Consumer ChatGPT is not covered by HIPAA. That includes the free version, Plus, Pro, and the Health features that rolled out to US users in July 2026. Whatever you type about your mother's diagnosis sits outside the legal framework that governs her doctor's office.

That answer is less alarming than it sounds once you understand why. HIPAA is a rule about specific kinds of organizations, and OpenAI is not one of them. Knowing where the line falls lets a family use AI for the things it does well while keeping the sensitive material somewhere it belongs.

Why ChatGPT falls outside HIPAA

No, it is not compliant, and the reason is structural. HIPAA applies to three categories: health care providers, health plans, and the business associates those organizations contract with. A hospital is covered. An insurer is covered. A billing vendor under a Business Associate Agreement is covered.

A consumer chatbot is none of those things. OpenAI has no HIPAA relationship with you, which means the protections you would expect from a patient portal do not apply. There is no Business Associate Agreement, no breach notification obligation to you, no required audit trail of who looked at what, and no enforcement path through the Office for Civil Rights if something goes wrong.

Worth noting on language: "HIPAA compliant" is how people search for this, though the precise term is "covered entity." Nothing about ChatGPT can be made HIPAA compliant by a setting you toggle. The status comes from what kind of organization is on the other end.

Does Health in ChatGPT change the answer?

It does not. OpenAI announced a limited waitlist version in January 2026 and rolled it out broadly on July 23, 2026 under the name Health in ChatGPT, available to logged-in US users 18 and older on web and iOS across the Free, Go, Plus, and Pro tiers.

It connects to real health data. Apple Health, US medical records through a partner called b.well, One Medical, Function Health, and a range of wellness apps. Medical record connections are US only, and they were excluded at launch in the EU and EEA, Switzerland, and the UK.

A health-specific interface that pulls in your medical records feels like it should carry medical-grade protections. It does not. Health in ChatGPT is a consumer feature. OpenAI states that it is designed to support rather than replace medical care and that it is not intended for diagnosis or treatment.

The HIPAA-oriented product is separate. OpenAI for Healthcare and ChatGPT for Clinicians launched January 8, 2026 for health systems and clinicians. Those are enterprise products sold to organizations, and the app on your phone is not part of that track.

What does OpenAI actually do with health information?

The published terms are more protective than most people assume:

•   Health conversations are not used to train foundation models.

•   Records you connect are not used for training or for ad targeting.

•   Disconnecting a data source deletes the synced data within 30 days.

So training is not the main risk. The main risk is that none of those commitments are HIPAA obligations. They are company policy, and company policy can change, be reinterpreted, or be overridden by a court.

That last point has a real precedent. In the New York Times litigation against OpenAI, a May 13, 2025 preservation order required the company to retain chat logs, including ones users had deleted. That order was terminated on October 9, 2025, and in November 2025 the court ordered production of 20 million de-identified chat logs. Deleting a conversation is a request to a company, and the company does not always have the final say.

What counts as protected health information in a chat?

More than most people think. The identifiers that turn a general question into a health record include:

•   A person's name, initials, or a description specific enough to identify them

•   Date of birth or exact age combined with other details

•   A diagnosis, procedure, or medication tied to a named person

•   Provider names, facility names, and appointment dates

•   Contents pasted from a document: lab results, discharge summaries, insurance cards

The risk compounds across a family. If one sibling pastes lab results, another shares a discharge summary, and a third asks about prescriptions by name, the family has assembled a detailed health profile in an unprotected space without anyone making a single deliberate decision to do so.

How should families use AI for health questions?

The workable rule is to separate general education from personal specifics. General questions are what these tools are good at, and they carry no privacy cost.

Useful and safe:

•   "What does ejection fraction mean in a heart test?"

•   "What questions should I ask a cardiologist at a first appointment?"

•   "What is the difference between palliative care and hospice?"

•   "How do I help someone with early-stage dementia stay engaged during the day?"

