CompliantChatGPT

What is CompliantChatGPT?

CompliantChatGPT is an AI assistant designed for medical professionals, clinics, and other regulated teams. It brings together general large language models, clinical workflows, voice recording, document analysis, PHI protection, and team management in a single workspace.

The privacy policy states that the product is provided by Light-it Inc.; the copyright information for this website also lists CompliantAI, LLC as the owner. The actual party involved in the contract, as specified in the purchase agreement, BAA, and data processing documents, shall be determined according to the finally signed documents.

A one-sentence summary

CompliantChatGPT offers an AI environment tailored for HIPAA requirements, supporting SOAP notes, medical record summaries, voice transcription, file analysis, and EHR workflows, through mechanisms such as BAA agreements, access control, audit logs, configurable data retention policies, and PHI Guard.

Current product composition

Main functions

Clinical AI dialogue and document drafting

Users can ask the system to organize SOAP notes, progress records, treatment plans, referral letters, summary of visits, or meeting minutes. It can also help interpret test results, extract information from medical records, and rewrite clinical text.

These outputs are AI-generated drafts and not medically verified conclusions. Diagnosis, prescriptions, drug interactions, risk assessment, and patient communication must all be reviewed by qualified professionals.

Medical Modes and Custom Modes

The built-in Medical Modes provide pre-configured guidance processes for tasks such as SOAP Notes, Differential Diagnosis, Bloodwork Analysis, and Treatment Planner. Mental health records are also available in formats such as BIRP, DAP, EMDR, and PIE.

Custom Modes allow teams to save their own system instructions, templates, and reference documents, so as to use a consistent format among different team members. This feature is available in all chat packages, but the files saved in Custom Modes are managed separately from the retention policies applied to regular conversations.

AI medical transcription

CompliantChatGPT can capture audio on mobile devices or web pages, generate editable transcriptions, and then organize them into clinical summaries and structured notes. It supports on-the-spot recording as well as processing audio files that are uploaded.

• Convert outpatient or consultation audio into editable text.
• Extract symptoms, action items, and follow-up arrangements from the complete transcript.
• Generate drafts of SOAP notes, progress records, treatment plans, and referral letters.
• Review the original audio and the organized clinical documents separately.
• Clinical staff verify the content before officially entering it into the EHR.

In-depth file analysis

The platform allows for the uploading of documents, text files, spreadsheets, images, and audio files; it can also read printed, scanned, or handwritten materials. Users can use AI to create summaries, extract data fields, compare records, or organize information in a specified format.

OCR, table parsing, and handwriting recognition can all fail to capture units, symbols, dates, and negative words. When it comes to laboratory values, drug dosages, allergy histories, and patient identities, each item should be checked against the original document.

Patients and Projects workspaces

The Patient Workspace allows storing background information, custom instructions, relevant conversations, and EHR links for each patient. Multiple conversations can share the same patient context, which is suitable for continuous recording and follow-up.

Archive merely removes the patient from the active list; it does not delete the conversations, background information, or EHR links. Only Delete will permanently remove the patient’s record. Organizations should set separate parameters for archiving, deletion, and compliance-related record retention.

Team management

Users can invite members based on the seats they have purchased, while the team owner is responsible for managing retention policies and PHI Guard settings. The account settings also provide options for two-factor authentication, BAA requests, subscription cancellation, and account deletion.

Team templates can help ensure consistency in documents, but they should not allow all professionals to have unrestricted access to all patients. In practice, minimum permissions, procedures for handling member departures, and regular reviews of access rights are necessary.

How PHI Guard works

PHI Guard is an optional organizational policy that is not always enabled by default. The team owner can decide to turn it off for everyone, turn it on for everyone, or allow team members to control it on a case-by-case basis.

1. Users enter medical questions, patient information, file contents, or clinical records.
2. The system detects protected health information and replaces the identification fields with temporary tokens.
3. The anonymized data is sent to the selected AI model for processing; the model does not receive the original, readable PHI.
4. The platform receives the anonymized responses returned by the model.
5. In a controlled environment, the system replaces the temporary token with the original information, displaying the complete result to the user.

