← The Health AI Toolkit

The AI tool directory

Vendor facts only, each one dated and linked to the vendor's own terms. Nothing here is a statement about what you are allowed to do.

Directory

All 19 tools

Tool data postures reviewed by Hillary Lin, MD — dates shown per claim.

AI tools, what each is for, its data posture, and who can access it
ToolBest forData postureAccessCost
OpenAI APIBuilding your own tool or workflow on GPT models
Will sign a BAAVerified 2026-08-06 · scope and source

BAA on request by emailing baa@openai.com — no enterprise agreement needed. Most API services covered, with a few exceptions.

source
AnyoneUsage-based
ChatGPT (Plus, Pro, Business)General writing, explaining, and summarising
No BAA — de-identify firstVerified 2026-08-06 · scope and source

No BAA on Plus, Pro, or Business — not even the paid Business tier.

source
Anyone$20/mo
ChatGPT for CliniciansClinical work in ChatGPT without an enterprise contract
Will sign a BAAVerified 2026-08-06 · scope and source

Separate in-product BAA flow for eligible individual clinicians — no sales-managed account required.

source
Verified cliniciansSee vendor
ChatGPT Enterprise / EduOrganisation-wide rollout with administrative control
Will sign a BAAVerified 2026-08-06 · scope and source

BAA only for sales-managed Enterprise or Edu accounts. Self-serve sign-up does not qualify.

source
Enterprise salesContact sales
Claude (Pro, Team)Long documents, protocols, and drafting in a careful voice
No BAA — de-identify firstVerified 2026-08-06 · scope and source

No BAA on Pro, Team, or Cowork — only on the API and HIPAA-ready Enterprise.

source
Anyone$20/mo
Claude Enterprise (HIPAA-ready)Team rollout where the work itself involves patient information
Will sign a BAAVerified 2026-08-06 · scope and source

Covered once the Primary Owner activates HIPAA. Chat, Projects, Artifacts, Voice, Search, Research and Skills are in; Computer Use, Web Fetch, Files and Batch APIs are not.

source
Enterprise salesContact sales
Claude APIBuilding your own tool or workflow on Claude models
Will sign a BAAVerified 2026-08-06 · scope and source

Messages API and related endpoints eligible once a BAA is signed via sales. Covered models require 30-day retention, not zero data retention.

source
AnyoneUsage-based
Claude CodeBuilding a small internal tool, or getting answers out of a messy file
Will sign a BAAVerified 2026-08-06 · scope and source

Covered under a BAA with zero data retention enabled. Remote mode, the web version, and the review and security tools are excluded.

source
Anyone$20/mo
FreedDrafting the visit note while you talk
Will sign a BAAVerified 2026-08-06 · scope and source

BAA is part of the platform terms, covered from account creation. Larger organisations can request a separate signed agreement.

source
Anyone~$99/mo
Gemini (consumer)General assistance on a free or personal Google account
No BAA — de-identify firstVerified 2026-08-06 · scope and source

No BAA on a personal Google account. Gemini is Included Functionality under Google’s HIPAA Business Associate Addendum only for a signed Google Workspace or Cloud Identity account — see Gemini in Workspace.

source
Anyone$20/mo
Gemini in WorkspaceAssistance and embedded AI features inside a managed Google Workspace account
Will sign a BAAVerified 2026-08-06 · scope and source

Covered once a Workspace or Cloud Identity admin signs Google’s Business Associate Addendum. The Included Functionality list names the "Gemini app" and "Gemini in Workspace" specifically, and excludes Gemini in Chrome. Needs an organisation-managed account, never a personal Google account.

source
Enterprise salesIncluded in Workspace plans
OpenEvidenceClinical questions answered from the published literature
Will sign a BAAVerified 2026-08-06 · scope and source

Standard BAA covers any covered entity that transmits PHI — the same free, NPI-verified account every clinician signs up for, not a separate tier.

source
Verified cliniciansFree
ConsensusAnswering “does X actually help with Y?” from published studies
No BAA — de-identify firstVerified 2026-08-06 · scope and source

No BAA, HIPAA, or PHI mentioned in Consensus’s Privacy Policy, Terms of Service, or Security FAQ, on any plan. It commits to anonymising queries and never training on them.

source
AnyoneFree tier
ElicitScreening and extracting from a large set of papers
No BAA — de-identify firstVerified 2026-08-06 · scope and source

No BAA, HIPAA, or PHI in Elicit’s Terms of Service, Privacy Policy, or Data Processing Addendum — the DPA, for Team and Enterprise customers, covers GDPR/CCPA only.

source
AnyoneFree tier + paid
NotebookLMInterrogating a stack of documents you already trust
No BAA — de-identify firstVerified 2026-08-06 · scope and source

Absent from Google’s HIPAA Included Functionality list on every account type — even Workspace and Cloud Identity customers with a signed Business Associate Addendum for Gmail and Drive. Its own privacy and terms page makes no BAA or HIPAA claim.

source
AnyoneFree
AbridgeDrafting the visit note while you talk
Will sign a BAAVerified 2026-08-06 · scope and source

BAA is part of Abridge’s standard contract with Covered Entity customers. No self-serve tier — every engagement is a sales-managed health-system contract.

source
Enterprise sales$250–500/mo
HeidiAmbient note-taking for solo and small practices
No BAA — de-identify firstVerified 2026-08-06 · scope and source

The default "Heidi Scribe Terms of Use" (Free and self-serve Clinician-plan sign-ups) lists GDPR, CCPA, and PIPEDA — never HIPAA or a BAA. A Business Associate Subcontractor Agreement exists only in a separate "Clinic agreement"; Heidi’s own pages don’t say which paid plan moves a customer onto it.

source
AnyoneFree tier + ~$110/mo
Microsoft 365 CopilotAI already inside Word, Excel, Outlook and Teams for a practice on Microsoft 365
Will sign a BAAVerified 2026-08-06 · scope and source

Microsoft 365 Copilot and Microsoft 365 Copilot Chat are named in-scope services for Commercial and GCC Office 365 customers, covered by default under the Microsoft Online Services Data Protection Addendum — no separate sales BAA needed once an organization is a covered-entity or business-associate customer. Needs a commercial or GCC-managed tenant; a personal Microsoft account is not in scope.

source
Enterprise salesCopilot Chat included; full Copilot ~$30/user/mo add-on
Notion AIQ&A, writing, and search inside a Notion workspace already used for docs and wikis
No BAA — de-identify firstVerified 2026-08-06 · scope and source

A BAA is available only on the Enterprise plan, so no other plan is covered at all. On Enterprise, Notion states that "Any Beta Services are not covered by the BAA" but does not say whether Notion AI counts as one — its own page leaves the AI unaddressed.

source
AnyoneAI add-on on paid plans

What this column is. Each vendor’s published terms as of the date shown — not a statement about your obligations. Terms change; verify before you rely on it. Not legal advice.

Not yet reviewed

These came up in research. No data posture has been verified for them.

  • Gemini on Vertex AIBuild & automate

    Calling Gemini models by API to build a tool or workflow

  • Zoom AI CompanionAssistants

    Meeting summaries, chat drafting, and email summaries inside Zoom

  • Slack AIAssistants

    Search, thread summaries, and daily recaps inside a Slack workspace

  • Hippocratic AIPractice ops

    Patient-facing voice calls for intake, follow-up, and reminders

  • DermaSensorImaging

    Point-of-care assessment of a suspicious skin lesion

Whether any of this applies to you depends on who you are. A BAA only matters if you need one, and plenty of people working in health are not covered entities — which is not the same as having no obligations. Who this applies to →