Can You Use ChatGPT for Clinical Documentation?

Can You Use ChatGPT for Clinical Documentation?

Only on the right tier. As of 2026, OpenAI will sign a Business Associate Agreement for ChatGPT for Healthcare and, on application, for the API — and it will not sign one for Free, Plus, Business or standard Enterprise. Without a BAA in place, protected health information cannot go into the prompt at all.

That single distinction decides almost every question people have about this. The model's drafting ability is not the constraint; the contract wrapped around it is.

This guide covers which products can take PHI and which cannot, what ChatGPT for Healthcare actually launched with, how a documentation workflow is built on it, the de-identification route for everyone else, and the limits that matter before anything touches a chart.

This is a general explainer and not legal or compliance advice. Your privacy officer and counsel decide what is permissible in your organisation.

The Short Answer

Where clinical documentation stands by product, in 2026:

• ChatGPT for Healthcare — launched January 2026 for hospitals, clinicians and researchers. OpenAI will sign a BAA with qualifying healthcare organisations, and content shared with it is not used to train OpenAI's models. This is the only ChatGPT surface built for clinical use.
• ChatGPT API — healthcare developers can apply for a BAA to embed the models in their own application. Approval depends on that surrounding application being HIPAA compliant.
• Free, Plus, Business and standard Enterprise — no BAA, so no PHI. These can still help with de-identified or non-patient work.
• ChatGPT Health — the consumer health experience inside standard ChatGPT. No BAA, so it cannot be used to process PHI, document care or support clinical decisions.

A BAA is the pivot because HIPAA requires one before a vendor may handle PHI on a covered entity's behalf. No BAA means the vendor is not a permitted business associate, whatever the product can technically do.

Your expertise is not the hard part — getting found is. Get a free SEO audit and see where your practice stands in search.

What ChatGPT for Healthcare Actually Is

OpenAI positions it as an enterprise offering for clinicians, administrators and researchers, priced on the ChatGPT Enterprise model. It is best understood as Enterprise plus a BAA, plus a set of healthcare-specific surfaces and some deliberate restrictions.

What It Supports

OpenAI describes drafting, summarising and differential reasoning as supported tasks, with clinical-search answers presented so that a clinician can verify them. Its own framing is unambiguous on where authority sits: final decisions always remain with the clinician.

That is the right mental model for documentation. The tool produces a draft that a clinician reads, corrects and signs. It does not produce a record.

The Integrations, and Their Limits

Two integration details are worth knowing before anyone plans a workflow around them:

• The Epic plugin is read-only, and it is not available with individual ChatGPT for Clinicians accounts. Read-only means it can inform a draft; it cannot write back to the chart.
• The Healthcare Public Data apps are read-only and do not access patient charts at all. They are for published datasets, not for your patients.

So nothing here writes to the medical record. Whatever the model drafts, a human moves into the EHR.

One Feature Explicitly Outside the BAA

Improved memory is off by default and is not covered by the BAA. OpenAI states plainly that PHI should not be entered when using that feature, and advises admins to review who has access before enabling it and to notify affected members.

This is the kind of detail that undoes an otherwise compliant deployment. A BAA covers only the eligible products and functionality OpenAI lists; it is not a blanket over everything in the interface. Read that eligibility list before you enable anything.

How a Documentation Workflow Gets Built

On a covered tier, the shape of a safe workflow is consistent:

1. Confirm the BAA is executed and that you know which products and features it covers
2. Configure the workspace — access controls, retention, audit logging, and any feature that falls outside the BAA switched off
3. Capture the encounter through whatever your organisation has approved for that purpose
4. Prompt for a structured draft — a SOAP note, a discharge summary, a referral letter — specifying the sections and the house format
5. Read the draft against the source, line by line, checking every clinical assertion, medication, dose and date
6. Correct and sign in the EHR, as the clinician of record
7. Log and review — sample outputs periodically to catch drift in quality or in behaviour

Step 5 is not a formality. It is the step that makes the rest defensible, and it is the step that gets dropped first when a clinic is busy.

Prompting for Notes That Need Less Editing

The quality of the draft is mostly a function of how much structure you give it:

• Name the format explicitly — Produce a SOAP note with Subjective, Objective, Assessment and Plan as separate headed sections
• State what must not be inferred — Do not add findings, diagnoses or medications that are not in the source material
• Ask for gaps to be surfaced — List anything a reviewer would need to confirm before signing
• Give it your template rather than letting it choose one
• Keep the output conservative in tone; hedged language is easier to correct than confident invention

The instruction to flag gaps is the most valuable one. A draft that ends with three open questions is far safer than a draft that quietly fills them.

