Is Claude Code HIPAA Compliant? Using AI Coding Agents on Healthcare Codebases

Claude Code can be covered by Anthropic’s Business Associate Agreement, but only in specific setups. As of October 2026, that means a Claude for Enterprise organization with HIPAA enabled and the separate “HIPAA configuration” applied to Claude Code, or an organization with zero data retention (ZDR) enabled for Claude Code; Free, Pro, Max and Team plans can’t enable HIPAA at all. Even inside a covered setup, the VS Code and JetBrains extensions, cloud sessions, MCP servers and connectors, and Claude Code routed through Amazon Bedrock, Google Cloud or a gateway sit outside Anthropic’s BAA. For most engineering teams the practical rule is simpler: keep PHI out of the agent’s reach and work on synthetic data.

1. The Short Answer, With Sources

Claude Code runs on your machine, but every prompt, file excerpt and tool result it sends to the model leaves it. Anthropic’s data usage page says that traffic “includes all user prompts and model outputs.” If any of that is PHI, Anthropic is receiving PHI and you need a BAA that covers the exact way you use Claude Code.

2. Route 1: Enterprise HIPAA Configuration

Anthropic made HIPAA-ready products a headline of its January 2026 healthcare announcement, which said HIPAA-compliant organizations “can now use Claude for Enterprise.” For Claude Code, getting there is two steps, both done by the organization’s Primary Owner:

1. Enable HIPAA for the organization. In Organization settings > Data and privacy, the Primary Owner reviews and accepts the BAA and the Implementation Guide (steps). Anthropic notes this is one-way and can’t be reversed from settings. On its own, it brings chat under the BAA, not Claude Code or Cowork.
2. Apply the HIPAA configuration to Claude Code (local mode) and Cowork (local mode). The button stays greyed out until your Anthropic account team turns it on, so organizations without an account team can’t apply it (Anthropic’s setup article).

Applying the configuration changes what developers can do. Per the same article: cloud sessions end and Claude Code on the web becomes unavailable; Remote Control turns off; connectors are switched off and their tool permissions set to Blocked; skills and Claude in Chrome turn off; the built-in GitHub integration turns off. Developers must update to a minimum Claude Code version, and each one can confirm coverage by running /status, which should show HIPAA. Anthropic says members shouldn’t process PHI until they see it.

Two operational details matter for your risk analysis:

• Local transcripts. Claude Code stores session transcripts locally, in plaintext under ~/.claude/projects/, for 30 days by default (cleanupPeriodDays changes it) (data usage). Anthropic’s setup article tells you to keep full-disk encryption on and wipe machines when people leave. If PHI ever enters a session, it is on the laptop too.
• Monitoring. The Compliance API captures Claude Code session content under the HIPAA configuration, readable for 30 days. If you export OpenTelemetry events, Anthropic warns that Cowork events include prompts and responses by default, so PHI can reach your monitoring stack unless IT disables content capture.

3. Route 2: Zero Data Retention

With ZDR, Anthropic says prompts and responses “are processed in real time and not stored by Anthropic after the response is returned, except where needed to comply with law or combat misuse” (Claude Code ZDR). There are two ZDR offerings that cover Claude Code:

• ZDR for Claude Code on Claude for Enterprise, available to qualified accounts, not included in the standard Enterprise plan, and enabled by Anthropic per organization.
• ZDR on the Claude API, which covers Claude Code used with API keys from a commercial organization that has a ZDR arrangement (API and data retention).

Things to know before choosing ZDR:

• Features are disabled: cloud sessions, Remote Control, artifacts and /feedback submission are blocked at the backend.
• Some models aren’t available. Anthropic’s Covered Models (Claude Fable 5.1 and Fable 5 in Claude Code’s docs) require 30-day retention and aren’t available under ZDR unless Anthropic expressly authorizes it.
• Flagged sessions can be kept. If a session is flagged for a Usage Policy violation, Anthropic may retain inputs and outputs for up to 2 years.
• Personal logins aren’t covered. ZDR applies only to requests authenticated into the ZDR organization. Anthropic recommends the forceLoginMethod and forceLoginOrgUUID managed settings so developers can’t sign in with a personal account.
• The two routes don’t stack neatly. Anthropic says the HIPAA configuration is meant to replace ZDR for Claude Code; talk to your account team before applying it if you already have ZDR.

4. What Is Not Covered, Even on Enterprise

From Anthropic’s BAA article and HIPAA configuration article:

None of this is unusual. Cursor, Copilot and other coding agents have their own versions of these limits; our Cursor HIPAA checklist for healthcare engineers covers the equivalent questions for Cursor.

5. Bedrock and Google Cloud Routes

Claude Code can use Claude models through Amazon Bedrock or Google Cloud, and Anthropic’s BAA explicitly doesn’t cover those sessions. That doesn’t automatically rule them out; it moves the question to the cloud provider. Anthropic’s data retention docs say that on Bedrock and Google Cloud “the cloud provider is the data processor.”

