# The best AI coding agents for HIPAA, ranked by what their BAA covers

Seven coding agents a health company can use under a HIPAA BAA, ranked by what each covers, plus where agents send PHI and what we changed to sign BAAs.

- Canonical: https://replicas.dev/resources/ai-coding-agents-hipaa

A coding agent working on a health company's codebase reads more than code. It opens seed files, runs queries, tails logs, reads the ticket it was given, and sends all of that to a model so it can decide what to do next. If any of it holds protected health information (PHI), the PHI goes wherever the agent's data goes.

Below are the seven coding agents a health company can use under a HIPAA Business Associate Agreement (BAA) today, ranked by what a team can run under each BAA. Every claim about a vendor comes from its own docs, checked October 25, 2026.

Replicas is first on the list, and we make it. In October 2026 we changed it so we could sign BAAs on Enterprise plans, and Connor, my co-founder, built most of that. After the ranking is what we learned: every place a workspace's data can end up, what we did about each one, and what you still have to set up yourself, starting with your model provider.

*This is an engineering guide, not legal advice. Check your plan with your own counsel.*

## The coding agents you can use under a HIPAA BAA, ranked

We ranked them on what a team can run under each BAA: which agents, where they run (a laptop, the cloud, code review), and how much else you'd have to set up. We make Replicas and put it first, so weigh that with this in mind: it's the one option here that runs Claude Code and Codex as cloud agents under a BAA, and it needs a second contract with your model provider.

| # | Agent | BAA from | Covers | Doesn't cover |
|---|---|---|---|---|
| 1 | Replicas | Replicas, on Enterprise | Claude Code, Codex, and other agents running as cloud agents, each in an isolated VM | Your model provider, which needs its own BAA. GPU sandboxes and mobile testing are turned off |
| 2 | Cursor | Cursor, on Enterprise | Desktop IDE, CLI, Cloud Agents, BugBot, Automations, and the iOS app, with Privacy Mode locked on | Third-party services, and models outside Cursor's eligible list |
| 3 | Claude Code | Anthropic, on Enterprise with the HIPAA configuration, or a Console organization with zero data retention | The terminal and Claude Desktop's Code section, with Anthropic's models | VS Code and JetBrains extensions, cloud sessions, Code Review, and sessions through Bedrock or a gateway |
| 4 | OpenAI Codex | OpenAI, with ChatGPT for Healthcare, ChatGPT for Clinicians, or a Regulated Workspace, or the API with Modified Retention | CLI, IDE extension, and desktop app, with OpenAI's models | Codex cloud, and third-party services it calls |
| 5 | Factory | Factory, through sales | The services in your Factory agreement. Droids run on laptops, in CI, or air-gapped | Your own gateways and self-hosted models |
| 6 | Kiro | AWS, under an AWS BAA | Kiro IDE and CLI | Kiro Web |
| 7 | Gemini Code Assist | Google, under a Google Cloud BAA | Gemini Code Assist, and Antigravity in Gemini Enterprise | Not stated. Ask about the GitHub app and Gemini CLI |

### 1. Replicas

This is our product, so read this one with that in mind. Replicas runs coding agents such as Claude Code and Codex in the cloud, each workspace in its own isolated VM, and we sign a BAA on Enterprise plans. That fills a gap the model vendors leave: Anthropic's BAA doesn't cover Claude Code cloud sessions, and OpenAI's Codex HIPAA guide excludes Codex cloud. With Replicas and a covered model route (an Anthropic Console API key with zero data retention, an OpenAI API key with Modified Retention, or Amazon Bedrock), a team can hand those agents work from Slack, Linear, or GitHub and let them run in the cloud under BAAs, instead of on developers' laptops. For organizations with a BAA, we turned off what our BAA doesn't cover, and every check fails closed. The rest of this guide shows how. The cost is a second contract, since our BAA doesn't cover your model provider.

