Best AI agent platforms with HIPAA BAA compliance in 2026: 7 picks compared

Short answer: if you're building your own agents and want a BAA you can sign today, start with Amazon Bedrock AgentCore. AWS lists AgentCore by name on its HIPAA eligible services reference, and you accept the BAA yourself in the AWS console. If your hospital or clinic already runs on Microsoft 365, Copilot Studio is the easier pick, and for phone agents on a small budget, Retell AI is the one I'd look at first.

The catch with AI agent platforms with HIPAA BAA compliance is that the BAA rarely covers the whole product. It covers specific services, specific plans and, sometimes, specific settings you have to switch on. A vendor can sign a BAA with you and still exclude half its features. So for each of the seven picks below, I've noted which plan includes the BAA, how you get it, and what it leaves out, using each vendor's own pages as of late October 2026.

This article is general information, not legal advice; check your BAA and setup with your own counsel or compliance officer.

Key takeaways

• A signed BAA doesn't make your agent HIPAA compliant on its own; OpenAI, Microsoft and Google all say so plainly on their HIPAA pages.
• AWS and OpenAI let eligible customers accept a standard BAA themselves, while Anthropic's BAA for Claude Enterprise needs the Primary Owner to switch on a HIPAA-ready setting.
• ChatGPT Business doesn't come with a BAA, so don't assume a paid business seat covers patient data.
• Retell AI offers a BAA on its pay-as-you-go plan, while Vapi charges $2,000 a month for its HIPAA add-on.
• Beta features, published pages and third-party connectors are the usual gaps, so map every place PHI could travel before you go live.

Our ranking method

Nobody at The AI Future ran hands-on tests for this roundup, and we didn't sign any BAAs. We compared each platform using its official HIPAA, trust and pricing pages, plus published third-party ratings where they exist, as of late October 2026. Then we ranked them on these criteria:

• BAA confirmed on an official vendor page, not a reseller or blog.
• Which plans include the BAA, and whether you need an enterprise contract to get it.
• How clearly the vendor lists covered and excluded features.
• Agent-building depth: tools, memory, orchestration and deployment options.
• Price transparency and the realistic monthly cost of a small healthcare deployment.
• Third-party ratings and user feedback, where we could find them.

Cloud platforms rank highest because their BAAs cover the infrastructure your agent runs on as well as the model. Voice platforms rank lower overall, but they're probably the fastest route if your use case is a phone line.

The 7 best AI agent platforms with HIPAA BAA compliance at a glance

The best AI agent platforms with HIPAA BAA compliance in 2026, ranked

Amazon Bedrock AgentCore – best for custom agents at scale

Amazon Bedrock AgentCore is AWS's service for running, scaling and securing AI agents, and it sits on AWS's HIPAA eligible list next to Amazon Bedrock itself.

Strengths

The BAA story here is the cleanest on this list. AWS's eligible services list, last updated October 15, 2026, names both Amazon Bedrock and Amazon Bedrock AgentCore. Getting the BAA doesn't need a sales call: going by AWS's HIPAA FAQ, you review and accept the Business Associate Addendum in AWS Artifact inside the console, and organisations can accept it across multiple accounts.

Pricing is consumption-based with no minimum fees. On the AgentCore pricing page, Runtime bills per second for actual CPU and memory, and new AWS customers get up to $200 in Free Tier credits. That flexibility cuts both ways (cost forecasting on AWS is its own skill), and AgentCore is a developer tool, so budget for engineering time too.

Key features

• Serverless Runtime with per-second billing and hardware-isolated microVMs.
• Works with models available in Amazon Bedrock, including third-party ones.
• BAA accepted self-serve in AWS Artifact for one account or a whole organisation.

Amazon Bedrock AgentCore pricing: No free plan, but new AWS customers get up to $200 in credits, then pay-as-you-go pricing (checked October 2026). See pricing

Related: How to create an AI agent

Verdict: if you have engineers and want the fewest BAA surprises, this is the one.

Microsoft Copilot Studio – best for Microsoft 365 organisations

Microsoft Copilot Studio is Microsoft's low-code tool for building agents that work inside Microsoft 365 or on outside channels like websites, and Microsoft says it's covered under its HIPAA BAA.