• AWS. Amazon Bedrock is on AWS’s HIPAA eligible services list (updated 3 September 2026), which applies once you have signed the AWS BAA. AWS’s page doesn’t say anything model-specific, so confirm with AWS that the Claude models and regions you use are in scope.
• Google Cloud. Google’s HIPAA covered-services list includes “Generative AI on Agent Platform,” but doesn’t mention partner models or Claude. We could not confirm from Google’s pages that Claude on Google Cloud is covered; ask Google in writing.

Also note that the Claude Code client still has its own behaviour on these routes. Telemetry, error reporting and /feedback are off by default on Bedrock and Google Cloud, but session-quality surveys and the WebFetch hostname safety check still run (data usage). Neither sends prompt content by default, but it is worth knowing for a network review.

6. Safe Practice on a Healthcare Codebase

Most of the time, an AI coding agent doesn’t need PHI. It needs your schema, your code and realistic-looking data. Set things up so a mistake can’t put patient data in a prompt:

1. Don’t paste PHI into prompts. No real names, MRNs, dates of birth or chart excerpts, even “just to reproduce a bug.” Recreate the bug with fake values.
2. Work on synthetic or de-identified data. Seed development databases with generated records. If you de-identify real data, follow HHS’s de-identification guidance (Safe Harbor or Expert Determination); removing names alone isn’t enough.
3. Keep production credentials off developer machines. If the agent can run psql against production, it can read PHI into the session. Give it a local or staging database with synthetic data.
4. Block reads of data and secret files with Claude Code permission rules: exports, fixtures copied from production, .env files.
5. Be careful with MCP servers. A database, ticketing or log-search MCP server can pull PHI into context, and MCP is outside Anthropic’s BAA.
6. Use company accounts only. On a covered plan, force login to your organization. On an uncovered plan, the safe assumption is that nothing in the session is protected by a BAA. Consumer accounts that allow training data use are retained for 5 years; 30 days if not (data usage).
7. Turn off what you don’t need. DISABLE_FEEDBACK_COMMAND=1 stops /feedback sending transcripts; CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC disables non-essential traffic in one setting.
8. Review generated code for HIPAA controls. An agent will happily write console.log(patient). Check logging, access checks, encryption and audit logging in review, the same as human code.
9. Write it down. Add AI coding tools to your risk analysis and your vendor list, including which plan and which route you use.

7. Where VertiComply Fits

VertiComply generates full-stack healthcare apps (web and native iOS/Android) with encryption, audit logging, role-based access control and session timeouts in the generated code on every plan, so those controls aren’t left to whatever an agent remembers to write. It signs a BAA on request on all paid plans (Pro $89/month, Business $249/month, Enterprise $349/month), not on Free, and Pro and above include code export, so your team can keep working on the code in Claude Code or any other editor. VertiComply does not hold a SOC 2 or HITRUST attestation. See our BAA page for the terms, and our HIPAA gap list for AI-built apps for what to check in any generated codebase.

Frequently Asked Questions

Is Claude Code HIPAA compliant?

Claude Code can be covered by Anthropic’s BAA only on Claude for Enterprise with HIPAA enabled and the HIPAA configuration applied, or with zero data retention enabled for Claude Code. It must be the terminal CLI or the Desktop Code tab connecting directly to Anthropic. HIPAA compliance also depends on how your team uses it.

Can I use Claude Code with PHI on a Pro or Max plan?

No. Anthropic says Team plans and individual plans (Free, Pro and Max) can’t enable HIPAA, so there is no BAA. On those plans, keep PHI out of prompts, files the agent can read, and any tool output it sees.

Does Anthropic’s API BAA cover Claude Code?

Not through API HIPAA readiness alone. Anthropic’s API documentation states that Claude Code is not covered under HIPAA readiness. Claude Code used with a Console API key is covered only when that organization has zero data retention enabled.

Are the VS Code and JetBrains extensions covered?

No. As of October 2026 Anthropic lists the VS Code and JetBrains extensions as outside the BAA, even on a HIPAA-configured Enterprise organization. Only the Claude Code CLI and the Code tab in Claude Desktop are covered under the HIPAA configuration.

Can I use Claude Code through Amazon Bedrock for HIPAA work?

Anthropic’s BAA does not cover Claude Code through Bedrock. Amazon Bedrock is on AWS’s HIPAA eligible services list under the AWS BAA, so coverage there depends on your AWS agreement. Confirm with AWS that the models and regions you use are in scope before any PHI is involved.

What is the safest way to use AI coding agents on a healthcare codebase?

Keep PHI away from the agent entirely. Use synthetic or properly de-identified data, keep production credentials and data exports off developer machines, block sensitive files with permission rules, avoid MCP servers that can reach production data, and review generated code for logging, access control and audit trails.

Last reviewed 12 October 2026. Anthropic’s eligible-services list and plan terms change; check the Implementation Guide on Anthropic’s Trust Center and the Claude Code legal and compliance page for the current position. Nothing here is legal advice on whether HIPAA applies to a specific product.