.

This gateway is where you strip identifiers, apply minimum-necessary rules, and capture the audit trail. Solid API Development work here also means swapping providers later takes days instead of quarters.

Vendors change terms. Gateways absorb that change without touching your product logic.

• Step 5: Log, redact, and re-verify quarterly

Log every request and response, with identifiers redacted inside the logs themselves. Auditors will ask who accessed what and when, and a missing trail reads as a missing control.

Then schedule a recurring review. Eligibility lists change monthly across AWS, Google, and Microsoft. A model that was covered in March may carry a footnote by September.

Assign that review to a named owner. Compliance drift is silent until it isn’t.

When You Do Not Need a BAA at All

Deidentified data falls outside HIPAA. If you strip all eighteen Safe Harbor identifiers, or get an expert determination, the record stops being PHI.

That opens up every model on the market, not just the LLMs under BAA. It also opens up real risk, because partial redaction is not deidentification. Free-text clinical notes hide identifiers in narrative form.

The practical play for early-stage teams: validate the workflow on synthetic or deidentified data first. MVP Development on a non-PHI dataset lets you prove the feature works before you take on compliance overhead.

Which Path Fits Your Stage

Not every team needs the same route to LLMs under BAA. Match the path to your stage.

Pre-seed, validating a workflow: synthetic data, any model, no BAA required.

Seed stage with a design partner: AWS Bedrock or Google Cloud, because self-serve BAAs unblock you in a day.

Series A selling into health systems: a direct OpenAI or Anthropic agreement, since procurement teams increasingly ask which named model you use.

Handling sensitive data at scale: self-hosted open weights inside your own perimeter, where nothing leaves your infrastructure.

Final Thoughts

The list of LLMs under BAA in 2026 is longer than it was two years ago, but the trap has not moved. Coverage is per service, per feature, per configuration, and it expires quietly when a vendor reorganizes a product line.

Read the eligible-features list. Pin your models. Build the gateway on day one, not after your first enterprise security questionnaire.

Scoping a clinical AI product and want the architecture reviewed before procurement does it for you?

EngineerBabu’s AI Development team has shipped HIPAA-scoped builds across EHR, RCM, and patient engagement workloads.

FAQs

• Which LLMs under BAA can a US healthcare startup use in 2026?

OpenAI through its healthcare products, Anthropic through a HIPAA-ready Claude API or Enterprise plan, Gemini through Google Cloud, and multiple models through AWS Bedrock or Azure OpenAI. Self-hosted open-weight models need no AI vendor BAA.

• Does a signed BAA make my app HIPAA compliant?

No. Using LLMs under BAA covers the vendor’s obligations only. Access controls, audit logging, minimum-necessary enforcement, workforce training, and a documented risk analysis all remain yours.

• Can I use ChatGPT Plus or Claude Pro for patient data?

No. Consumer and self-serve tiers are excluded from every major BAA. Using them with PHI is a violation regardless of how the prompt is written.

• Is it cheaper to self-host instead of using LLMs under BAA from a vendor?

Rarely at low volume. GPU costs, evaluation pipelines, and security engineering usually exceed API spend until you are running heavy, sustained inference.

• How long does it take to get a BAA in place?

AWS and Google Cloud are effectively immediate through self-serve acceptance. OpenAI and Anthropic enterprise agreements typically take two to six weeks depending on legal review.

• What happens if a vendor drops a model from its eligible list?

Your coverage for that model ends immediately. This is why teams running LLMs under BAA keep version pinning and a quarterly eligibility review in the compliance calendar, not the backlog.