The best AI coding agents for HIPAA, ranked by what their BAA covers

A coding agent working on a health company's codebase reads more than code. It opens seed files, runs queries, tails logs, reads the ticket it was given, and sends all of that to a model so it can decide what to do next. If any of it holds protected health information (PHI), the PHI goes wherever the agent's data goes.

Below are the seven coding agents a health company can use under a HIPAA Business Associate Agreement (BAA) today, ranked by what a team can run under each BAA. Every claim about a vendor comes from its own docs, checked October 25, 2026.

Replicas is first on the list, and we make it. In October 2026 we changed it so we could sign BAAs on Enterprise plans, and Connor, my co-founder, built most of that. After the ranking is what we learned: every place a workspace's data can end up, what we did about each one, and what you still have to set up yourself, starting with your model provider.

This is an engineering guide, not legal advice. Check your plan with your own counsel.

The coding agents you can use under a HIPAA BAA, ranked

We ranked them on what a team can run under each BAA: which agents, where they run (a laptop, the cloud, code review), and how much else you'd have to set up. We make Replicas and put it first, so weigh that with this in mind: it's the one option here that runs Claude Code and Codex as cloud agents under a BAA, and it needs a second contract with your model provider.

1. Replicas

This is our product, so read this one with that in mind. Replicas runs coding agents such as Claude Code and Codex in the cloud, each workspace in its own isolated VM, and we sign a BAA on Enterprise plans. That fills a gap the model vendors leave: Anthropic's BAA doesn't cover Claude Code cloud sessions, and OpenAI's Codex HIPAA guide excludes Codex cloud. With Replicas and a covered model route (an Anthropic Console API key with zero data retention, an OpenAI API key with Modified Retention, or Amazon Bedrock), a team can hand those agents work from Slack, Linear, or GitHub and let them run in the cloud under BAAs, instead of on developers' laptops. For organizations with a BAA, we turned off what our BAA doesn't cover, and every check fails closed. The rest of this guide shows how. The cost is a second contract, since our BAA doesn't cover your model provider.

2. Cursor

Cursor's BAA lists more of its product than any other agent here: the desktop IDE (Agent, Tab, Edit, and local agent mode), the CLI, Cloud Agents, BugBot code review, Automations, and Cursor for iOS. It's on the Enterprise plan, and coverage requires Privacy Mode turned on and locked for the whole organization. The models you can use with PHI are listed in Cursor's HIPAA guide, which you request through its Trust Center. Third-party services and integrations aren't covered automatically (Cursor).

3. Claude Code

On a Claude Enterprise plan, the Primary Owner applies a HIPAA configuration once Anthropic's account team turns it on. It covers Claude Code in the terminal and in Claude Desktop's Code section, when members sign in with the Enterprise account and connect directly to Anthropic, and it includes Covered Models such as Claude Fable 5 (Anthropic). The other route is a Console API key from an organization with zero data retention, which Anthropic covers "through ZDR". Neither route covers the VS Code or JetBrains extensions, or Claude Code through Bedrock or an LLM gateway. Cloud sessions, Code Review, and Remote Control are turned off under the HIPAA configuration (Anthropic).

4. OpenAI Codex

Codex is covered when members sign in to a HIPAA-eligible ChatGPT workspace (ChatGPT for Healthcare, ChatGPT for Clinicians, or a Regulated Workspace), or use an API key under a BAA that includes the API with Modified Retention. That covers the CLI, the IDE extension, and the desktop app. Your OpenAI account director turns on Codex HIPAA support (OpenAI). On the cloud, OpenAI's own pages disagree: its Codex HIPAA guide says "The BAA doesn't cover Codex cloud. Don't use Codex cloud with PHI," while its help center lists cloud Codex as covered. Plan on local Codex until OpenAI tells you otherwise in writing.

Codex and Claude Code are close. Codex covers its IDE extension, which Claude Code doesn't. We put Claude Code ahead because Anthropic's pages agree with each other about what's covered, and OpenAI's don't about the cloud.

5. Factory

Factory publishes its whole BAA (Factory, last updated April 29, 2026) and offers it to healthcare customers through sales (Factory). Droids can run on laptops, in CI, in a hybrid setup, or fully air-gapped. By default Factory sends model traffic straight to providers' enterprise endpoints under zero-retention contracts (Factory docs), and its docs tell healthcare teams to allowlist only the models and gateways that meet their PHI rules (Factory docs). The BAA doesn't list which products or models it covers, so confirm the scope in your contract. Also read sections 2.2 and 2.5: they let Factory use PHI for internal product improvement, and use de-identified data.