### 2. Cursor

Cursor's BAA lists more of its product than any other agent here: the desktop IDE (Agent, Tab, Edit, and local agent mode), the CLI, Cloud Agents, BugBot code review, Automations, and Cursor for iOS. It's on the Enterprise plan, and coverage requires Privacy Mode turned on and locked for the whole organization. The models you can use with PHI are listed in Cursor's HIPAA guide, which you request through its Trust Center. Third-party services and integrations aren't covered automatically ([Cursor](https://cursor.com/docs/enterprise/baa)).

### 3. Claude Code

On a Claude Enterprise plan, the Primary Owner applies a HIPAA configuration once Anthropic's account team turns it on. It covers Claude Code in the terminal and in Claude Desktop's Code section, when members sign in with the Enterprise account and connect directly to Anthropic, and it includes Covered Models such as Claude Fable 5 ([Anthropic](https://support.claude.com/en/articles/17318731-use-claude-code-local-mode-and-claude-cowork-local-mode-on-a-hipaa-ready-enterprise-plan)). The other route is a Console API key from an organization with zero data retention, which Anthropic covers "through ZDR". Neither route covers the VS Code or JetBrains extensions, or Claude Code through Bedrock or an LLM gateway. Cloud sessions, Code Review, and Remote Control are turned off under the HIPAA configuration ([Anthropic](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers)).

### 4. OpenAI Codex

Codex is covered when members sign in to a HIPAA-eligible ChatGPT workspace (ChatGPT for Healthcare, ChatGPT for Clinicians, or a Regulated Workspace), or use an API key under a BAA that includes the API with Modified Retention. That covers the CLI, the IDE extension, and the desktop app. Your OpenAI account director turns on Codex HIPAA support ([OpenAI](https://learn.chatgpt.com/docs/hipaa-configuration)). On the cloud, OpenAI's own pages disagree: its Codex HIPAA guide says "The BAA doesn't cover Codex cloud. Don't use Codex cloud with PHI," while its [help center](https://help.openai.com/en/articles/20001069-hipaa-eligible-products-and-functionality) lists cloud Codex as covered. Plan on local Codex until OpenAI tells you otherwise in writing.

Codex and Claude Code are close. Codex covers its IDE extension, which Claude Code doesn't. We put Claude Code ahead because Anthropic's pages agree with each other about what's covered, and OpenAI's don't about the cloud.

### 5. Factory

Factory publishes its whole BAA ([Factory](https://factory.com/baa), last updated April 29, 2026) and offers it to healthcare customers through sales ([Factory](https://factory.com/industries/healthcare)). Droids can run on laptops, in CI, in a hybrid setup, or fully air-gapped. By default Factory sends model traffic straight to providers' enterprise endpoints under zero-retention contracts ([Factory docs](https://docs.factory.com/enterprise/privacy-and-data-flows)), and its docs tell healthcare teams to allowlist only the models and gateways that meet their PHI rules ([Factory docs](https://docs.factory.com/enterprise/compliance-audit-and-monitoring)). The BAA doesn't list which products or models it covers, so confirm the scope in your contract. Also read sections 2.2 and 2.5: they let Factory use PHI for internal product improvement, and use de-identified data.

### 6. Kiro

Kiro, from AWS, is on AWS's list of HIPAA-eligible services, so its IDE and CLI can be used under an AWS BAA. Kiro Web isn't included ([Kiro](https://kiro.dev/changelog/general/kiro-is-now-a-hipaa-eligible-service/), [AWS](https://aws.amazon.com/compliance/hipaa-eligible-services-reference/)). If your company already has an AWS BAA, there's no new vendor contract to sign. Your organization still has to configure Kiro to meet HIPAA requirements ([Kiro](https://kiro.dev/docs/privacy-and-security/compliance-validation/)).

### 7. Gemini Code Assist

Google's list of products under the Google Cloud BAA includes Gemini Code Assist and Antigravity in Gemini Enterprise ([Google Cloud](https://docs.cloud.google.com/docs/security/compliance/hipaa)). Like Kiro, it's the shortest path if you already have a Google Cloud BAA. It ranks last because Google doesn't say which Code Assist surfaces the BAA reaches, and Google's compliance certifications for Gemini don't apply to Gemini Code Assist on GitHub ([Google Cloud](https://docs.cloud.google.com/gemini/docs/discover/certifications)). Ask about the GitHub app and Gemini CLI before using them with PHI.

