Anthropic Details Segmented HIPAA Compliance for Enterprise and Claude Code

Anthropic offers Business Associate Agreements for specific AI services, not every Claude interaction. [2] Enterprise Primary Owners must accept the BAA and activate HIPAA readiness. [2] API documentation describes eligible organizations accepting a standard BAA in Console settings, while the Privacy Center still instructs customers to contact sales for API activation. [2] The feature table identifies Enterprise coverage under versions accepted after December 2, 2025 and specified API features after April 1, 2026. [2]

Claude Code CLI and Desktop local mode require a qualifying account, applicable BAA and separately enabled ZDR. [2] Enterprise HIPAA activation alone does not cover Claude Code. [2] Covered Models require 30-day retention and generally cannot use ZDR. [2] Third-party connector, browser and external MCP data flows are outside Anthropic's BAA. [2]

The nuanced rollout of HIPAA readiness highlights the complexity of healthcare compliance in generative AI tools. Rather than providing blanket platform certification, Anthropic’s approach segments coverage by interface and timeline, differentiating Enterprise coverage following the December 2, 2025 version from specified API features active after April 1, 2026. Organizations must actively manage their configurations, as features like the Claude Code CLI demand distinct Zero Data Retention activation, while Covered Models simultaneously require a 30-day retention period. Furthermore, the explicit exclusion of external MCP data flows places the burden of third-party risk management entirely on the user. What the sources don't address: Whether Anthropic plans to reconcile the conflicting API activation instructions between its Console and Privacy Center.