Fact · Voice privacy and security
OpenAI says that customers who have signed its Business Associate and Healthcare Addendum can use BAA-eligible endpoints to process protected health information once their organization is provisioned for Private Retention, even if data is retained.
Checked against its source on October 17, 2026
In the source's own words
“For customers who have executed an OpenAI Business Associate and Healthcare Addendum, once your org ID is provisioned with Private Retention with Private Safety Processing, BAA-eligible endpoints can be used for processing PHI, even if data is retained.”
Data controls in the OpenAI platform, OpenAI, OpenAI Platform documentation, 2026, Private Retention with Private Safety Processing section.
Open the original- What it measures
- OpenAI's data controls page for the platform API. The sentence applies only to the endpoints it marks as BAA-eligible and to organizations OpenAI has provisioned.
- What it does not show
- A signed agreement and a provisioned organization are both required. The page does not say that every endpoint, including every audio endpoint, is covered, so check the endpoint list for the specific API you use.