Business Associate Agreements (BAA) for Commercial Customers (original) (raw)

This article is about our commercial products such as Claude for Work and the Anthropic API. For our consumer products such as Claude Free, Pro, Max and when accounts from those plans use Claude Code, see here.

For Claude Enterprise features to be covered under a BAA, an administrator must activate HIPAA compliance in the HIPAA-ready Claude Enterprise admin settings under “Data & Privacy” and sign Anthropic's BAA. Standard Claude Enterprise plans do not include BAA coverage without action from an administrator.

Anthropic provides a Business Associate Agreement (BAA) covering our HIPAA-ready services, such as use of our first-party API or Enterprise plans. Claude Enterprise administrators can sign the BAA directly when activating HIPAA compliance in the admin settings under “Data & Privacy.” If you are a self-managed account and do not see the admin setting, please contact sales.

To use the 1P API with PHI, your organization’s administrator will need to sign a BAA and then contact sales to get this turned on.

For clarity, the BAA does not cover Workbench and Console, Claude Free, Pro, Max, or Team plans, Cowork, or features currently in beta such as Claude in Office and Claude Design. As part of the BAA, customers of Anthropic’s HIPAA-ready services are subject to certain configuration requirements and limitations on what features/integrations are available.

Not all API features are covered; see the Implementation Guide for the full list of eligible and non-eligible features.

Below is a breakdown of what’s covered under the BAA, by feature and product surface.

What’s covered under Anthropic’s BAA

*Covered under versions of the BAA signed after 12/2/25

Data retention periods within a HIPAA-Enabled API Organization are described in Anthropic’s public documentation.

The Messages API is covered as an Eligible Service under your BAA. The following Messages API features are covered under your BAA. Messages API features not listed below are not covered under your BAA.

*Covered under versions of the BAA signed after 4/1/26

Product BAA coverage by surface

Please see our Trust Portal for more information about our compliance commitments.

Deleting commercial Anthropic accounts How long do you store my organization’s data?I have a zero data retention agreement with Anthropic. What products does it apply to?What personal data will be processed by Computer use?Data retention practices for Mythos-class models