Rework before you send:

•   Instead of pasting a medication list and asking about interactions, look up each drug on its own and bring the question to the pharmacist

•   Instead of pasting a discharge summary, ask what the procedures and terms in it mean

•   Instead of naming your parent, describe the situation generically

The jargon is dense and the AI answers instantly, which makes pasting everything in the path of least resistance. Agreeing on the line in advance is easier than policing it later. One short conversation with your care network, something like "general questions are fine, no names or documents," prevents most of the problem.

Where should your family's health information live instead?

Somewhere built for it. Group texts, email attachments, and a folder on one person's laptop are more private than a chatbot and worse at nearly everything else.

Documents. Neela's Vault is HIPAA compliant and shared across your care network, so insurance cards, advance directives, and discharge paperwork live in one place instead of one person's inbox.

Questions about your own situation. Neela's Chat answers in plain language using your family's actual care context, inside an environment built for health information. That is the same convenience families reach for in a consumer chatbot, without putting the details somewhere unprotected.

Appointments. Scribe records a visit on your phone and produces a transcript and a written summary. Audio is not stored, and the feature is mobile only. You get a text record you can search and share, which removes the temptation to reconstruct the visit in a chatbot afterward.

Tasks and updates. Shared tasks and notes keep everyone working from the same version of events.

For official clinical records, your loved one's patient portal is still the source of truth. If their health system uses MyChart, test results and provider messages belong there.

Frequently asked questions

Is ChatGPT HIPAA compliant?

No. HIPAA covers health care providers, health plans, and their contracted business associates. A consumer chatbot falls into none of those categories, so the protections that apply to your doctor's office do not extend to a chat window.

Is Health in ChatGPT HIPAA compliant?

No. Health in ChatGPT, which rolled out broadly on July 23, 2026, is a consumer feature. Connecting Apple Health or your medical records to it does not create a HIPAA relationship. The HIPAA-oriented products, OpenAI for Healthcare and ChatGPT for Clinicians, are separate and sold to health systems.

Is ChatGPT Plus or Pro more private than the free version?

Not in the way that matters here. The HIPAA status is identical across Free, Go, Plus, and Pro. Paying for a consumer subscription does not turn OpenAI into a covered entity.

Can I upload my parent's medical records to ChatGPT?

You can, technically, and it is worth understanding what you are accepting. Once a discharge summary or lab report is in a consumer chat, it sits outside HIPAA, with no breach notification obligation to you and no audit trail. For documents specifically, a HIPAA-compliant storage option is the better home.

Does OpenAI use my health conversations to train its models?

No, according to OpenAI's published terms. Health conversations are not used to train foundation models, and connected records are not used for training or ad targeting. Those are company commitments rather than legal obligations under HIPAA.

Can I delete health information I already put into ChatGPT?

Mostly. You can delete conversations, and disconnecting a data source removes the synced data within 30 days. The New York Times litigation showed the limit of that: a May 13, 2025 preservation order required OpenAI to retain logs including deleted ones, and it stayed in force until October 9, 2025.

Is it illegal for me to put my parent's health information into ChatGPT?

HIPAA regulates covered entities and their business associates, so it does not govern what a family member types into a consumer app. Other agreements or state privacy laws may still apply, and Neela is not a law firm, so treat this as background rather than legal advice.

Is Neela HIPAA compliant?

Yes. Neela is built to handle health information for families, which is why documents, appointment summaries, and care details can live there instead of in a general-purpose chatbot.

The short version

Consumer ChatGPT is a capable explainer and a poor filing cabinet. Use it to understand terminology, prepare for appointments, and make sense of what you heard. Keep names, documents, and anything tied to a specific person somewhere with actual obligations attached.

If you want your family's care information in one secure, organized place, Neela can help. From doctor visit summaries to medication lists and shared documents, she keeps your care network working from the same information. Try Neela free for 7 days, no credit card required.