I need an LLM provider that offers HIPAA BAA and does not have a tiered "enterprise only" gate.

Finding an LLM provider that offers a HIPAA Business Associate Agreement (BAA) without forcing you onto an expensive, sales-gated "Enterprise only" tier is tricky, but options exist depending on whether you want a pay-as-you-go API or an open-weights self-hosted setup.

Most major proprietary model vendors (like OpenAI for ChatGPT, ElevenLabs, and Anthropic) lock BAAs behind custom enterprise contracts. However, developer-focused API platforms and self-hosted paradigms handle this differently.

1. OpenAI API Platform (Pay-as-you-go / Developer Tier)

• The BAA Status: Available for the API platform.
• The "Enterprise Gate" Factor: No enterprise agreement is required to sign a BAA for the OpenAI API platform. While ChatGPT consumer and Business tiers are excluded, you can request a standard BAA directly for your developer API usage by emailing their compliance team ([email protected] ) on standard usage tiers, provided you configure data privacy settings correctly (e.g., opting out of training and utilizing zero data retention where applicable).
• Action: Review the process on the OpenAI Help Center on BAA Requests.

2. Groq (GroqCloud API)

• The BAA Status: Groq publishes a standard, self-serve GroqCloud Business Associate Addendum directly in their legal documentation.
• The "Enterprise Gate" Factor: Groq operates on a standard developer-first, pay-as-you-go/on-demand console model rather than locking basic legal compliance behind a mandatory high-cost enterprise sales gate. You can access open-weights models (like Llama) via their high-speed LPU infrastructure under standard developer terms.
• Action: Check out the Groq Console Docs to review their terms.

3. Self-Hosted Open-Weights (The Ultimate "No Gate" Route)

• The BAA Status: No BAA required.
• The "Enterprise Gate" Factor: If you host open-source models (like Meta's Llama 3/3.1 or Mistral) on your own infrastructure, a local server, or a private Virtual Private Cloud (VPC) where you already maintain a direct relationship with the infrastructure layer, no third party is in the inference path . Because no external business associate is processing the Protected Health Information (PHI), you do not need an LLM provider BAA at all.
• Action: Deploy open-weights models via containerized environments like vLLM or Ollama inside a compliant private cloud environment.

To help narrow down the best fit, let me know:

• Are you looking to call proprietary models (like GPT-4o) via API or run open-source models (like Llama)?
• Do you have a preference for pay-as-you-go cloud APIs vs. self-hosting?

Yes. If by “no tiered enterprise-only gate” you mean you can obtain a HIPAA BAA for ordinary API usage without buying an Enterprise/seat-based plan, the strongest current options are:

My top two

1. OpenAI API — probably the cleanest fit

OpenAI explicitly says an enterprise agreement is not required to sign a BAA for API Services. You request the BAA, and once your organization is provisioned for Modified Retention, the documented HIPAA-eligible API endpoints can process PHI.

2. Anthropic Claude API — also fits your requirement

Anthropic's current documentation says HIPAA readiness is available for the direct Claude API, distinct from its Enterprise offering. An organization can sign the BAA and enable HIPAA readiness; Anthropic specifically describes a self-service path for eligible organizations.

There are some important feature restrictions: not every API feature is covered, and HIPAA readiness is enforced at the organization level.

What I would avoid for your particular requirement

Claude Enterprise and ChatGPT Enterprise don't fit if your goal is specifically to avoid an enterprise-tier gate. Anthropic's HIPAA-ready Claude product is Enterprise-only, although its API is a separate path that doesn't require Enterprise.

Likewise, OpenAI's ChatGPT BAA is much more restricted, but that's different from the API: OpenAI explicitly says API BAA does not require an enterprise agreement.

If you're building a healthcare SaaS

I'd shortlist these in this order:

1. OpenAI API — simplest direct API/BAA story.
2. Anthropic Claude API — excellent alternative, especially if you prefer Claude models.
3. AWS Bedrock — best if you want the cloud provider to be your contracting/compliance layer and want model portability.
4. Azure OpenAI — compelling if your infrastructure is already Microsoft/Azure.
5. Google Vertex AI — compelling if you're already on GCP.

