BAA Coverage for AI Document Processing Apps

BAA coverage for AI document processing apps requires more than a model vendor’s signature. To keep sensitive customer data from reaching a model provider, send requests through a BAA-covered gateway that redacts PII and PHI before sending them on. Then secure coverage for every vendor that handles PHI, including the application, gateway, and model-provider layers, and enforce controls on the exact routes and features in use.

Why uploading a document with PHI automatically creates a Business Associate relationship

A team deploys an AI document tool, starts sending documents through it, and only later asks whether it needs a Business Associate Agreement. If those documents have protected health information, or PHI, that legal relationship is already in place. Under 45 CFR § 160.103, a vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity is a Business Associate. The vendor’s marketing does not change that definition. The agreement documents obligations triggered by the work.

A claim that the tool does not store documents does not remove those obligations. A vendor that processes PHI in memory still receives it, even if it keeps no permanent copy. Yet standard BAAs drafted for EHR vendors or billing companies did not anticipate AI systems that ingest PHI to analyze, route, or potentially train models. That mismatch makes the contract’s scope important from the first upload. The agreement must cover what the tool actually does.

The three hops where PHI actually travels in an AI document processing app

The basic path is application → gateway → model provider, with subprocessors branching off each layer. The application receives the document, parses it, and prepares the request. Any storage or logging before transmission is already in scope. Even after a clean request goes downstream, the duties tied to the original document stored upstream still apply.

The gateway then handles provider routing, authentication, error handling, and response normalization. Because it receives PHI, a vendor-operated gateway without a BAA is an uncovered Business Associate, regardless of what the model provider has signed. A unified gateway such as Concentrate can enforce redaction at this boundary, before tokens reach a provider. The gateway’s own handling of the unredacted request still needs coverage.

The model provider is the inference endpoint that processes the tokens, and its covered surfaces depend on the agreement. All three layers may use vector databases, logging systems, trace backends, and storage buckets. The primary Business Associate must bind subcontractors handling PHI to appropriate safeguards and BAAs. Embeddings and vectors remain PHI if they can identify an individual or sit beside identifiable data. Logs that keep the contents of documents carry the same risk.

What a BAA actually obligates a vendor to do — and what it leaves entirely with you

A BAA limits the vendor’s use of PHI to agreed purposes and requires administrative, physical, and technical safeguards. It also requires incident and breach reporting, access to books and records for HHS, and return or destruction of PHI at termination. Subcontractors that handle PHI must follow the same rules. The vendor must report a breach without unreasonable delay and within 60 days of discovering it. The report must say what happened, which PHI categories were affected, about how many individuals were affected, and how to reach a privacy-official contact.

Those duties cover only the product surfaces named in the agreement. A signature does not cover excluded features or make the whole workflow HIPAA-compliant. Workforce training, access control, minimum-necessary enforcement, audit logging, and risk analysis remain the covered entity’s responsibility. Centralized gateway records can help demonstrate that those controls operate, but the responsibility stays with the team running the workflow.

AI-specific terms also need attention in new agreements and legacy amendments. These include prohibitions on training, fine-tuning, or product improvement without separate written authorization, plus data minimization and limits on secondary uses. Re-identification safeguards, prior written approval for new subprocessors, and matching protections throughout the subcontractor chain address further gaps. Audit rights should let the covered entity see enough data lineage, model cards, and processing logs to check compliance. The work around the BAA therefore includes technical controls, architecture decisions, vendor selection, and collecting signatures.

Which major model providers will sign a BAA and what surfaces each BAA actually covers

Vendors change what they cover, so check each provider’s compliance page before signing a contract. In 2026, the major providers offering BAAs restrict coverage to particular tiers and surfaces. A covered vendor on an uncovered endpoint is still a gap. The access path matters as much as the model name.

Anthropic offers BAAs for the first-party Claude API and sales-assisted, HIPAA-ready Claude Enterprise plans. The Primary Owner must turn on HIPAA mode in Organization Settings. Covered Enterprise features include chat, projects, artifacts, file creation, code execution excluding network or external sites, voice, web search, and research. BAAs signed before December 2, 2025 cover the API only and require a separate Enterprise agreement. Agreements signed after that date can cover both surfaces.

OpenAI offers BAAs for its API and sales-managed ChatGPT for Enterprise with Regulated Workspace, including ChatGPT for Healthcare and ChatGPT for Clinicians. ChatGPT Free, Plus, Pro, and self-serve Business are not eligible. API coverage applies to endpoints approved under Modified Retention or Zero Data Retention. As of late 2025–2026, Assistants, Threads, the Files API, and image generation endpoints are listed as HIPAA-eligible under Modified Retention but excluded from Zero Data Retention. Verify current endpoint eligibility before designing the workflow.

Microsoft provides its BAA through the Microsoft Products and Services Data Protection Addendum. It covers Microsoft 365 Copilot in commercial or enterprise tenants and Azure OpenAI Service, but not Microsoft 365 Family or Personal subscriptions. Copilot through a personal Microsoft account is not HIPAA-eligible. For Gemini models, Gemini Enterprise Agent Platform, formerly Vertex AI, is the BAA-eligible API path. Some experimental Gemini features and Gemini in Chrome have been excluded from coverage.

AWS signs BAAs for HIPAA-eligible services, including Amazon Bedrock. That allows Claude and other hosted models to run under an AWS BAA. Claude accessed through the Anthropic API or Amazon Bedrock can therefore have coverage that Claude.ai self-serve or a Team plan does not. None of these distinctions ranks the models. They define which doors PHI may pass through.

