Tools our team has evaluated. What each is for, what it costs, and what each vendor will accept.
Start here
Claude (Pro, Team)Our pick
Reads the raw file and answers directly — no formulas to write first.
No BAA on Pro, Team, or Cowork — only on the API and HIPAA-ready Enterprise.
sourceChatGPT (Plus, Pro, Business)
No BAA on Plus, Pro, or Business — not even the paid Business tier.
sourceFreedOur pick
Covered by a BAA from the moment you sign up, with no procurement cycle to get through.
BAA is part of the platform terms, covered from account creation. Larger organisations can request a separate signed agreement.
sourceChatGPT for CliniciansOur pick
The only route here that covers an individual clinician without a sales conversation.
Separate in-product BAA flow for eligible individual clinicians — no sales-managed account required.
sourceClaude Enterprise (HIPAA-ready)
Covered once the Primary Owner activates HIPAA. Chat, Projects, Artifacts, Voice, Search, Research and Skills are in; Computer Use, Web Fetch, Files and Batch APIs are not.
sourceClaude API
Messages API and related endpoints eligible once a BAA is signed via sales. Covered models require 30-day retention, not zero data retention.
sourceThe rest of the toolkit
What each vendor will accept, what it costs, and who is allowed to sign up. Every posture claim is dated, sourced, and scoped to the plans it actually covers.
Prompts to copy and paste, each with a note on what belongs in it and what does not.
A BAA only matters if you need one. Which regimes typically govern which kind of reader, and the primary sources behind each one.
We review this list monthly. You’ll hear from us only when something changes.
Roughly monthly. Unsubscribe anytime.