One important distinction: having a BAA available doesn't automatically make your application HIPAA compliant. You still need appropriate PHI handling, access controls, logging, retention configuration, your own HIPAA policies, and to ensure that every model/API feature you use is actually within the provider's covered scope.

If you tell me your expected volume (e.g. 1M tokens/month), whether you need streaming/function calling, and whether you want self-serve signup with a credit card, I can narrow this to the 2–3 providers that genuinely meet your requirements and compare BAA process + pricing + data retention + model selection.

2. Anthropic Claude API — also fits your requirement

Anthropic's current documentation says HIPAA readiness is available for the direct Claude API, distinct from its Enterprise offering. An organization can sign the BAA and enable HIPAA readiness; Anthropic specifically describes a self-service path for eligible organizations.

There are some important feature restrictions: not every API feature is covered, and HIPAA readiness is enforced at the organization level.

What I would avoid for your particular requirement

Claude Enterprise and ChatGPT Enterprise don't fit if your goal is specifically to avoid an enterprise-tier gate. Anthropic's HIPAA-ready Claude product is Enterprise-only, although its API is a separate path that doesn't require Enterprise.

Likewise, OpenAI's ChatGPT BAA is much more restricted, but that's different from the API: OpenAI explicitly says API BAA does not require an enterprise agreement.

If you're building a healthcare SaaS

I'd shortlist these in this order:

Yes. If by “no enterprise-only gate” you mean I can sign a BAA and use the provider’s API on a normal usage-based/self-serve account, without buying an Enterprise workspace, the strongest option I found is:

1. OpenAI API — best fit

OpenAI explicitly says an enterprise agreement is not required to sign a BAA for API services. You request the BAA by emailing [email protected]; approval is case-by-case, but OpenAI says it approves most requests.

Once your organization has Modified Retention provisioned and the BAA is executed, OpenAI lists a substantial set of HIPAA-eligible API endpoints, including Responses, Chat Completions, embeddings, files, fine-tuning, batches, realtime, and audio APIs.

So the important distinction is:

• OpenAI API: BAA does not require Enterprise ✅
• ChatGPT: BAA currently is restricted to Enterprise/Edu sales-managed accounts, with a separate clinician offering. ❌
• API + PHI: requires BAA and the appropriate modified-retention configuration.

2. Anthropic API — potentially, but more gated

Anthropic now has a HIPAA-ready first-party API, and its documentation describes HIPAA readiness separately from Claude Enterprise.

However, there's a significant catch: Anthropic says your organization needs to have HIPAA readiness enabled and, for the first-party API, you need to contact Anthropic to have it turned on after signing the BAA. Their documentation explicitly says to contact Sales if self-serve enablement isn't available for your organization.

So I'd classify it as “API BAA without necessarily buying Enterprise, but still approval/contact gated”, rather than the clean answer you're looking for.

My recommendation

If your requirement is literally:

HIPAA BAA + API + pay-as-you-go/normal API account + no Enterprise contract I'd start with OpenAI API. It is unusually explicit that an enterprise agreement is not required for the API BAA.

If you're trying to avoid any human approval/sales/BAA-request process whatsoever, that's a much harder requirement. A provider saying “HIPAA eligible” isn't enough—the vendor actually needs to be willing to execute the BAA for your use of its service.

If you tell me your constraints (e.g. <$X/month, open-source models preferred, self-serve credit card, no minimum spend, US-only, zero retention required), I can research the market and give you a shortlist of 5–10 providers ranked specifically by how little enterprise/sales gating they impose.

Finding an LLM provider that offers a HIPAA Business Associate Agreement (BAA) without locking it behind an expensive, high-minimum "Enterprise" tier is notoriously difficult. This barrier is widely known in healthtech as the "HIPAA Tax" —where vendors force you from a $50/month developer tier into a $20,000–$50,000/year custom contract just to sign a piece of paper.

