Is Claude Fable 5 HIPAA Compliant?

Claude Fable 5 can be used in a HIPAA-compliant way, but only if you sign Anthropic's Business Associate Agreement (BAA) and use it through a covered surface. The model alone does not make you compliant.

There is one catch that trips up healthcare teams. Claude Fable 5 is a Mythos-class model, and Anthropic applies a mandatory 30-day safety retention to Mythos-class models on business accounts. So if your risk analysis or a payer contract requires zero data retention, Fable 5 does not meet that bar today, even though earlier Claude models can.

Healthcare teams also assume every Claude surface is covered once Anthropic signs a BAA. It is not. Coverage applies only to the first-party API and HIPAA-ready Enterprise plans — Claude.ai Free, Pro, Max, and Team never qualify, no matter which model answers.

The Honest Answer

Claude Fable 5 can be part of a HIPAA-compliant workflow, but only through a covered plan with a signed Anthropic BAA. No AI model is HIPAA compliant on its own.

Anthropic signs a BAA for two surfaces: the first-party Claude API and HIPAA-ready Enterprise plans. Fable 5, released June 9, 2026 and back to worldwide general availability on July 1, 2026, runs on the same API and Enterprise infrastructure as every other current Claude model, so it inherits the same BAA and certifications.

The model name does not change the rules. What changes is one retention detail: Fable 5 is a Mythos-class model, and Mythos-class models carry a mandatory 30-day safety retention on business accounts that earlier Claude models did not carry in the same way. Confirm your BAA and risk analysis account for that window before you send PHI.

• No model is HIPAA compliant by itself
• Anthropic signs a BAA for the first-party API and HIPAA-ready Enterprise plans
• Fable 5 inherits the same BAA and certifications as other current Claude models
• Fable 5's mandatory 30-day safety retention is the one detail that differs — confirm it before sending PHI

What HIPAA Requires of an AI Vendor

HIPAA requires a signed BAA plus real safeguards before any vendor can handle PHI. The BAA is the contract that makes the vendor legally responsible for protecting patient data.

The safeguards matter as much as the contract. HHS requires access controls, audit logging, breach reporting, and limits on how the vendor may use or disclose the data. For AI, that also means the vendor must not train its models on your PHI.

These rules apply to Anthropic the same way they apply to any other vendor. A newer, more capable model does not change what HIPAA asks of it.

• A signed BAA before any PHI is sent
• Access controls and audit logging
• Breach reporting duties defined in the contract
• No training on your PHI

Anthropic's Compliance Baseline

Anthropic holds the core certifications healthcare buyers look for: SOC 2 Type I and Type II, ISO 27001:2022 for information security, and ISO/IEC 42001:2023 for AI management systems.

Anthropic signs a HIPAA BAA on its first-party API and HIPAA-ready Enterprise plans. Coverage on Enterprise includes chat, projects, artifacts, voice, web search, research, skills, file creation, and code execution. On the API, the Messages API, prompt caching, structured outputs, memory, web search, and tool use are covered.

That baseline is solid, and it applies to Fable 5 the moment you use it through one of those covered surfaces. It does not extend to Claude.ai Free, Pro, Max, or Team — those plans get no BAA regardless of which model is selected.

• SOC 2 Type I and Type II
• ISO 27001:2022 for information security
• ISO/IEC 42001:2023 for AI management systems
• HIPAA BAA on the first-party API and HIPAA-ready Enterprise plans only

The 30-Day Retention Caveat (The Real Gotcha)

Fable 5 is a Mythos-class model, and Mythos-class models carry a mandatory 30-day safety retention on business accounts — this is the specific compliance trap on this page.

Anthropic offers a Zero-Data-Retention (ZDR) addendum for eligible APIs and Claude Code for Enterprise, where Anthropic does not store your inputs or outputs except where law requires. Fable 5 does not qualify for full ZDR, even on plans where earlier Claude models can run under it. The 30-day window exists so Anthropic can review flagged sessions for safety, then deletes the data afterward.