### Agents without a published BAA

We also checked these. Their own terms rule PHI out without a separate agreement, or don't list the product:

| Agent | What their own docs say |
|---|---|
| GitHub Copilot | GitHub's [Data Protection Agreement](https://github.com/customer-terms/github-data-protection-agreement), which applies to Copilot, says: "Except with GitHub's prior, written, and specific consent, You shall not provide GitHub any Personal Data" that is PHI. We didn't find a GitHub page offering a BAA for Copilot |
| Devin, and Devin Desktop (formerly Windsurf) | Cognition's [Acceptable Use Policy](https://cognition.com/legal/acceptable-use-policy) lists "Protected Health Information as defined under HIPAA" as prohibited data "unless you have entered into a separate written agreement with Cognition expressly permitting such use" |
| Amazon Q Developer | Not on AWS's [HIPAA-eligible services list](https://aws.amazon.com/compliance/hipaa-eligible-services-reference/). Kiro is |

GitHub's agreement also covers GitHub Enterprise Cloud and Teams, which matters for any agent that writes commits, issues, or pull requests there. And if you run an open-source agent such as OpenCode or Cline on your own machines with your own model credentials, no agent vendor sees the data. The model provider does, so that's the BAA you need ([see below](#model-providers-whose-baa-covers-the-model-calls)).

## Does the agent need to see PHI at all?

Under HIPAA, a vendor that creates, receives, maintains, or transmits PHI on your behalf is a business associate, and so is any vendor it hands that PHI to ([HHS](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html)). Source code on its own usually isn't PHI. What matters is everything else the agent can reach:

| Where PHI turns up | How an agent reaches it |
|---|---|
| Seed data, fixtures, test snapshots | Reads them while writing or fixing tests |
| Staging copies or dumps of production data | Runs queries from the shell or through an MCP server |
| Application logs and error reports | Pulls them up to debug a failure |
| Tickets and Slack threads | Gets one as its task, sometimes with a patient detail pasted in |
| Screenshots and screen recordings | Looks at a bug report that shows a real record |

That leaves two positions you can defend:

1. **Keep PHI out, and enforce it.** Use synthetic or [de-identified](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html) data everywhere the agent can reach, give it no production credentials, and keep patient details out of tickets. This holds only as long as the controls do, because an agent goes wherever its tools let it.
2. **Assume PHI will get in, and put every stop under a BAA.** Each vendor in the path then needs a BAA with you, or with the vendor in front of it, or has to be cut off.

Encryption doesn't change the answer. HHS says a cloud provider that stores only encrypted PHI, without the key, is still a business associate, and the "conduit" exception only covers services that transmit data without storing it. Using a vendor that maintains PHI without a BAA in place is a violation on the covered entity's side ([HHS cloud guidance, question 5](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html)).

## Every place a coding agent's data can go

![Diagram of where data from a coding agent's VM can go: model provider, MCP servers and plugins, and code host under your own contract; sandbox VMs, the Replicas database, and Replicas' own model calls under Replicas' BAA; error tracking and the metrics warehouse trimmed to metadata; GPU sandboxes, mobile testing, product analytics, OpenRouter, and the digest email cut off](/blog/ai-coding-agents-hipaa-data-flow.png)

*Where data from a Replicas workspace can go, and what we did about each stop for organizations with a signed BAA.*