Patients search before they call. Get a free SEO audit and find out what they see.

The De-Identification Route

There is a legitimate path for anyone not on a covered tier. De-identified data is not PHI under the HIPAA Privacy Rule, so once information has been de-identified by a method the rule permits, it can be used with ChatGPT-based services generally.

That is narrower than it sounds. De-identification is a defined standard, not a judgement call about whether a note "looks anonymous" — removing a name while leaving a rare diagnosis, an exact date and a small-town location may not meet it. The two permitted routes are the Safe Harbor method and expert determination, and both are specific.

Staff still need training on impermissible disclosure. The practical failure mode is not a misread of the regulation; it is a clinician pasting a real note into a consumer account to save five minutes.

What the de-identified route is genuinely good for:

• Drafting templates and standard phrasing for note types
• Rewriting patient-education material at a lower reading level
• Summarising published literature and guidelines
• Administrative text — policies, rotas, letters with no patient detail
• Learning what the tool is good at before a procurement conversation

When It Earns Its Place

Documentation support pays off where the burden is highest and the risk is lowest:

• Structuring material that already exists, converting a dictated account into a formatted note
• Summarising long records into a referral letter or handover, with the source open alongside
• Draft correspondence to patients and other clinicians, reviewed before sending
• Coding and billing support, as a prompt to the coder rather than a decision
• Reducing the after-hours charting tail, which is the specific burden clinicians most consistently report

It earns its place least where the output is the decision rather than the paperwork.

Limitations Worth Taking Seriously

Fabrication is the central clinical risk. A language model will produce a plausible normal exam finding, a plausible dose, a plausible date. In prose that reads fluently, an invented detail is harder to spot than an obvious error, not easier — and in a signed clinical record it is a patient-safety event, not a typo.

The clinician owns the record. OpenAI's own position is that final decisions remain with the clinician. A note signed off unread is the clinician's note, with all that follows from that.

A BAA is not compliance. OpenAI's healthcare product enables HIPAA-compliant use only with proper organisational configuration and governance. The agreement is one component; access control, training, audit and risk assessment are the rest.

Scope creep inside the product. Coverage applies to listed products and functionality. New features do not arrive pre-approved, and improved memory is the standing example of one that is explicitly excluded.

Consumer accounts are the real-world leak. The likeliest breach is not an exotic attack but a staff member using a personal Plus account on a busy afternoon. Policy plus a sanctioned alternative beats prohibition on its own.

Nothing writes to the chart. With read-only integrations, a human performs the final transfer — which is a safety feature, and also a workflow cost to plan for.

The regulatory picture keeps moving. Product names, tiers and eligibility have changed more than once already. Verify against OpenAI's own healthcare and HIPAA-eligibility pages rather than any third-party summary, including this one.

Good care, invisible online, still loses the patient. Get a free SEO audit and fix the gap.

How It Compares to Purpose-Built Scribes

ChatGPT for Healthcare is a general assistant with a healthcare wrapper. The ambient clinical documentation market is a different category, and the trade-offs run in both directions.

• Dedicated ambient scribes are built for one job: listen to the encounter and produce a note. They typically ship with EHR write-back, specialty-specific templates and clinical-safety tooling. If reducing charting time is the whole objective, that focus shows.
• General assistants cover the long tail — correspondence, summarisation, literature, administrative drafting — in one place, and do not need a separate contract per use case.
• Write-back is the clearest functional split. Read-only integration means manual transfer; a scribe built into the EHR does not.
• Procurement effort is comparable. Either way you are negotiating a BAA, running a risk assessment and training staff, so the general tool's breadth is worth weighing against the specialist's depth.

The deciding question is usually whether you want one vendor covering many tasks adequately, or one vendor covering the note exceptionally. If you are weighing the underlying platform, our guide to ChatGPT Enterprise and who it is actually for covers the tier that ChatGPT for Healthcare is priced and built on.

Final Thoughts

The answer is yes on a covered tier, and no everywhere else. ChatGPT for Healthcare and the API can be brought under a BAA; Free, Plus, Business, standard Enterprise and the consumer ChatGPT Health experience cannot, and so cannot take PHI.

Everything else follows from that. Get the agreement in place, learn exactly which features it covers, switch off the ones it does not, and treat every draft as something a clinician must read against the source before signing. The de-identified route is a real option for template and education work in the meantime.

The one thing not to do is assume that because the drafting is good, the governance is handled. The model will write a convincing note either way — whether or not anyone was allowed to give it the chart.

Be the practice that gets found first. Get a free SEO audit and see what is holding you back.