HIPAA AI Vendor Comparison Table

PrivateClaude Business, Hathr, BastionGPT, CompliantChatGPT, OpenAI for Healthcare, Anthropic Enterprise, Microsoft Azure OpenAI. Side by side, honestly.

What you're actually comparing

Every vendor in this post will sign a BAA with you. That's the legal floor. If a vendor won't sign a BAA, you can't put PHI in their tool. Full stop. So the BAA itself isn't a differentiator. Everything that matters happens above that line.

Here's what actually varies between these seven vendors:

• The model under the hood. Some run Claude (Anthropic). Some run GPT (OpenAI). Some run a custom or fine-tuned variant. Model choice affects quality, latency, and what the tool feels like to use day to day.
• Deployment. SaaS is the default. Some vendors offer VPC deployment (your cloud, their software). A few will discuss on-prem for the right contract. This matters a lot if your security policy says "data doesn't leave our network."
• Audit logs and SSO. If you have more than a handful of users, you want both. Audit logs for compliance reviews and incident response. SSO so you can deprovision someone in one place when they leave.
• Target buyer. Some of these tools are built for solo practitioners. Some are built for hospital systems. The procurement cycle, the contract minimums, and the support posture all reflect that.
• Pricing posture. A few publish their pricing. Most say "contact sales." Both are legitimate, but they tell you something about who the vendor is set up to serve.

The honest framing: there's no single winner. Pick the tool that matches your size, your stack, and your buying process. The big comparison table below should help you narrow down to two or three.

The big comparison table

This is the core of the post. Scroll horizontally if you're on mobile. Specifics for each vendor are detailed in the sections that follow.

A few notes on how to read this. "Configurable" retention means the vendor lets you set the retention window in your contract or admin settings. "Per public info" is a hedge: we're describing what the vendor publishes, not what we've independently verified for every plan. Always confirm specifics with the vendor before you sign.

Private Claude Business

Model: Claude (Opus, Sonnet, Haiku). All three available depending on the task.

BAA: Yes, on the Business tier. The standard consumer product isn't BAA-backed; the Business tier is the SKU that adds the BAA, audit logs, SSO, and admin controls.

Retention: Zero application-level chat history. Conversations live in the browser tab and disappear when it closes. Anthropic's API logs auto-delete after 7 days, and Anthropic doesn't train on the data. So the longest any record exists is 7 days, on infrastructure governed by Anthropic's enterprise terms.

Deployment: SaaS by default. Bring-your-own-key (BYOK) so the API contract sits with your org, not ours. VPC deployment available for teams that need it.

Audit logs and SSO: Both included on the Business tier.

Pricing: $1,449/year for the White Label deployment. Transparent. No "contact sales" required to get a number.

Target buyer: Solo practitioners, small clinics, and mid-size practices. The kind of org that wants HIPAA-grade AI without a six-month procurement cycle. If you've already got an Anthropic API key and you want a chat interface that won't store PHI, this is the cleanest fit.

For a deeper head-to-head with one of the obvious alternatives, see Private Claude vs Hathr.AI.

Hathr.AI

Model: Claude-based, per publicly available info. Hathr markets itself as a HIPAA-focused Claude wrapper.

BAA: Yes, BAA-backed. This is one of their core marketing points and it's a real one.

Retention: Per their published terms. They publish a privacy posture aimed at clinical use cases. Confirm the specifics directly with their sales team before you sign, particularly around message retention and where the data sits.

Deployment: Hosted SaaS. We don't have public confirmation of a VPC option. If your security team requires VPC, ask before you commit.

Audit logs: Available, per public info.

Pricing: Contact sales. They don't publish a sticker price, which is normal for the clinical-buyer segment but worth knowing if you want a fast self-serve answer.

Target buyer: Clinical teams and healthcare orgs. Their go-to-market and product framing is squarely aimed at the medical buyer. If you're in healthcare and you want a vendor whose entire pitch is "HIPAA Claude," they're on the shortlist.

BastionGPT

Model: GPT-based, per publicly available info. Built on OpenAI under the hood.

BAA: Yes, BAA-backed. Marketed as a HIPAA-compliant GPT for clinical and operational use.

Retention: Per their published terms. Like most GPT wrappers, the retention story sits on top of OpenAI's underlying enterprise terms. Verify specifics with their team.

Deployment: Hosted SaaS.

Audit logs and SSO: Available, with SSO typically gated to higher tiers. Confirm at the plan level you're considering.