Most of these stops exist for any cloud coding agent. The right-hand column is what Replicas does today:

| Stop | How PHI gets there | What Replicas does for a BAA organization |
|---|---|---|
| Model provider | Every turn sends the files the agent read, command output, and your messages to the model | Uses the model credential you connect. You need your own BAA with that provider ([see below](#model-providers-whose-baa-covers-the-model-calls)) |
| MCP servers, plugins, integrations | The agent can pass anything it has read to a tool it calls | Not blocked automatically. Each one your admins add is another vendor that needs a BAA, or should stay off |
| Code host | Commits, pull request descriptions, and comments the agent writes | Your own contract. GitHub's terms are [above](#agents-without-a-published-baa) |
| Sandbox VMs | Your repo, the agent's terminal, and its transcript live there while it works | Covered by our BAA |
| Replicas database | Chat transcripts, Canvas files, and setup step errors | Covered by our BAA. Admins can stop saving [chat and Canvas history](https://docs.replicas.dev/admin/data-retention), so new history is kept only while a workspace is awake. History saved before the change isn't deleted |
| Replicas' own model calls | Workspace names, the Needs you inbox, the merge-protection check, and session descriptions all read agent messages, commands, or transcripts | Moved from OpenRouter, which our BAA doesn't cover, to a zero-retention OpenAI project that it does |
| Error tracking (Sentry) | By default the SDK attaches request bodies, turns each `console.error` into an event with its arguments, and keeps console lines as breadcrumbs | For every organization, the request on an event is cut to its method and path. For BAA organizations, console-only events are dropped, and console arguments and breadcrumbs are stripped |
| Metrics warehouse (ClickHouse) | A failed setup script's full output was copied into an error column | Stopped copying it, for every organization |
| Product analytics (PostHog) | Session replay records the screen, and even a pageview carries the page title, which holds the workspace name | Off entirely for signed-in users of BAA organizations, on the web and in the mobile app |
| GPU sandboxes (Modal) | The agent can send code and data to a GPU machine | We have no BAA with Modal, so it's blocked and hidden from the agent |
| Mobile testing (Limrun) | Simulators show app data, and screenshots come back to the agent | Limrun doesn't offer a BAA, so it's blocked and its skills aren't installed |
| Learnings digest email (Resend) | The nightly email listed learning names drawn from chats | Resend won't sign a BAA, so we removed the email for everyone |

## What we changed to sign BAAs

All of it shipped in five days:

| Date (2026) | Change | Why |
|---|---|---|
| Oct 20 | A BAA flag on organizations that only Replicas staff can set | One switch for every check to read |
| Oct 20 | Stopped copying setup step errors into ClickHouse | Nothing read them there, and setup output can hold customer data |
| Oct 21 | Turned off and hid GPU sandboxes and mobile testing | No BAA with Modal, and Limrun doesn't offer one |
| Oct 21 | Kept request bodies, console text, and breadcrumbs out of Sentry | The SDK's defaults capture prompt text |
| Oct 21 | Turned PostHog off for BAA organizations | Replay and page titles can't be filtered field by field |
| Oct 21 | Removed the learnings digest email | It went through a vendor that won't sign a BAA |
| Oct 22 | Kept signed-in BAA users' IDs out of the homepage experiment | The page asked PostHog which headline to show |
| Oct 24 | Moved our backend model calls from OpenRouter to OpenAI | OpenRouter isn't covered by our BAA |

A few things we learned on the way:

### One flag, and every check fails closed

Every check reads one column on the organization, set from our admin dashboard. No customer-facing route writes it. When the lookup itself errors, each check behaves as if the organization has a BAA: the GPU and mobile routes refuse the request, the Sentry hook strips the event, and the settings page shows those features as off. A database blip turns things off for a moment instead of sending data somewhere it shouldn't go.

```ts
export function isBaaOrganizationFailClosed(organizationId: string, source: string): Promise<boolean> {
  return isBaaOrganization(organizationId).catch((error) => {
    captureError(error, { source, action: 'baa_lookup', organizationId });
    return true;
  });
}
```

### Hide blocked tools from the agent too

Returning a 403 from the GPU routes wasn't enough. An agent reads its skills and system prompt, and one that's been told it can rent a GPU will try to. We didn't want agents in BAA organizations told about these tools at all, so we also removed the GPU guide from the agent's skill and system prompt, hid `replicas gpu` from the CLI, and stopped installing the Limrun skills. Replicas keeps warm sandboxes ready ahead of time, so changing an organization's BAA flag also rebuilds its warm pools. Otherwise a sandbox prepared earlier would still carry the old instructions.