Enabling PHI Guard reduces direct exposure of the model to identifiable information, but removing the context may degrade the quality of the responses. Disabling PHI Guard preserves the complete context; organizations should establish unified policies based on the BAA, risk assessments, and clinical requirements.

What requirements must be met to comply with HIPAA?

• The organization must apply for and sign a BAA within the settings; official documentation specifies that this is a necessary condition for full compliance with HIPAA.
• It cannot be assumed on its own whether the trial period covers the BAA; signed documents must be obtained before handling PHI.
• When using Zoom, the organization needs to sign appropriate BAA agreements with both CompliantChatGPT and Zoom.
• When connecting to Healthie or other EHRs, it is necessary to ensure that the systems themselves, as well as the scope of authorization and data flow, meet the required standards.
• The team should establish minimum permissions, two-factor authentication, audit checks, a retention period, and a process for disabling team members.
• PHI Guard can enhance confidentiality, but it can be disabled through policies; its presence does not mean it is always active.
• Compliance with HIPAA does not mean that AI-generated content is accurate for clinical use, nor does it imply compliance with all national and industry regulations.
• The terms prohibit the use of the product in high-risk automated scenarios where a failure could lead to death or physical injury.

File format and upload quota

The reference files saved in Custom Mode are subject to the file limits set for each plan, but it is stated officially that they are not governed by the retention periods applicable to regular chats. After uploading internal templates or files containing PHI, it is necessary to separately check the deletion and access permissions for those mode files.

Complete workflow

1. The organization verifies whether AI can be used for the task, and carries out risk assessment, BAA approval, and internal policy approval.
2. Create a team account, enable two-factor authentication, and assign the minimum permissions required for each role.
3. The team owner configures PHI Guard and data retention to prevent members from choosing inconsistent policies on their own.
4. Select the Medical Mode suitable for the task, or an approved Custom Mode.
5. Enter only the minimum necessary information, or upload documents, images, and audio that fit within the package’s quota.
6. Let AI generate notes, summaries, or draft analyses, and then compare them item by item with the original records.
7. It is reviewed, modified, and signed by qualified clinical professionals, to prevent AI from making high-risk decisions on its own.
8. Write the final results back to the EHR or a controlled system in a secure manner, and record audit information in accordance with the organization’s rules.
9. Regularly check whether there are any changes in the model, integrations, BAA agreements, member permissions, as well as retention and deletion settings.

Usage tutorial

Begin the first clinical task safely.

1. Register for a 7-day free trial; the trial page indicates that no credit card is required.
2. Before processing actual PHI, apply through account settings and complete the signing of a BAA.
3. Enable two-factor authentication and verify the PHI Guard policy set by the team owner.
4. Set the data retention to the shortest period required by the task; select “Do not retain” when synchronization is not necessary.
5. Select built-in modes such as SOAP Notes to verify the output using de-identified test data.
6. Verify the format, omissions, and errors in the mode, and then decide whether to proceed with the actual work.
7. Each output is checked by professionals, who then save the final, revised official version.

Connect to Zoom for remote meeting transcription

1. Confirm that you have a Zoom Pro account, and complete the BAA agreements with both CompliantChatGPT and Zoom.
2. Initiate Zoom authorization in the Integrations section of CompliantChatGPT.
3. Check the authorization settings, log in to Zoom, and grant access to the meeting recordings you need.
4. Enable Cloud Recording and Audio Transcription in Zoom; automatic processing is not available for local recording.
5. Cloud recording is initiated automatically once the meeting starts, with the consent of the participants obtained in accordance with applicable laws and organizational policies.
6. After the meeting, wait for Zoom to process it; it usually takes between 5 and 60 minutes for a public explanation to be provided.
7. Upon receiving the completion notification, open a new dialogue to review the transcription and generate the required clinical documents.
8. Disconnect the integration when it is no longer needed; the generated conversations are still handled in accordance with the retention policy or by manual deletion.