Strengths

Microsoft is unusually direct about this one. Its Copilot Studio compliance page says: "Microsoft Copilot Studio is covered under the Health Insurance Portability and Accountability Act (HIPAA) Business Associate Agreement (BAA)." It even gives examples, such as an agent asking a patient for blood pressure or weight. Its Azure HIPAA overview says Microsoft will enter into BAAs with covered entities and business associates, and the BAA itself sits in the Microsoft Product Terms.

One caveat stands out. Microsoft says Copilot Studio "isn't intended for use as a medical device", so triage or diagnosis agents are off the table. A review by DeepInspect makes a practical point I agree with: coverage stops at the edge of the in-scope service, so each Power Platform connector your agent calls needs its own check.

Key features

• Low-code agent builder that licensed Microsoft 365 Copilot users can use for internal agents.
• Standalone plans let you publish agents to websites, apps and social channels.
• Billing in Copilot Credits, either prepaid packs or a pay-as-you-go meter.
• An Azure subscription is needed for pay-as-you-go agents.

Microsoft Copilot Studio pricing: No free plan (a free trial is available), then $200 per month for a pack of 25,000 Copilot Credits, or pay as you go (checked October 2026). See pricing

Related: Microsoft AI review

Verdict: if your IT team already runs Microsoft 365, I think this is the least painful route to a covered agent.

Google Gemini Enterprise Agent Platform – best for Google Cloud teams

Google Gemini Enterprise Agent Platform (the platform formerly sold as Vertex AI) is Google Cloud's toolkit for building, tuning and deploying agents, and it's listed under the Google Cloud BAA.

Strengths

Google's HIPAA page for Google Cloud lists Gemini Enterprise Agent Platform, Generative AI on Agent Platform, Agent Search, Conversational Agents and Gemini Enterprise among the covered products. The BAA also covers Google Cloud's whole infrastructure, every region and zone, so you aren't pushed into one location.

The fine print matters, though. For Conversational Agents, Google says not to put PHI in your agent definition, including intents and training phrases. For Speech-to-Text, it says not to opt in to data logging if you have a BAA. You accept the Google Cloud BAA through the privacy compliance settings in the console. New customers get $300 in free credits, going by the product page.

Key features

• Model Garden with Gemini models, Anthropic's Claude models and open models like Gemma.
• Agent Search for grounding answers in your own data.
• Antigravity app for steering and orchestrating several agents at once.
• BAA covers all Google Cloud regions, with standard pricing.

Google Gemini Enterprise Agent Platform pricing: No free plan, but new customers get $300 in credits, then usage-based pricing, with text generation from $0.0001 per 1,000 characters (checked October 2026). See pricing

Verdict: a strong pick if your data already lives in BigQuery; otherwise AWS is simpler.

OpenAI API – best for developers wanting a self-serve BAA

The OpenAI API gives developers OpenAI's models and agent tools, and eligible organisations can now accept a standard BAA themselves in the API Platform settings.

Strengths

This changed recently, and I think it's a big deal for small teams. Going by OpenAI's BAA help article, updated in late October 2026, "An enterprise agreement is not required to sign a BAA for API services." An admin opens Settings, goes to Organization, then General, and enables HIPAA compliance support. The catch: self-serve enrolment needs an established history of API usage, so a brand-new account will likely see "Not eligible yet".

Watch the ChatGPT side carefully. OpenAI says a BAA for ChatGPT Enterprise or Edu needs a sales conversation, and "We do not offer a BAA for ChatGPT Business." That's the $20-a-seat plan on OpenAI's business pricing, so plenty of clinics could get this wrong. Also, once HIPAA support is turned on for an API organisation, you can't turn it off.

Key features

• Self-serve BAA acceptance in the API Platform for eligible organisations.
• Downloadable Business Associate and Healthcare Addendum after acceptance.
• Token-based pricing across the GPT-6 family, from gpt-6-luna up to gpt-6-astra.
• HIPAA eligible products list and implementation guide for setup.