6. Kiro

Kiro, from AWS, is on AWS's list of HIPAA-eligible services, so its IDE and CLI can be used under an AWS BAA. Kiro Web isn't included (Kiro, AWS). If your company already has an AWS BAA, there's no new vendor contract to sign. Your organization still has to configure Kiro to meet HIPAA requirements (Kiro).

7. Gemini Code Assist

Google's list of products under the Google Cloud BAA includes Gemini Code Assist and Antigravity in Gemini Enterprise (Google Cloud). Like Kiro, it's the shortest path if you already have a Google Cloud BAA. It ranks last because Google doesn't say which Code Assist surfaces the BAA reaches, and Google's compliance certifications for Gemini don't apply to Gemini Code Assist on GitHub (Google Cloud). Ask about the GitHub app and Gemini CLI before using them with PHI.

Agents without a published BAA

We also checked these. Their own terms rule PHI out without a separate agreement, or don't list the product:

GitHub's agreement also covers GitHub Enterprise Cloud and Teams, which matters for any agent that writes commits, issues, or pull requests there. And if you run an open-source agent such as OpenCode or Cline on your own machines with your own model credentials, no agent vendor sees the data. The model provider does, so that's the BAA you need (see below).

Does the agent need to see PHI at all?

Under HIPAA, a vendor that creates, receives, maintains, or transmits PHI on your behalf is a business associate, and so is any vendor it hands that PHI to (HHS). Source code on its own usually isn't PHI. What matters is everything else the agent can reach:

That leaves two positions you can defend:

1. Keep PHI out, and enforce it. Use synthetic or de-identified data everywhere the agent can reach, give it no production credentials, and keep patient details out of tickets. This holds only as long as the controls do, because an agent goes wherever its tools let it.
2. Assume PHI will get in, and put every stop under a BAA. Each vendor in the path then needs a BAA with you, or with the vendor in front of it, or has to be cut off.

Encryption doesn't change the answer. HHS says a cloud provider that stores only encrypted PHI, without the key, is still a business associate, and the "conduit" exception only covers services that transmit data without storing it. Using a vendor that maintains PHI without a BAA in place is a violation on the covered entity's side (HHS cloud guidance, question 5).

Every place a coding agent's data can go

Where data from a Replicas workspace can go, and what we did about each stop for organizations with a signed BAA.

Most of these stops exist for any cloud coding agent. The right-hand column is what Replicas does today:

What we changed to sign BAAs

All of it shipped in five days:

A few things we learned on the way:

One flag, and every check fails closed

Every check reads one column on the organization, set from our admin dashboard. No customer-facing route writes it. When the lookup itself errors, each check behaves as if the organization has a BAA: the GPU and mobile routes refuse the request, the Sentry hook strips the event, and the settings page shows those features as off. A database blip turns things off for a moment instead of sending data somewhere it shouldn't go.

Hide blocked tools from the agent too

Returning a 403 from the GPU routes wasn't enough. An agent reads its skills and system prompt, and one that's been told it can rent a GPU will try to. We didn't want agents in BAA organizations told about these tools at all, so we also removed the GPU guide from the agent's skill and system prompt, hid replicas gpu from the CLI, and stopped installing the Limrun skills. Replicas keeps warm sandboxes ready ahead of time, so changing an organization's BAA flag also rebuilds its warm pools. Otherwise a sandbox prepared earlier would still carry the old instructions.

Telemetry leaks more than features do

The stops that surprised us weren't ones anyone thinks of as handling health data. A PostHog pageview includes the page title, and on a workspace page that title is a name generated from the prompt. In testing, a workspace named "Jane Doe MRN 12345 discharge summary" showed up word for word in a pageview event. Sentry's Node SDK attaches up to 10 KB of each request body by default, and the console integration we use turns every console.error into an event. Here's the hook that runs before each Sentry event leaves the server, slightly trimmed:

Errors still reach Sentry with their message and stack trace, so we can fix bugs. What's gone is everything that copies whatever happened to be posted or logged.

Delete what nobody reads

Two of the fixes were deletions. Nothing read the error column in ClickHouse, so we stopped writing it for every organization. The digest email repeated what the Learnings page already shows, so it's gone. A per-organization check is code someone has to keep right, so where nobody used the data, we deleted the copy instead.