So a team that signed a ZDR addendum for an earlier Claude model cannot assume it silently carries over to Fable 5. Confirm with Anthropic, in writing, whether your BAA and any ZDR terms explicitly address Mythos-class retention before PHI touches Fable 5.

• Fable 5 is Mythos-class and carries a mandatory 30-day safety retention on business accounts
• Full zero-data-retention is not available on Fable 5, unlike some earlier Claude models
• Anthropic uses the retained data only for safety review, then deletes it
• Confirm in writing whether your BAA and risk analysis account for the 30-day window

The Safety Fallback to Opus 4.8

Fable 5 blocks high-risk requests and falls back to Claude Opus 4.8 to answer them instead. Anthropic reports that over 95% of sessions never trigger this fallback.

The fallback does not weaken BAA coverage — Opus 4.8 runs on the same covered API and Enterprise surfaces. But it does mean a different model can answer a given clinical question, so validate outputs on real cases rather than assuming Fable 5 always generates the response you review.

For teams running high-stakes clinical workflows, this is a reason to spot-check outputs periodically, not a reason to avoid Fable 5.

• High-risk requests fall back to Claude Opus 4.8 automatically
• Over 95% of sessions never trigger the fallback (Anthropic)
• The fallback stays within the same BAA-covered surfaces
• Validate clinical outputs — the answering model can vary

A Safe-Use Checklist for Clinics and Practices

Follow a short checklist before Fable 5 sees any patient data. Each step closes a gap that a new flagship model can leave open.

Start by confirming the BAA is signed and that you are using the first-party API or a HIPAA-ready Enterprise plan — never Claude.ai Free, Pro, Max, or Team. Then confirm your risk analysis and any payer contracts explicitly allow the mandatory 30-day safety retention, since full zero-data-retention is not available on Fable 5.

Until every box is checked, keep PHI out of the model. Your team can still use Fable 5 for tasks with no patient data while the paperwork clears.

• Confirm a signed Anthropic BAA is in place
• Confirm you are using the first-party API or HIPAA-ready Enterprise — not Free, Pro, Max, or Team
• Confirm your risk analysis allows Fable 5's mandatory 30-day safety retention
• Confirm HIPAA settings are turned on for Enterprise — coverage is not automatic
• Keep all PHI out until every box is checked

When Your Contract Requires Zero Data Retention

Prefer a different Claude model when a payer contract or risk analysis requires zero data retention and cannot accommodate a 30-day safety window. That requirement removes Fable 5 from consideration until Anthropic changes the Mythos-class retention policy.

Claude Opus 4.8 remains available under the same BAA and, on eligible plans, under the ZDR addendum, since it is not a Mythos-class model. For teams that need frontier Claude capability without the 30-day retention rule, Opus 4.8 is the closer fit today.

The decision rule is simple: if zero retention is contractually non-negotiable, use a Claude model that supports ZDR. If a 30-day safety window is acceptable, Fable 5's added capability is available to you now.

• Zero-retention requirement + Fable 5 = not currently compatible
• Claude Opus 4.8 supports ZDR on eligible plans and is not Mythos-class
• Confirm ZDR eligibility model-by-model — it is not a blanket Claude feature
• Revisit this if Anthropic updates Mythos-class retention terms

The Bottom Line

Claude Fable 5 can be HIPAA compliant, but only with a signed Anthropic BAA on the first-party API or a HIPAA-ready Enterprise plan.

The mandatory 30-day safety retention is the risk to manage. It applies to Fable 5 because it is a Mythos-class model, and it means full zero-data-retention is not available even where it is for other Claude models.

Confirm your BAA and risk analysis in writing, keep PHI off Claude.ai Free, Pro, Max, and Team, and choose a ZDR-eligible model instead when your contract requires zero retention with no exceptions.

• The model alone does not make you compliant
• A signed BAA on a covered surface does the work
• The 30-day safety retention is the specific trap to plan around
• Use Opus 4.8 instead when zero retention is contractually required