OpenAI API pricing: No free plan; pay per token, with gpt-6-luna at $0.10 per million input tokens and $0.50 per million output tokens (checked October 2026). See pricing

Related: OpenAI review

Verdict: great for developers with some API history; not the answer if you wanted ChatGPT seats for staff.

Anthropic Claude – best for staff-wide rollout plus API

Anthropic Claude covers both a workplace app (Claude Enterprise) and a developer API, and Anthropic offers a BAA for its HIPAA-ready services on both.

Strengths

Anthropic's BAA article for commercial customers says it provides a BAA covering its first-party API, Claude in Microsoft Foundry and Enterprise plans. It has the most detailed feature-by-feature table of any vendor here: chat, projects in chat, voice, web search and Research are covered on Claude Enterprise, while Skills are available but not covered.

It isn't automatic. Standard Claude Enterprise plans "do not include BAA coverage without action from a Primary Owner", who has to switch on HIPAA compliance under Data and privacy. API customers sign the BAA and then contact sales to turn it on. Beta features like Claude in Office, Claude Design, Claude Slides and Claude Docs are excluded, and so is Cowork in the cloud. On the individual plans page, the HIPAA-ready offering is marked "No" for Free, Pro, Max and Ultra (so don't try to get there with a personal plan).

Key features

• Feature-by-feature BAA coverage table, updated as products change.
• Covered models need 30-day data retention unless Anthropic authorises otherwise.
• Claude Code and Cowork in local mode can be covered on HIPAA-ready Enterprise.
• Enterprise adds SSO, SCIM, audit logs and a Compliance API.

Anthropic Claude pricing: No free plan with a BAA; Claude Enterprise uses custom pricing, and the API is billed per million tokens (checked October 2026). See pricing

Related: Claude AI review

Verdict: the best fit if you want one vendor for clinicians' chat and your developers' agents.

Retell AI – best for phone agents on a budget

Retell AI is a platform for building AI phone agents that answer and make calls, and it offers a BAA even on its pay-as-you-go plan.

Strengths

Retell is blunt about not gating HIPAA behind a contract. A May 2026 post on Retell's blog says: "Every Retell account, including pay-as-you-go, can operate as a HIPAA-eligible workload once a BAA is in place." Its help centre article adds that the BAA covers your whole account, not single workspaces, and stays in effect until it's terminated.

User feedback is strong. Retell holds a 4.9 rating from 805 reviews on Trustpilot, where one reviewer wrote that "Where Retell really stands out compared to other providers is the reliability and uptime." Bear in mind those reviews are invited and Retell pays for a Trustpilot subscription. For a reminder or booking line at a busy practice, though, I'd probably start here.

Key features

• BAA available on pay-as-you-go accounts, with custom BAAs on Enterprise.
• PII redaction runs about a penny a minute and works on any plan, going by Retell.
• Choice of LLMs, including GPT and Claude models, priced per minute.
• 20 concurrent calls included on pay-as-you-go.

Retell AI pricing: No free plan; pay as you go from $0.07 to $0.31 per minute, with custom Enterprise pricing (checked October 2026). See pricing

Related: Best AI outbound calling tools

Verdict: the cheapest serious way to get a covered phone agent running this month.

Vapi – best for developer-built voice agents

Vapi is a developer platform for building voice AI agents, and it sells HIPAA-eligible data handling, with a standard BAA, as a monthly add-on.

Strengths

Vapi gives developers a lot of control: you pick the transcriber, model and voice, and model costs pass through with no markup. On Vapi's pricing page, the HIPAA compliance add-on includes "Standard Data Processing Agreement and Business Associate Agreement" for $2,000 a month. Honestly, that price surprised me next to Retell's approach. It makes sense for a funded health-tech startup; it's a lot for a three-doctor practice.

Third-party feedback is thin. Vapi's Trustpilot profile is unclaimed and shows a 2.5 rating from just 13 reviews, and Trustpilot notes the company hasn't invited customers, so the sample probably isn't representative.

