Free, Go, Plus & Pro: No BAA · Trains on your data by default, opt-out is forward-only
Business: No BAA · Does not train on your data by default
Enterprise: Not HIPAA-eligible as standard · OpenAI's HIPAA-eligible list names Regulated Workspace, a separate configuration
None of these three tiers appear on OpenAI's HIPAA-eligible products list. The eligible products are named separately: ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT for Clinicians, ChatGPT FedRAMP, and two API configurations — not standard Enterprise.
| Free, Go, Plus & Pro | Business | Enterprise | |
|---|---|---|---|
| HIPAA BAA | Nono consumer tier appears on OpenAI's HIPAA-eligible products list | NoChatGPT Business does not appear on OpenAI's HIPAA-eligible products list | Not as standardOpenAI's HIPAA-eligible list names "ChatGPT for Enterprise with Regulated Workspace," not standard Enterprise. Several features are excluded from BAA coverage, including workspace agents with agent-owned connections, browser use for Work in the cloud, Sites, improved memory, and event-triggered scheduled tasks |
| Trains on your data | Yesby default - "ChatGPT... improves by further training on the conversations people have with it, unless you opt out." Opt-out via the privacy portal applies to new conversations only | No"We do not train our models on your data by default"; only if explicitly opted in | Nonot by default |
| Survives deletion | The opt-out is forward-only - OpenAI's documentation does not state what happens to content already used in training | Admins control retention; deleted conversations are removed within 30 days | Customer controls retention |
| Deployer / admin log access | Nodeployer access - consumer accounts are individual, not workspace-managed | Yesadmin retention and workspace controls | Yesadmin and workspace controls |
| Third-party attestation | SOC 2 Type 2 is stated for the business products; not stated for consumer tiers | YesSOC 2 Type 2 | YesSOC 2 Type 2 |
ChatGPT Business, which does not train by default. Note the lineup changed - Go and Pro are current consumer tiers, and no "Team" or "Teams" tier exists
ChatGPT Enterprise, and the broader assumption that any paid business tier carries a BAA - neither Business nor standard Enterprise is HIPAA-eligible
The belief that ChatGPT Enterprise carries a BAA. It is the Regulated Workspace configuration that is HIPAA-eligible, not Enterprise as sold
Vendor terms change without notice. This page reflects what ChatGPT published as of September 3, 2026. Re-verified quarterly.
If you need a scored Go / Conditional Go / No-Go verdict for a vendor decision — including a vendor not listed here — that's an AI Vendor Risk Assessment: three binary industry gates, nine scored criteria, four provenance fields on every finding. $997, delivered in 48 hours.
See how AVRA works →Want all 13 tools in one file?
Covers 22 tiers across 13 tools — same sourcing, side by side, printable for a vendor file.