Is GPT-5.6 HIPAA Compliant?

GPT-5.6 can be used in a HIPAA-compliant way, but only if you sign OpenAI's Business Associate Agreement (BAA) and the specific model is named in scope. The model alone does not make you compliant.

There is one catch that trips teams up. Even though GPT-5.6 is now generally available in the OpenAI API and Codex, a newly released model may not yet be named in your BAA scope. So you must confirm your BAA names the specific model before you send any protected health information (PHI).

Healthcare teams assume a platform-level BAA covers every model OpenAI ships. It does not. Coverage applies only to models named in scope, and a preview model may not be listed yet.

The Honest Answer

GPT-5.6 can be part of a HIPAA-compliant workflow, but only after you sign OpenAI's BAA and confirm the model is in scope. No AI model is HIPAA compliant on its own.

OpenAI signs a BAA for eligible services, which covers its Zero Data Retention API and ChatGPT Enterprise. But a BAA covers the models named in your agreement, not automatically every new model OpenAI releases.

GPT-5.6 is a newly released model. Do not assume your existing OpenAI BAA already names it in scope. Confirm the specific model is named in scope, in writing, before any PHI touches it.

• No model is HIPAA compliant by itself
• OpenAI signs a BAA for its Zero Data Retention API and ChatGPT Enterprise
• A BAA covers only the models named in scope
• GPT-5.6 may not be named in your BAA scope yet — confirm in writing

What HIPAA Requires of an AI Vendor

HIPAA requires a signed BAA plus real safeguards before any vendor can handle PHI. A BAA is the contract that makes the vendor legally responsible for protecting patient data.

The safeguards matter as much as the contract. HHS requires access controls, audit logging, breach reporting, and limits on how the vendor may use or disclose the data. For AI, that also means the vendor must not train its models on your PHI.

These rules apply to the model provider the same way they apply to any other vendor. The model being powerful or new does not change what HIPAA asks of it.

• A signed BAA before any PHI is sent
• Access controls and audit logging
• Breach reporting duties defined in the contract
• No training on your PHI

OpenAI's Compliance Baseline

OpenAI holds the core certifications healthcare buyers look for, including SOC 2 and ISO 27001. It also maintains a Trust Portal where you can review its controls.

OpenAI signs a HIPAA BAA on its API and Enterprise products once a model is in scope. Coverage runs through the Zero Data Retention API and ChatGPT Enterprise, and business data is not used to train its models.

That baseline is solid, but it is a platform baseline. It confirms OpenAI can support HIPAA in general. It does not confirm that a specific model like GPT-5.6 is named in scope for you today.

• SOC 2 and ISO 27001 in place
• HIPAA BAA on API and Enterprise once a model is in scope
• Covered through the Zero Data Retention API and ChatGPT Enterprise
• Business data is not used for model training

The BAA-Scope Caveat (The Real Gotcha)

GPT-5.6 is a newly released model, and a model not yet named in your BAA is not covered. This is the specific compliance trap on this page.

OpenAI made GPT-5.6 (Sol, Terra, Luna) generally available in the API and Codex in July 2026, with no waitlist or vetted-org gating (OpenAI). Even so, a newly named model may not yet appear in your BAA's in-scope list.

So the platform-level BAA you already signed may not extend to GPT-5.6 yet. Email OpenAI at baa@openai.com and confirm the specific model is named in scope before you send PHI. Get the confirmation in writing.

• GPT-5.6 is generally available in the OpenAI API and Codex
• A newly released model may not yet be named in your BAA scope
• A model not named in your BAA is not covered
• Confirm scope in writing before any PHI

Sol, Terra, and Luna: Confirm the Tier You Use

GPT-5.6 ships in three tiers, and your BAA needs to cover the exact tier and access route you use. The tiers are Sol, Terra, and Luna, priced from higher to lower.

Sol runs $5 input and $30 output per million tokens, Terra runs $2.50 and $15, and Luna runs $1 and $6. A team may test on one tier and deploy on another, which changes what your BAA must name.

When you confirm scope with OpenAI, name the tier and the access path, whether that is the API or Codex. Do not assume coverage of one tier extends to the others.

• Sol: $5 input / $30 output per million tokens
• Terra: $2.50 input / $15 output per million tokens
• Luna: $1 input / $6 output per million tokens
• Confirm the BAA names your exact tier and access route

A Safe-Use Checklist for Clinics and Practices

Follow a short checklist before GPT-5.6 sees any patient data. Each step closes a gap that a newly named model can leave open.

Start by confirming the BAA is signed and that GPT-5.6 is named in scope for your tier and access route. Then confirm you are on the Zero Data Retention API and that data is not used for training.

Until every box is checked, keep PHI out of the model. You can still use GPT-5.6 or a covered model for tasks that contain no patient data, so your team can learn the tool while the paperwork clears.

• Confirm a signed OpenAI BAA is in place
• Confirm GPT-5.6 is named in scope for your tier and access route
• Confirm you are on the Zero Data Retention API
• Confirm data is not used for training
• Keep all PHI out until every box is checked

When to Prefer a Model With a Confirmed In-Scope BAA

Prefer a model whose BAA scope you have confirmed when you need to send PHI now and cannot wait to verify a newly named model. A confirmed in-scope BAA removes the uncertainty entirely.

Claude Fable 5 is a strong option here. Anthropic offers a HIPAA BAA on its API and Enterprise plans, holds SOC 2, ISO 27001, and ISO 42001, and Fable 5 returned to worldwide general availability on July 1, 2026. Note that Fable 5 carries a mandatory 30-day safety retention on business accounts, so full zero-data-retention is not available.

The decision rule is simple. If your work with PHI cannot wait, use a model whose BAA you have confirmed. Save GPT-5.6 for non-PHI tasks until it is named in scope on your account.

• Choose a model with a confirmed in-scope BAA when PHI cannot wait
• Claude Fable 5 offers a HIPAA BAA on API and Enterprise
• Fable 5 holds SOC 2, ISO 27001, and ISO 42001
• Use GPT-5.6 for non-PHI tasks until it is named in your BAA scope

The Bottom Line

GPT-5.6 can be HIPAA compliant, but only with a signed OpenAI BAA that names the model in scope. The model by itself does not make you compliant.

BAA scope is the risk to manage. A model not yet named in your BAA is not covered, and GPT-5.6 is a newly released model.

Confirm scope in writing, use the Zero Data Retention API, and keep PHI out until every check clears. When in doubt, use a model with a confirmed in-scope BAA instead.

• The model alone does not make you compliant
• A signed BAA that names GPT-5.6 does the work
• BAA scope is the specific trap to avoid
• Prefer a model with a confirmed in-scope BAA when PHI cannot wait