Turn on HIPAA protection.
If you work with medical records or other health information, turn this on in your Claude account before you use real client files. It's free and takes a few minutes.
Turning on HIPAA protection puts Anthropic's Business Associate Agreement (BAA) in place for your organization. It's a legal agreement in which Anthropic commits to safeguard the health information you send, to use it only to provide the service, to report any breach to you, and never to use your content to train its models.
The Claude chat app
Claude's regular chat app on Free, Pro, Max and Team plans can't be covered by Anthropic's Business Associate Agreement. Don't paste client health information into it.
Your Claude API account
You can turn on HIPAA protection yourself, in a few minutes, for your Claude API organization. This is the account our software connects to, which makes it the most practical way for a practice to use Claude with private medical information.
Anthropic's Enterprise plans can also be covered, through Anthropic's sales team.
Open Data retention
In the Claude Console, open Organization settings, then Data retention in the left menu.
If the menu at the top right doesn't say Organization, select it. The HIPAA compliance card is near the bottom of the page.
Download both documents
Download the Business Associate Agreement, then the HIPAA Implementation Guide. Each step unlocks after the one before it.
Keep both with your practice records, and read the guide. It explains what you may and may not do with health information.
Accept the agreement
Accept the agreement as the person authorized to sign for your practice. It takes effect immediately.
Look for the green check
The card now shows HIPAA compliance with a green check and the message "This organization is configured to process Protected Health Information (PHI) under the executed BAA."
While you're on this page, leave Allow user feedback turned off, and don't join the Development Partner Program. Our software doesn't need either.
Three things to remember
It's permanent
Once turned on, HIPAA protection can't be switched off for that organization. That's what you want for client work. Keep unrelated projects in a separate organization.
Use a key from this organization
Only API keys created in your HIPAA-enabled organization are covered. If you made your key earlier in the same organization, it's covered too.
Health information goes in your files only
Keep it out of your organization and workspace names, your profile, your billing details and any support requests to Anthropic.
Clear commitments, under your own rules.
HIPAA is a U.S. law and doesn't apply directly in Canada. The agreement still gives you clear written commitments about how health information is handled. Your own obligations come from PIPEDA and provincial health privacy laws, such as Ontario's PHIPA and Quebec's Law 25.
Check the rules in your province, let clients know that AI is part of your process, and send only the information each task needs. The privacy shield and redaction tools in our software help with that. This is general information, not legal advice. See our privacy page for more.