Pricing: Per-user subscription, with org pricing on request.

Target buyer: Clinical and operational healthcare teams. Their framing leans toward day-to-day clinical workflow assistance.

One thing to acknowledge directly: we can verify what's on their public pages and marketing. Specifics like exact retention windows and the precise audit log schema are best confirmed with their sales team. We're not going to invent details we can't source.

CompliantChatGPT

Model: GPT-based, accessed through a wrapper. The name uses "ChatGPT" descriptively. CompliantChatGPT is not affiliated with OpenAI. It's a separate company that wraps OpenAI's API and adds a HIPAA-compliant layer on top.

BAA: Yes, via the underlying provider arrangement. The wrapper sits between you and OpenAI, and the BAA flow runs through the wrapper's terms.

Retention: The wrapper applies its own retention layer on top of OpenAI's enterprise terms. Read both.

Deployment: Hosted SaaS.

Audit logs and SSO: Available; SSO typically on higher tiers.

Pricing: Per-user subscription, generally lower per-seat than the OpenAI Enterprise floor. That's the main reason small practices look at it.

Target buyer: Solo and small practices that want a ChatGPT-style interface and a BAA, without the procurement cycle of going direct to OpenAI Enterprise. If you specifically want the GPT family of models and you don't want to talk to a salesperson, this is one of the paths.

OpenAI for Healthcare / ChatGPT Enterprise

Model: GPT, native. No wrapper. You're getting the same models OpenAI ships to every other Enterprise customer, with healthcare-specific contract terms layered on.

BAA: Yes, available on the Enterprise tier. OpenAI does sign BAAs for ChatGPT Enterprise customers in healthcare.

Retention: Configurable. Business data isn't used for training. Retention windows can be set per the contract.

Deployment: Hosted SaaS, on OpenAI's infrastructure.

Audit logs and SSO: Both included on Enterprise. SAML SSO is standard.

Pricing: Contact sales. Enterprise has seat minimums and a real procurement cycle. This is not a credit-card self-serve product.

Target buyer: Mid-market to enterprise healthcare orgs. If you have a procurement team, a security review process, and a multi-month buying cycle, OpenAI Enterprise fits the shape. If you're a solo practice trying to get HIPAA AI by Friday, the procurement path is going to feel heavy.

The honest thing about this option: it's the gold standard if you have the buying process to support it, and it's overkill (and slow to land) if you don't.

Anthropic Enterprise + Microsoft Azure OpenAI

These two get grouped because they're the cloud-native paths. If you're already running on AWS, GCP, or Azure, the cleanest answer might be to use the AI service that's native to the cloud you already trust.

Anthropic Enterprise

Model: Claude, native. Same family as Private Claude, but the official enterprise contract directly with Anthropic.

BAA: Yes, available on the Enterprise tier.

Retention: Configurable. No training on enterprise data, ever. Anthropic API logs auto-delete after 7 days by default, and the enterprise contract can adjust this.

Deployment: Anthropic-hosted SaaS, plus availability through AWS Bedrock and GCP Vertex AI. If you're already using Bedrock for other workloads, you can pipe Claude through your existing AWS contract.

Audit logs and SSO: Both included.

Pricing: Contact sales.

Target buyer: Mid-market to enterprise. If you want Claude specifically and you have the procurement process to support a direct enterprise contract, this is the path.

Microsoft Azure OpenAI

Model: GPT, hosted in Azure. Same OpenAI models, different infrastructure and contract.

BAA: Yes, with your Azure subscription. If you already have a Microsoft BAA for Microsoft 365, it typically extends to Azure services with proper configuration.

Retention: Configurable. Data stays in your Azure tenant. It's not shared with OpenAI's main consumer environment.

Deployment: Inside your Azure tenant. This is the closest thing to "VPC for AI" most healthcare orgs will need.

Audit logs and SSO: Azure-native logging, Microsoft Entra ID for identity. If your IT team is already managing Azure, none of this is new work.

Pricing: Pay-as-you-go Azure consumption pricing, layered on your existing Azure contract.

Target buyer: Orgs already on Microsoft 365 and Azure. The fact that you don't have to onboard a new vendor (because Microsoft is already a vendor) is the entire pitch. Procurement is faster, security review is shorter, and the BAA story sits inside contracts you already have.

If you're still narrowing down, our broader writeup on HIPAA-compliant AI chat covers the architecture questions that should drive the decision before you start vendor calls.