Write the rule down for the next vendor

The last change was a written rule. Every agent session in our organization loads a short instruction: any new place customer data is stored or sent has to be blocked for BAA organizations unless a BAA covers it. The next vendor an engineer or an agent adds starts from that question.

Model providers: whose BAA covers the model calls

Replicas doesn't resell model access to coding agents. A workspace runs Claude Code, Codex, or another agent with the credential your organization or a member connected: a Claude or ChatGPT login, an Anthropic or OpenAI API key, Amazon Bedrock, Microsoft Foundry, and others. The agent's model calls go from the VM to that provider, under your account. Our BAA covers Replicas. It doesn't cover your model provider, so you need your own BAA with whichever provider the agent uses, for that exact product and setup.

Two Replicas behaviors to plan around:

• A member's personal credential is used before the organization's (scopes). In a BAA organization, make sure nobody connects a personal login that isn't covered, such as a Claude Pro or ChatGPT Plus account.
• When a credential hits a usage limit, the chat moves to the next one in the fallback chain, which can be another provider. Every credential in the chain has to be covered, or taken out of it.

Here's what each provider's own docs say, checked October 25, 2026:

Anthropic's BAA

Anthropic signs a BAA for what it calls HIPAA-ready services, including its first-party API and Claude Enterprise plans, where the organization's Primary Owner turns HIPAA on and accepts the BAA in settings (Anthropic). Three details matter for a coding agent:

• HIPAA readiness on the API doesn't extend to Claude Code. Anthropic's API docs list Claude Code under "What HIPAA readiness does not cover" (Anthropic). For Claude Code, the API-key route to coverage is zero data retention.
• Covered Models, which include Claude Fable 5 and 5.1, need 30-day retention and aren't available from an organization with zero data retention unless Anthropic has authorized it (Anthropic). On the zero-retention route, plan on Opus and the other models.
• The Enterprise HIPAA configuration covers "local mode", which Anthropic defines as a session on a member's own computer. Whether Claude Code running in a vendor's VM counts is a question for your Anthropic account team. The API key with zero data retention has no such condition.

Claude zero data retention

With zero data retention, Anthropic doesn't store prompts or responses after the response is returned, except where needed to comply with law or combat misuse. Your account team turns it on per organization, after a request through Anthropic sales, and it doesn't carry over to other organizations on the same account (Anthropic). For Claude Code it applies to API keys from a commercial organization. Claude Enterprise has a separate offering for Claude Code that turns off features that store transcripts, such as cloud sessions, Remote Control, and /feedback. Sessions flagged for a policy violation can still be kept for up to two years (Claude Code docs).

OpenAI's BAA

OpenAI makes these products HIPAA-eligible with a BAA: ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT FedRAMP, ChatGPT for Clinicians, and the API with Modified Retention (OpenAI). On the API, you need a signed BAA and an organization provisioned with Modified Retention. After that, endpoints including /v1/responses and /v1/chat/completions can process PHI.

The BAA covers what OpenAI processes, not the machine the agent runs on. It "does not apply to the execution of the Codex Local Client on Customer's client machines or to any Third-Party Services" Codex calls (OpenAI). In a cloud agent, that machine is the vendor's VM, which is why the agent platform needs its own BAA.

Without zero data retention or Modified Abuse Monitoring, OpenAI keeps API abuse-monitoring logs, which can include prompts and responses, for up to 30 days. Both controls need OpenAI's approval. With zero data retention, the store flag on /v1/responses and /v1/chat/completions is always treated as false (OpenAI).

Questions to ask an agent vendor

These are the questions we had to answer about our own product. Ask them of any vendor, us included:

1. Will you sign a BAA, and on which plan?
2. Which vendors handle workspace data (sandbox host, database, logs, analytics, error tracking, email), and does each have a BAA with you?
3. What gets turned off for a BAA account, and is it also hidden from the agent?
4. Whose model account does the agent use, and can a personal login or a fallback route around it?
5. What happens when the check for "is this a BAA account" fails?
6. How long are transcripts kept, and can you turn that off?

Where Replicas fits

Replicas signs a HIPAA BAA on Enterprise plans and is SOC 2 Type I, with Type II in progress. You can request the report on our Trust Center. No certification makes a product HIPAA compliant. Compliance is shared: our BAA covers what Replicas does with PHI, and you still choose and contract your model provider, decide what the agent can reach, and run your own HIPAA program. Our Data Processing Agreement covers personal data more broadly.

If you're working through this for your team, see what Enterprise includes.