This article details which Anthropic commercial products and API features qualify under a HIPAA Business Associate Agreement. It breaks down covered and non-covered services, notes beta and third-party integration exclusions, and highlights ZDR requirements for handling PHI in Claude Code.

• Core Claude for Work features (chat history, Artifacts, voice, web search, research, file creation/code execution without external network access) are BAA-covered, but third-party integrations like MCPs/Connectors, Enterprise Search, and Claude in Chrome are not once data leaves Anthropic.
• On the API side, Messages API and related tools (prompt caching, structured outputs, memory, web search, Bash/text-editor) plus Token Counting, Models, Org Management, and Compliance APIs are covered, while Batch API, Files API, Skills API, Code Execution, Computer Use, and Web Fetch are excluded.
• For Claude Code, only the CLI with Zero-Data-Retention enabled qualifies for BAA coverage—the web, desktop, review, and security betas don't support ZDR and fall outside it.
• Beta features like Cowork and Claude for Office are entirely excluded from BAA coverage, requiring separate data-handling safeguards for any PHI use.

Anthropic offers Business Associate Agreements (BAA) for its HIPAA eligible services, specifically for commercial products like Claude for Work and the Anthropic API. However, the BAA does not cover certain services and has specific configuration requirements and limitations. To start the BAA process or learn more, customers should contact the sales team.

• Anthropic only offers BAAs for Claude for Work and the Anthropic API, not for Claude.ai Free/Pro/Max or standard Claude for Work plans and beta/chat products
• HIPAA-eligible use requires zero data retention agreements as part of the BAA setup
• Features like web search, batch processing, prompt caching, and Files API uploads are excluded from BAA coverage
• Interested customers must contact Anthropic's sales team directly to start the BAA process