Connect to Healthie EHR

1. It is confirmed that Healthie is currently supported, while other EHRs are still in the process of being added later.
2. In the Integrations section that has been set up, select connecting to the EHR and complete the security authorization.
3. Search in the Patient Workspace and identify the correct patient to avoid incorrect connections due to identical names.
4. Load the necessary medical history and recent records so that the AI can generate drafts of SOAP, progress, or discharge documents.
5. Review each item carefully and correct any errors; the system must not be allowed to save the official medical records without confirmation.
6. After confirming the final version, synchronize it back to Healthie and check the locations of the patients and documents that have been written.
7. Revoke authorization immediately after integration is disabled or when there are changes in user permissions.

Data retention policy

There is a specific policy regarding reservations: when reservations are disabled, the conversations exist only within the current device session; they are deleted upon refreshing the browser, closing it, logging out, or starting a new chat, and files are not synchronized across different devices. When reservations are enabled, conversations and files are saved for a specified period of time and can be synchronized across devices.

On the current pricing page, it is stated that Starter is available for a period of 30 days, but the dedicated reservation policy table specifies that Starter is only available for 24 hours. The details are listed under the respective policies, and users are advised to check the actual options available in their accounts.

Which users are it suitable for

• Doctors and senior practitioners: Organize SOAP notes, progress records, test results, and draft treatment plans.
• Mental health professionals: Convert session transcripts into formats such as BIRP, DAP, EMDR, or PIE.
• Nutrition and health management agencies: They combine the information from Healthie to organize patient details, records, and follow-up data.
• Small clinics: Creating controlled team workspaces in the absence of proprietary AI infrastructure.
• Medical operations staff: Generate meeting summaries, process documents, and administrative materials that are not related to patient care.
• Telemedicine team: Uses Zoom transcription and structured notes to reduce redundant documentation.
• Medical software developers: Access chat completion or PHI anonymization functions via APIs.
• Lawyers and insurance professionals: They handle summaries of sensitive documents, but it is necessary to verify the applicable industry regulations separately.

Typical use cases

• Organize the outpatient audio recordings or key points into SOAP notes pending review.
• Extract timelines and key data from multiple medical records or examination documents.
• Generate easier-to-understand summaries of the consultation and drafts of follow-up instructions for patients.
• Transcribe psychotherapy sessions into structured records as required by the institution.
• Load the patient’s background information in Healthie and write back the reviewed notes.
• Process remote meetings and clinical sessions through Zoom’s cloud transcription service.
• Use Custom Modes to standardize the document templates and expression criteria across different members.
• First, the text is anonymized using the Redact PHI API, and then it is passed on to other controlled workflows.

Product advantages

• Predefined Modes are provided for medical workflows, rather than just an empty chat box.
• PHI Guard tokenizes the identification fields before sending the model and restores them upon retrieval.
• All paid chat plans publicly include the standard BAA application process.
• Data retention can be set by the team to none, for a short period, or for a long time, and this setting applies to all members.
• It supports various types of input, including text, documents, tables, images, audio, and handwritten content.
• It covers on-site transcription, Zoom, Healthie EHR, Patients, and Projects at the same time.
• Multiple model options, including GPT and Gemini, are available to facilitate selection based on tasks and packages.
• The standalone API offers chat completion and PHI masking, and can be integrated into medical applications.
• The privacy policy clearly states that customer content is not used to train the platform or third-party AI models.