### Telemetry leaks more than features do

The stops that surprised us weren't ones anyone thinks of as handling health data. A PostHog pageview includes the page title, and on a workspace page that title is a name generated from the prompt. In testing, a workspace named "Jane Doe MRN 12345 discharge summary" showed up word for word in a pageview event. Sentry's Node SDK attaches up to 10 KB of each request body by default, and the console integration we use turns every `console.error` into an event. Here's the hook that runs before each Sentry event leaves the server, slightly trimmed:

```ts
beforeSend: async (event) => {
  if (event.request) event.request = { method: event.request.method, url: event.request.url?.split('?')[0] };
  const organizationId = event.tags?.organization_id;
  if (typeof organizationId !== 'string') return event;
  const { isBaaOrganization } = await import('./lib/baa');
  const baa = await isBaaOrganization(organizationId).catch(() => true);
  if (!baa) return event;
  if (event.logger === 'console' && !event.exception) return null;
  delete event.extra?.arguments;
  delete event.breadcrumbs;
  return event;
},
```

Errors still reach Sentry with their message and stack trace, so we can fix bugs. What's gone is everything that copies whatever happened to be posted or logged.

### Delete what nobody reads

Two of the fixes were deletions. Nothing read the error column in ClickHouse, so we stopped writing it for every organization. The digest email repeated what the Learnings page already shows, so it's gone. A per-organization check is code someone has to keep right, so where nobody used the data, we deleted the copy instead.

### Write the rule down for the next vendor

The last change was a written rule. Every agent session in our organization loads a short instruction: any new place customer data is stored or sent has to be blocked for BAA organizations unless a BAA covers it. The next vendor an engineer or an agent adds starts from that question.

## Model providers: whose BAA covers the model calls

Replicas doesn't resell model access to coding agents. A workspace runs Claude Code, Codex, or another agent with the credential your organization or a member connected: a Claude or ChatGPT login, an Anthropic or OpenAI API key, Amazon Bedrock, Microsoft Foundry, and [others](https://docs.replicas.dev/admin/credentials). The agent's model calls go from the VM to that provider, under your account. Our BAA covers Replicas. It doesn't cover your model provider, so you need your own BAA with whichever provider the agent uses, for that exact product and setup.

Two Replicas behaviors to plan around:

- A member's personal credential is used before the organization's ([scopes](https://docs.replicas.dev/admin/credentials#scopes)). In a BAA organization, make sure nobody connects a personal login that isn't covered, such as a Claude Pro or ChatGPT Plus account.
- When a credential hits a usage limit, the chat moves to the next one in the [fallback chain](https://docs.replicas.dev/admin/credentials#fallback-chains), which can be another provider. Every credential in the chain has to be covered, or taken out of it.

Here's what each provider's own docs say, checked October 25, 2026:

| How the agent reaches the model | Covered by the provider's BAA? |
|---|---|
| Claude Code with an Anthropic Console API key, organization has zero data retention | Yes, "covered through ZDR" ([Anthropic](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers)) |
| Claude Code with a Console API key, no zero data retention | No ([Anthropic](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers)) |
| Claude Code on a HIPAA-ready Claude Enterprise plan, HIPAA configuration applied | Yes in "local mode": a session on a member's own computer, signed in with the Enterprise account, connecting directly to Anthropic ([Anthropic](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers)) |
| Claude Free, Pro, or Max login | No ([Anthropic](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention)) |
| Claude Code through Amazon Bedrock or Microsoft Foundry | Not under Anthropic's BAA. AWS lists Bedrock as a [HIPAA-eligible service](https://aws.amazon.com/compliance/hipaa-eligible-services-reference/) under its own BAA |
| Codex signed in with a HIPAA-eligible ChatGPT workspace | Yes, for the data OpenAI processes ([OpenAI](https://help.openai.com/en/articles/20001069-hipaa-eligible-products-and-functionality)) |
| Codex with an OpenAI API key | Yes, if your BAA includes the API with Modified Retention ([OpenAI](https://help.openai.com/en/articles/20001069-hipaa-eligible-products-and-functionality)) |