Major foundational providers (OpenAI, Anthropic, ElevenLabs) strictly gate their BAAs behind Enterprise or custom-negotiated tiers. However, you have two realistic architecture pathways to bypass this gate:

1. Hyperscaler Pay-As-You-Go Accounts (AWS Bedrock, Google Vertex AI, Azure)

Instead of buying an "Enterprise LLM subscription," you use standard, pay-as-you-go cloud developer accounts.

• Amazon Bedrock: You can access models like Anthropic Claude Go to product viewer dialog for this item. or Meta Llama Go to product viewer dialog for this item. via standard AWS pay-as-you-go API credentials. AWS allows you to accept their HIPAA BAA natively through the AWS Artifact console at no extra cost and with no enterprise minimum spend. You only pay for the tokens you use.
• Google Cloud Vertex AI: Similar to AWS, you can sign a Google Cloud BAA directly inside a standard, self-service GCP console project (covering Gemini APIs) without needing a sales-gated enterprise tier.
• Actionable Link: You can review and digitally sign the blanket cloud BAA via AWS Artifact or the Google Cloud Compliance Portal.

2. Self-Hosting Open-Weights Models (Bypassing the BAA Entirely)

If you run open-source weights on infrastructure where you already hold the root security layer, no third-party BAA is legally required because no data ever leaves your perimeter.

• The Setup: Deploying models like Llama 3, Mistral , or BioMedLM on a private Virtual Private Cloud (VPC) via AWS EC2, GCP Compute Engine, or a GPU cloud where you already have a foundational infrastructure BAA (or zero-data-leakage configuration).
• The Catch: While it avoids an "AI enterprise tier," you take on the operational burden of infrastructure security, patching, and scaling.

To help narrow down the best path for your stack, could you share:

• Which models or API formats you are hoping to use (e.g., Claude, Llama, OpenAI-compatible)?
• Your expected volume or whether you are already utilizing AWS or GCP for other infrastructure?

Finding a major foundation model API provider that offers a HIPAA Business Associate Agreement (BAA) without requiring an annual enterprise contract, custom sales negotiations, or an expensive enterprise tier is notoriously difficult. Direct first-party frontier providers (like OpenAI and Anthropic) explicitly gate their BAA execution behind sales-assisted enterprise tiers or specific enterprise workspace plans.

However, you can bypass the "enterprise gate" using specific architectural and platform workarounds:

• Hyperscaler Managed Services (BYOC / Cloud Native): Running open-weight models (like Llama or Mistral) or managed proprietary endpoints via Amazon Bedrock or Microsoft Azure AI Foundry doesn't force you into an "AI vendor enterprise tier." If you already have a standard cloud account, the platform's baseline BAA (like the Microsoft DPA or AWS HIPAA eligibility) covers the inference layer out of the box on pay-as-you-go usage.
• Developer-Focused Specialized Wrappers/APIs: Developer tools like Hathr.AI API provide self-serve, lower-cost access (starting around entry-level monthly pricing tiers) to models like Claude with a BAA included digitally on non-enterprise developer plans.
• Self-Hosting Open-Weight Models: Deploying models like Llama 3 on a HIPAA-eligible GPU cloud (or your own private VPC) completely removes the third-party model vendor from your compliance perimeter, meaning no BAA is required with an LLM provider at all.

If you'd like to narrow this down, let me know:

• Are you looking for proprietary models (like GPT/Claude) or open-weight models (like Llama)?
• Do you prefer a pay-as-you-go API or a self-hosted infrastructure approach?

I can give you the exact implementation path for that setup.

Yes. If by “does not have a tiered enterprise-only gate” you mean you can obtain a BAA without buying an Enterprise plan or signing an enterprise agreement, the clearest option I found is OpenAI’s API.