Usage restrictions and significant risks

• Compliance with HIPAA relies on having a signed BAA, proper configuration, authorization, and user procedures; it is not achieved simply by purchasing an account.
• PHI Guard can be turned off; when it is enabled, the quality of responses may decline due to changes in context.
• AI may fabricate facts, omit negative words, misinterpret handwritten content, or provide inappropriate clinical advice.
• AI must not be allowed to carry out independently tasks such as life support, emergency response, or any other high-risk activities whose failure could result in physical harm.
• Zoom integration requires Zoom Pro, cloud recording, audio transcription, as well as a separate BAA signed with Zoom.
• Currently, the native integration for EHRs is mainly Healthie; the statement “supports EHRs” should not be interpreted as meaning coverage of all systems.
• The reference files in Custom Mode are not subject to the regular conversation retention policies; they need to be deleted and managed separately.
• Unlimited credits are mentioned in the description of the chat package; they do not mean that API usage, file size, model speed, and reasonable usage are all unlimited.
• There are discrepancies between some of the annual figures on the price page and the options available for reservation; it is necessary to verify these details on the settlement page and in the account interface before making a payment.
• HIPAA controls cannot automatically ensure compliance with all the requirements of GDPR, state laws, insurance regulations, legal professional standards, or other industries.

Chat version prices and packages

As of August 22, 2026, the price page displays four tiers: Starter, Pro, Full, and Enterprise. It also shows a 20% annual discount and the option for an annual one-time payment; however, there is an arithmetic discrepancy between the total annual cost for the Starter tier and the monthly average figure shown on the page, making it impossible to determine the hidden prices on one’s own.

All paid chat plans are listed with features such as HIPAA compliance, unlimited credits per month, PHI Guard, Custom Modes, a standard BAA, and team collaboration. Model options and plan benefits can change frequently; therefore, the information on the purchase page, order details, and organization console should be taken as the authoritative source.

API price

The API offers services similar to chat completion as well as the ability to redact PHI; developers must first register to obtain an API key. There are two separate billing systems: 15,000 calls per month and unlimited credits for chat-related functions, and these cannot be used together.

How to choose a package

• When dealing with only a single document, short-term tasks, and basic transcription, use the Starter to verify the process first.
• Choose Pro for multilingual transcription, multiple 200-page documents, or a retention period of 7 to 30 days.
• Full should be considered when indefinite retention is required, for Patients, Projects, or for more comprehensive integration.
• Contact Enterprise if you need SSO, unified governance, custom features, and dedicated support.
• When integrating capabilities into your own software, opt for a separate API; do not purchase chat subscriptions as a substitute for interface authorization.
• Before any solution is used to handle PHI, it is necessary to confirm that a BAA has been signed, that retention policies are in place, and that staff have received appropriate training.

Platform support and integration

Privacy and security

The platform states that static data is encrypted using AES-256, while transmission takes place via TLS 1.2; in addition, role-based permissions and audit logs are available. The official website also mentions that BAA agreements have been signed with key AI and infrastructure providers such as OpenAI and Google Cloud Platform.

The privacy policy states clearly that prompts, files, audio recordings, transcriptions, outputs, and PHI are not used for training, developing, or improving the platform or third-party AI models. Website registration and marketing data continue to be processed by analytics, advertising, CRM, CAPTCHA, and customer service tools.

• First sign the BAA, then handle PHI within its scope of application.
• Enable two-factor authentication and restrict team members’ access to the EHR.
• Set the retention time to the shortest period permitted by business and legal requirements.
• Include the Custom Mode files, Patient archives, and regular chats in separate deletion processes.
• Obtain the necessary consent before recording via Zoom, and check the BAA as well as the cloud settings on the Zoom side.
• Regularly check audit records, unusual logins, model changes, and member permissions.
• The privacy policy permits the processing of data in the United States and in the countries where the service providers are located; cross-border teams should conduct a separate assessment.
• No system can guarantee absolute security; in the event of any issue related to credentials or data, a response procedure must be initiated immediately.

API, SDK, and open-source status

CompliantChatGPT offers commercial APIs and API keys; its current publicly available functions include chat completion in HIPAA-related scenarios and the redaction of PHI. No official language SDKs or open-source client libraries were found during the verification process.

No verifiable official GitHub repository for the product, complete source code, or open-source license was found. The platform, PHI Guard, and API are all to be considered closed-source commercial services; the availability of public interfaces does not mean that the underlying code or models are open source.