### Anthropic's BAA

Anthropic signs a BAA for what it calls HIPAA-ready services, including its first-party API and Claude Enterprise plans, where the organization's Primary Owner turns HIPAA on and accepts the BAA in settings ([Anthropic](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers)). Three details matter for a coding agent:

- HIPAA readiness on the API doesn't extend to Claude Code. Anthropic's API docs list Claude Code under "What HIPAA readiness does not cover" ([Anthropic](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention)). For Claude Code, the API-key route to coverage is zero data retention.
- Covered Models, which include Claude Fable 5 and 5.1, need 30-day retention and aren't available from an organization with zero data retention unless Anthropic has authorized it ([Anthropic](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers)). On the zero-retention route, plan on Opus and the other models.
- The Enterprise HIPAA configuration covers "local mode", which Anthropic defines as a session on a member's own computer. Whether Claude Code running in a vendor's VM counts is a question for your Anthropic account team. The API key with zero data retention has no such condition.

### Claude zero data retention

With zero data retention, Anthropic doesn't store prompts or responses after the response is returned, except where needed to comply with law or combat misuse. Your account team turns it on per organization, after a request through [Anthropic sales](https://claude.com/contact-sales), and it doesn't carry over to other organizations on the same account ([Anthropic](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention)). For Claude Code it applies to API keys from a commercial organization. Claude Enterprise has a separate offering for Claude Code that turns off features that store transcripts, such as cloud sessions, Remote Control, and `/feedback`. Sessions flagged for a policy violation can still be kept for up to two years ([Claude Code docs](https://code.claude.com/docs/en/zero-data-retention)).

### OpenAI's BAA

OpenAI makes these products HIPAA-eligible with a BAA: ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT FedRAMP, ChatGPT for Clinicians, and the API with Modified Retention ([OpenAI](https://help.openai.com/en/articles/20001069-hipaa-eligible-products-and-functionality)). On the API, you need a signed BAA and an organization provisioned with Modified Retention. After that, endpoints including `/v1/responses` and `/v1/chat/completions` can process PHI.

The BAA covers what OpenAI processes, not the machine the agent runs on. It "does not apply to the execution of the Codex Local Client on Customer's client machines or to any Third-Party Services" Codex calls ([OpenAI](https://help.openai.com/en/articles/20001069-hipaa-eligible-products-and-functionality)). In a cloud agent, that machine is the vendor's VM, which is why the agent platform needs its own BAA.

Without zero data retention or Modified Abuse Monitoring, OpenAI keeps API abuse-monitoring logs, which can include prompts and responses, for up to 30 days. Both controls need OpenAI's approval. With zero data retention, the `store` flag on `/v1/responses` and `/v1/chat/completions` is always treated as false ([OpenAI](https://developers.openai.com/api/docs/guides/your-data)).

## Questions to ask an agent vendor

These are the questions we had to answer about our own product. Ask them of any vendor, us included:

1. Will you sign a BAA, and on which plan?
2. Which vendors handle workspace data (sandbox host, database, logs, analytics, error tracking, email), and does each have a BAA with you?
3. What gets turned off for a BAA account, and is it also hidden from the agent?
4. Whose model account does the agent use, and can a personal login or a fallback route around it?
5. What happens when the check for "is this a BAA account" fails?
6. How long are transcripts kept, and can you turn that off?

## Where Replicas fits

Replicas signs a HIPAA BAA on Enterprise plans and is SOC 2 Type I, with Type II in progress. You can request the report on our [Trust Center](https://trust.replicas.dev). No certification makes a product HIPAA compliant. Compliance is shared: our BAA covers what Replicas does with PHI, and you still choose and contract your model provider, decide what the agent can reach, and run your own HIPAA program. Our [Data Processing Agreement](/dpa) covers personal data more broadly.

If you're working through this for your team, [see what Enterprise includes](/enterprise).