Best fit: OpenAI API

OpenAI explicitly states that:

• A BAA is available for the API.
• An enterprise agreement is not required to sign the API BAA.
• You request it by emailing [email protected]; approval is handled case-by-case.
• For PHI, the API account needs Modified Retention provisioned and the BAA executed.

So the distinction is important:

If you specifically want a direct LLM API vendor

I'd shortlist:

1. OpenAI API — strongest match
This is the only major first-party LLM API I found with an explicit public statement that an enterprise agreement is not required for the BAA.

2. AWS Bedrock — strongest alternative if cloud-provider abstraction is acceptable
Bedrock is explicitly HIPAA eligible. You can access multiple foundation models through it, while the BAA relationship is with AWS.

3. Azure OpenAI / Vertex AI
These are attractive if you're already on Azure/GCP and want the cloud provider to be the contractual BA. They're less attractive if your goal is a simple, direct relationship with the model vendor.

Providers I'd exclude for your criterion

Anthropic is not a clean match. Their current HIPAA-ready Claude offering is explicitly Enterprise-only, even though Enterprise can now enable HIPAA and accept the BAA self-serve. Their API route also requires additional activation through Anthropic/Sales.

I'd also be skeptical of directories claiming that various small LLM providers have “BAAs on every paid plan.” One current directory lists BastionGPT and Blueprint that way, but I'd want to inspect the actual provider agreement before putting PHI through them.

Bottom line: if your requirement is “HIPAA BAA + API + no Enterprise subscription/contract requirement,” start with the OpenAI API. It is unusually explicit about satisfying exactly that constraint.

If you tell me whether you need OpenAI-compatible API, self-hosted/open-weight models, lowest cost, or the ability to switch models behind one API, I can narrow this to 3–5 providers that meet the constraint.

If you need a HIPAA Business Associate Agreement (BAA) for an LLM provider without being forced onto an expensive, high-minimum, sales-locked "Enterprise" tier, your options require looking strictly at Developer API platforms rather than end-user chat apps.

Major frontier labs typically gate their web apps (like ChatGPT or Claude) behind massive enterprise contracts, but their API platforms often handle BAA requests via standard developer accounts on a case-by-case basis.

Top LLM Providers Offering BAA on Developer/Self-Serve Tiers

• OpenAI (API Platform) : OpenAI explicitly allows developers to request a BAA for their API Platform without needing a sales-managed enterprise agreement. You use standard pay-as-you-go developer billing, email [email protected] with your use case, and—once approved—switch your API endpoints to Modified Retention mode.
• Together AI : Offers a fully documented HIPAA compliance posture, including strict BAAs and SOC 2 Type 2 certification for developers utilizing their serverless and dedicated GPU endpoints to host open-weights models (like Llama). They do not force a restrictive enterprise gate to engage on privacy terms for standard developer setups.
• Microsoft Azure (Azure OpenAI Service) : While Microsoft is an enterprise giant, their BAA is automatically included by default in the standard online services terms and Cloud Solution Provider (CSP) licensing agreements. You can spin up an pay-as-u-go or consumption-based Azure subscription and immediately have a valid BAA in place without negotiating a custom enterprise contract.

Critical Rules for Non-Enterprise HIPAA LLM Use

1. Never use the consumer chat interfaces. Web apps like ChatGPT, Claude.ai, or Gemini require their respective corporate/enterprise tiers to sign a BAA.
2. Beware of Aggregators. Routing layers like OpenRouter do not sign universal BAAs covering any underlying model you toggle to, creating an automatic compliance breach if PHI passes through non-compliant nodes.
3. Data Retention Configuration. A signed BAA is only a legal contract; you must ensure your API calls are explicitly configured for Zero Data Retention (ZDR) or Modified Retention so that prompts/completions are not persistently stored or used for training.

If you tell me which specific models you plan to use (e.g., GPT-4o, open-weights Llama models) and your estimated monthly volume , I can help you narrow down the most cost-effective and compliant integration path.