How do you enforce sensitive data redaction at the gateway before it reaches a model provider

A provider shortlist cannot enforce its own boundaries. The gateway must use redaction before sending a request and check that the request takes a covered route. Its shared authentication, formatting, and routing controls make it the natural chokepoint for these checks. One policy can then govern every provider rather than depending on separate application integrations.

The placement of that chokepoint matters because one request can create several stored copies. The provider may receive the inference request, a trace backend may capture span attributes, and a SIEM or data lake may receive exported records. Each copy needs a residency answer, access policy, and retention clock. Redaction before content reaches those downstream destinations gives them a redacted version. It does not clean up raw content already captured by the application.

Audit logs must keep evidence without storing more PHI. They should omit raw prompts and record the data category, guardrail event, model, team, trace ID, and who did what and when. A compliance-grade log is immutable, complete, tamper-evident, and exportable to a SIEM. Zero Data Retention complements this control by preventing provider retention after inference, but does not replace upstream redaction. Because retention settings, training opt-outs, and logging controls may need to be turned on or set up, eligibility must be enforced for each request as well as checked at onboarding.

Three deployment models for the gateway layer and what each means for BAA coverage

A fully managed SaaS gateway sends PHI to the vendor’s infrastructure, so that vendor is a Business Associate. Its BAA must cover the features used, including base routing, redaction, audit logging, and fallback routing. The vendor is in charge of TLS encryption, Zero Data Retention processing, tenant isolation, and the rules for how long data is kept. Ask whether processing uses shared infrastructure or tenant isolation. This model offers the fastest deployment and lowest ongoing IT burden for teams comfortable with a documented cloud vendor.

With a private cloud or dedicated environment, the gateway processes data inside a set network boundary, such as the organization’s VPC or a vendor-hosted single-tenant instance. It can give the organization more control over encryption keys and network isolation, but updates may arrive later than on the SaaS path. Maintenance or update access can still make the vendor a Business Associate. The key questions are whether isolation is truly single-tenant and who has administrator access. This model suits organizations that already have cloud infrastructure and need more than standard SaaS offers.

With self-hosting, the gateway processes data inside the organization’s perimeter, while the organization still chooses its downstream provider route separately. A software vendor with no PHI access through telemetry, support tunnels, or cloud callbacks may not be a Business Associate for that deployment, subject to legal counsel’s review. LiteLLM unifies more than 140 providers behind an OpenAI-compatible API, with failover and usage tracking per virtual key. Governance, security, and support come with its paid Enterprise edition. Those capabilities do not remove the need to operate and patch the infrastructure continuously.

On March 24, 2026, LiteLLM versions 1.82.7 and 1.82.8 were published to PyPI containing credential-stealing malware in a supply chain compromise. Exact version pinning, image-signature verification, network restrictions, and rapid patching are therefore launch requirements for self-hosted PHI workloads. Self-hosting offers the most control over keys, networks, and physical access, but carries the highest IT burden and slowest deployment. It suits organizations with the staff to sustain that work. Most organizations start with SaaS plus a BAA and reconsider deployment as volume, regulation, or risk requirements change.

What a BAA-covered managed gateway enforces that vendor BAAs alone cannot

Without a layer that enforces the rules, agreements with each vendor rely on developers choosing the right route and settings every time. A managed gateway instead applies redaction, access policy, and routing rules at a shared boundary. With RBAC and SSO, access depends on who someone is, including when they have an API key. Automatic fallback can preserve coverage during an outage, provided every destination is BAA-covered. Real-time spend visibility by team, project, key, model, and provider also makes usage visible before the invoice arrives.

Concentrate offers a fully managed option with gateway-enforced PII and PHI redaction, Zero Data Retention, SSO, RBAC, and audit logs. Its BAA is available on a paid plan, while its pricing page places BAA coverage and SOC 2 Type II under Enterprise. Buyers should establish the required plan and confirm that the agreement covers redaction, routing, logging, and fallback. Evaluating any gateway whose controls and contracts have different eligibility rules requires checking eligibility for free-tier controls and BAA coverage separately.

For teams using Concentrate, one base URL change connects to models from 20+ providers, and automatic fallbacks can route across providers serving the same model without application code changes. The managed deployment also removes the team’s need to deploy or patch a proxy. The covered entity still needs records of access and of redaction on each request to back up its own evidence. Training, minimum-necessary use, and risk analysis remain outside any claim that a gateway alone solves compliance.

The compliance checklist for an AI document processing app handling PHI

Start with the application. Confirm whether it logs or stores raw PHI before the gateway, and place any such storage within the control and BAA scope. Limit requests to fields needed for the processing task. Include derived data and content-bearing telemetry in that review.

At the gateway, confirm a signed BAA covers redaction, routing, audit logging, and fallback. Verify redaction per request through metadata-only logs, and enable RBAC and SSO. Restrict fallback destinations to covered providers. Configure spend tracking by team, project, key, model, and provider.

At the provider layer, match every agreement to the exact product tier and endpoint in the routing pool. Enable Zero Data Retention on eligible endpoints and review subprocessor disclosures and contractual flow-down. Review BAAs for training restrictions, minimization, re-identification safeguards, subprocessor approval, audit rights, and breach timelines. Amend or replace legacy agreements missing those protections.

Keep workforce training, access control, minimum-necessary enforcement, and HIPAA risk analysis active. OCR made vendor accountability a centerpiece of its 2026 enforcement priorities, with BAA deficiencies among its early audit and investigation checks. Under HHS’s January 2025 proposed Security Rule amendments, AI tools that work with ePHI would be included in inventories and risk analyses, but the proposal sets no specific AI governance requirements. Vendor BAA positions and Zero Data Retention eligibility also change as those proposed updates move toward implementation. Coverage therefore needs periodic re-verification across every hop.