Key features

• HIPAA add-on with a standard DPA and BAA for $2,000 a month.
• Success packages from $29 a month (Core) to $999 a month minimum (Pro).
• Unlimited agents, testing and call simulation on every plan.
• $0.05 per minute Vapi hosting, with providers billed at cost.

Vapi pricing: Free to start with $5 in credits, then usage-based hosting at $0.05 per minute plus a $2,000 monthly HIPAA add-on for BAA coverage (checked October 2026). See pricing

Verdict: pick Vapi if you need fine-grained control and the add-on fee is a rounding error for you.

Choosing the right AI agent platform with HIPAA BAA compliance

Check the BAA covers the exact feature you'll use

Vendors list covered services one by one. Anthropic excludes Skills and beta apps; Google warns against PHI in agent definitions; AWS limits PHI to eligible services. Before you build, write down every feature your agent touches and find each one on the vendor's list. If it isn't named, assume it isn't covered.

Match the plan, not just the vendor

"OpenAI signs BAAs" is true for the API and ChatGPT Enterprise, but not for ChatGPT Business. Claude's BAA exists for Enterprise and the API, not Pro or Max. Plan names matter more than brand names here, and I'd guess this is the most common mistake small clinics make.

Trace every hop your data takes

Agents call tools. A covered agent that sends a patient's details to an uncovered CRM, calendar or SMS service has just moved PHI outside the BAA. Each connector needs its own BAA or has to be kept away from PHI. If you're new to how agents chain tools together, our explainer on agentic AI covers the basics, and our guide on how to create an AI agent walks through a build.

Free vs paid: what you actually get

None of these platforms gives you a free plan that includes a BAA. The free bits are trial credits: $200 on AWS, $300 on Google Cloud, $5 on Vapi and a Copilot Studio trial. They're useful for building a prototype with fake data, and that's about it.

Paid access splits into three models. Usage-based clouds (AWS, Google, the OpenAI API) cost little at low volume but are harder to predict. Per-minute voice platforms like Retell price each call, which makes budgeting easy for a phone line. Then there are contract-based plans, such as Claude Enterprise, ChatGPT Enterprise and Vapi's add-on, where the BAA comes with a bigger fixed commitment. For a small practice, I think usage-based pricing with a self-serve BAA is probably the best value; larger health systems will likely want the contract route for the support and custom terms.

Final verdict

If you only pick one, pick Amazon Bedrock AgentCore: it's named on the official eligible list, the BAA is self-serve, and you pay only for what runs. Choose Copilot Studio if your organisation lives in Microsoft 365 and wants staff to build agents without code. Choose Retell AI if all you need is a covered phone agent and you don't want an enterprise contract. In my view, the vendor matters less than the homework: confirm the plan, confirm each feature, and get your compliance lead to read the BAA before any real patient data goes in.

FAQ

What is a HIPAA BAA for an AI agent platform?

A Business Associate Agreement is the contract HIPAA requires between a covered entity (or its business associate) and any vendor that handles protected health information for it. For an AI agent platform, it sets out how the vendor protects PHI your agent processes. Without one, you shouldn't send PHI to the platform at all.

Does signing a BAA make my AI agent HIPAA compliant?

No. OpenAI says accepting a BAA and enabling HIPAA support "do not, by themselves, make your application HIPAA compliant", and Microsoft and Google say much the same. The BAA covers the vendor's side. You still own access controls, configuration, risk analysis and making sure PHI only flows through covered services.

Can I get a BAA without an enterprise contract?

Yes, with several vendors. AWS lets you accept its BAA in AWS Artifact, OpenAI offers a self-serve API BAA to organisations with enough usage history, and Retell AI offers BAAs on pay-as-you-go accounts. Anthropic's API BAA and ChatGPT Enterprise BAAs need a sales contact.

Does ChatGPT or Claude sign a BAA on cheaper plans?

Not on the cheaper ones. OpenAI doesn't offer a BAA for ChatGPT Business, only for sales-managed Enterprise and Edu accounts (plus a separate flow for ChatGPT for Clinicians). Anthropic's HIPAA-ready offering isn't available on Claude Free, Pro, Max or Ultra; you need Claude Enterprise or the API.