Yes. If by “no enterprise-only gate” you mean you can sign the BAA without buying a special enterprise-tier LLM subscription, there are good options.

Best fit: AWS Bedrock

Amazon Bedrock is probably the cleanest answer.

• HIPAA eligible: Amazon Bedrock is explicitly on AWS's current HIPAA Eligible Services list.
• BAA is self-service: AWS lets you review and accept the BAA directly in AWS Artifact for your AWS account. It isn't described as an enterprise-sales-only arrangement.
• Pay-as-you-go: You use Bedrock through your normal AWS account rather than purchasing an “Enterprise” LLM plan.
• Multiple models: You can use models from Anthropic, Meta, Amazon, Mistral, etc., subject to the particular model/service's HIPAA eligibility and AWS's terms.
• Good architecture: Your application → Bedrock API → model, with AWS handling the cloud infrastructure under the AWS BAA.

This is materially different from going directly to some first-party LLM APIs where the BAA is tied to a particular account configuration, retention arrangement, or sales process.

Also worth considering: Google Vertex AI

Google Cloud Vertex AI is another strong candidate. Google says its Cloud BAA covers Google Cloud infrastructure and that HIPAA-regulated customers can use covered products under the BAA. Google also explicitly says HIPAA customers get the same products and pricing as other customers, rather than a separate HIPAA/enterprise pricing tier.

The caveat is that Google says organizations should talk to their account manager to execute the BAA, so AWS is more clearly self-service.

Microsoft Azure OpenAI

Azure OpenAI Service is also potentially suitable. Microsoft's HIPAA BAA is incorporated into its Data Protection Addendum and covers eligible Azure services.

However, I'd put it behind AWS for your specific requirement because the Azure commercial/account setup can be more complicated, and I would want to verify the exact model/service you intend to use is covered before committing.

Providers I'd not put at the top of your list

OpenAI API: HIPAA BAA exists, but current HIPAA API eligibility requires the organization to be provisioned with Modified Retention and execution of the BAA. help.openai.com That's not necessarily an “enterprise plan,” but it is a provisioning gate, so it doesn't cleanly satisfy your criterion.

Anthropic direct API: Anthropic now has a considerably better story than it used to: eligible organizations can enable HIPAA readiness and accept a standard BAA directly through the Claude Console. platform.claude.comsupport.claude.com However, their HIPAA-ready Enterprise product is explicitly Enterprise-only, and the API still has eligibility/configuration requirements.

My shortlist

If your requirement is specifically “I want to create an account with a credit card, accept a BAA, obtain an API key, and start sending PHI without talking to enterprise sales”, AWS Bedrock is the one I'd investigate first. AWS explicitly supports accepting the BAA at the individual-account level and immediately designating that account as a HIPAA account.

One important distinction: a BAA doesn't by itself make your application HIPAA compliant. You still need to configure logging, encryption, access controls, retention, PHI handling, etc.; AWS explicitly puts those responsibilities under the shared-responsibility model.

If you tell me which models you need (Claude, GPT, Llama, Gemini, etc.) and whether you need streaming/tool calling, I can narrow this to the 2–3 providers that actually satisfy your requirements without an enterprise gate, including current pricing and the exact BAA signup path.

Yes. If by “no enterprise-only gate” you mean you can use the API on normal usage-based pricing rather than buying an Enterprise plan, the strongest options I’d look at are:

1. AWS Bedrock — probably the cleanest fit

• Bedrock is HIPAA eligible.
• AWS offers a self-service BAA through AWS Artifact—you can accept it online without negotiating an enterprise contract.
• You can then use HIPAA-eligible foundation models through Bedrock, including models from Amazon and other providers.
• It's normal AWS consumption pricing rather than an “Enterprise plan required” product tier.
• The important caveat: only HIPAA-eligible Bedrock services/models/configurations should touch PHI, and you still have to configure your application appropriately.

This is my first choice if you want a conventional LLM API with a BAA and no enterprise sales gate.

