Covered Models under a Business Associate Agreement (BAA) (original) (raw)

This article is for organizations that use Anthropic's HIPAA-ready services under a Business Associate Agreement (BAA). It explains which configurations are Eligible Services under the BAA and whether you can access Covered Models. Your organization is responsible for ensuring its use of these services complies with applicable legal obligations. Learn about Business Associate Agreements (BAA) for Commercial Customers and Covered Models.

Covered Models and data retention

Covered Models, like Claude Fable 5, require 30-day data retention on every platform where they're offered, as part of our safety work, and they can't be accessed from organizations or workspaces with zero data retention (ZDR) enabled. Learn about data retention practices for Mythos-class models.

Coverage at a glance

Each row in the table is a configuration: a product, how you access it, and whether you're using standard retention or zero data retention. The two right-hand columns show whether that configuration is covered under Anthropic's BAA and whether it can access Covered Models.

Note: Coverage under Anthropic's BAA always requires (a) signing the BAA, and (b) accessing Anthropic's products via their HIPAA-ready or (in the case of Claude Code) zero data retention configurations. Learn about HIPAA-ready API access and HIPAA-ready Enterprise plans.

*Anthropic's BAA doesn't apply to services purchased through a third-party cloud provider. For questions about coverage on these platforms, contact your cloud provider and your Anthropic account team.

Requests to a Covered Model from a ZDR-enabled organization or workspace return an error.

How to access Covered Models under the BAA

To access Covered Models in configurations that are covered under the BAA:

How to access Covered Models outside the BAA

To access Covered Models in configurations that aren't covered under the BAA:

Note: These configurations are not covered under the BAA. Don't submit protected health information (PHI) through them.

Before you change your configuration

Some organizations may consider setting up a separate, non-ZDR organization to access Covered Models in Claude Code, Cowork, Chat, or API in production. Before you do, keep in mind:

Business Associate Agreements (BAA) for Commercial Customers HIPAA-ready Enterprise plans Public Sector FAQs Covered Models Data retention practices for Mythos-class models