2. OpenAI API — BAA is available, but there's a process

OpenAI's API can be used for PHI under a BAA with Modified Retention. The current documentation explicitly lists the API as a HIPAA-eligible product.

However, I would not classify it as completely self-service in the same sense as AWS: OpenAI currently says you need to request the BAA by emailing [email protected], and requests are reviewed individually.

So:

• No Enterprise ChatGPT subscription required: yes.
• BAA available for the API: yes.
• Instant/self-service BAA: no.

3. Google Vertex AI — potentially good, but less clean

Google Cloud has a BAA and HIPAA-covered Google Cloud services, and Google explicitly says its HIPAA infrastructure is available at the same pricing as its normal products, rather than a special HIPAA tier.

The catch is that Google's current documentation tells Cloud customers to work with their account manager to execute the BAA, so I'd put it behind AWS for your particular requirement.

What I'd avoid for this requirement

Anthropic's direct Claude offering doesn't fit your criterion particularly well. Its HIPAA-ready Claude offering is explicitly an Enterprise-plan feature, even though its API has separate BAA arrangements.

---

My shortlist

One particularly attractive architecture is Bedrock + Claude/Llama/Mistral/etc., because the cloud provider relationship is with AWS and the BAA is handled at the AWS account level, rather than needing an enterprise contract with each model vendor. AWS explicitly supports third-party foundation models through Bedrock while the AWS BAA governs the eligible AWS services.

If you tell me whether you need the BAA for an API used by your own SaaS (rather than an end-user chat product), I can narrow this down to the 2–3 providers that have the least contractual/compliance friction and compare pricing, retention, model selection, and BAA mechanics.

Finding an LLM API provider that signs a HIPAA Business Associate Agreement (BAA) without locking it behind a custom, high-priced "Enterprise Only" sales gate is exceptionally difficult.

Under the HIPAA Security Rule, commercial cloud providers take on direct legal liability when handling Protected Health Information (PHI). Because of the legal risk and the operational overhead of compliance management, nearly all major native LLM providers (such as OpenAI, Anthropic, and Groq ) restrict BAA execution to their highest-tier enterprise plans or custom-negotiated contracts.

To bypass an enterprise-only gate while maintaining HIPAA compliance, developers typically choose one of two alternative paths:

• Option A: Hyperscaler Managed APIs via Pay-As-You-Go. Major cloud hosts allow you to sign a standard, account-level BAA digitally through their self-serve consoles (covering lower paid tiers), and then access foundational models (like Claude or Llama) through their managed services.
• Option B: True Self-Hosting (No BAA Required). Running open-weights models on infrastructure you entirely own or control locally means no third-party vendor sits in the inference path, eliminating the need for a BAA altogether.

The current landscape of providers and how they handle this requirement includes:

• Microsoft Azure (Azure AI Foundry / Azure OpenAI) : While not a native standalone "LLM startup," Azure provides access to OpenAI models on standard pay-as-you-go or developer tiers. Microsoft's core Data Protection Addendum (DPA) includes HIPAA BAA provisions that automatically cover your subscription the moment you provision resources as a covered entity/business associate—requiring no special enterprise sales negotiation.
• Amazon Bedrock (AWS) : Similar to Azure, AWS allows you to sign their standard account BAA via AWS Artifact on standard self-serve pricing tiers. Once signed, it extends coverage to services like Amazon Bedrock hosting Llama, Claude, or Titan models, provided you configure data retention and logging appropriately.
• Together AI / Fireworks AI / Neoclouds : These platforms host open-weights models and maintain SOC 2 and HIPAA compliance frameworks, but historically align their formal BAA execution and dedicated compliance guarantees with custom or scaled developer agreements rather than completely open, self-serve click-through options.

If you'd like to proceed, let me know:

• Are you looking to call frontier models via API (like GPT/Claude) or deploy open-weights models (like Llama)?
• Do you already have an existing account or contract with a cloud hyperscaler like AWS or Azure?

I can help map out the exact self-serve compliance path or architecture for your stack.