Basic information

Recommendation score

Its recommendation score is 4.4 out of 5 points. CompliantChatGPT provides more specific medical workflows for handling PHI, BAA agreements, data retention, files, transcription, patients, projects, Healthie, and Zoom, compared to ordinary chat tools.

The main shortcomings are that compliance relies heavily on organizational settings and contracts; the activation of PHI Guard may affect accuracy. The current scope of the EHR is limited, and there are minor discrepancies between certain numbers on the pricing page and the relevant documentation. It is suitable for use as a supplementary tool in documentation and research, but it should not be used for clinical decisions without supervision.

Frequently Asked Questions

Is CompliantChatGPT free?

A 7-day free trial is available; the information on the homepage indicates that no credit card is required. For long-term use, a Starter, Pro, Full, or Enterprise subscription is necessary.

Does it really comply with HIPAA?

The platform offers technical and contractual controls that support HIPAA workflows, but organizations must configure the BAA properly and sign it; the product name or marketing identifiers alone cannot replace compliance processes.

Do all paid plans include a BAA?

The official pricing page lists the standard BAA among all paid chat options, and users can request it through the settings. Before handling PHI, it is necessary to ensure that both parties have signed the agreement.

Will PHI Guard remain active all the time?

No, it is an optional strategy; the team owner can decide to enable it or disable it, or allow team members to control it themselves. Organizations should avoid letting team members make such choices on their own without any governance in place.

Will PHI Guard affect accuracy?

It is possible; the official documentation states that tokenizing PHI reduces the model’s context, which in turn affects the quality of some responses. The level of protection and clinical accuracy need to be managed together through manual review.

Will the data be used to train models?

According to the official privacy and retention policy, customer content will not be used to train CompliantChatGPT or third-party AI models. Data related to website marketing and usage analysis is handled in accordance with the privacy policy.

Which files are supported?

It supports PDF, Word, YAML, CSV, JSON, Markdown, TXT, Excel, various image formats, and common audio formats. There are limits on the size of a single file, the number of pages, and the number of attachments per message, as specified by the plan.

Can it handle handwritten medical records?

The official website states that it is possible to read scanned and handwritten documents, but handwriting recognition may lead to errors in the identification of drug names, dosages, and numbers. Any extracted information must be verified item by item against the original documents.

Which EHRs are supported?

Currently, Healthie is natively supported; other EHRs are still under development. Do not assume that “EHR integration support” means compatibility with all medical record systems.

What is required for Zoom integration?

Zoom Pro, cloud recording, and audio transcription are required; moreover, it is necessary to establish appropriate BAA agreements with both CompliantChatGPT and Zoom. Local Zoom recording does not support this automated process.

Are APIs provided?

API Starter is available for $500 per month, including 15,000 calls; there is a charge of $0.01 per additional call. Enterprise API comes with a customized quote.

Can the unlimited credits of the chat package be used with APIs?

No, chat seats and APIs are separate products with distinct billing systems. The API comes with a set number of calls per month, and additional fees are charged for any excess usage.

Is CompliantChatGPT open source?

It is not open source; no official source code repository, SDK, or open-source license has been found. The availability of APIs does not mean that the PHI Guard code, the platform’s code, or the model codes are available for use.

Can AI be used to make direct diagnoses or prescribe medications?

AI should not be allowed to make independent decisions regarding diagnosis, prescription, emergency responses, or other high-risk decisions. It can help in creating research drafts and documents, but these must be reviewed by qualified professionals taking into account the full details of the patient’s condition.

What will be deleted after data retention is turned off?

Normal chats are not saved on the server; they are deleted when the page is refreshed, the browser is closed, or the chat is terminated or a new chat is started. Files are also not synchronized across different devices. Custom Mode allows files and patient records to have separate lifecycles, which require separate handling.

Summary

CompliantChatGPT is not merely a standard chat tool with a HIPAA label attached to it; it offers a full range of functionalities such as PHI tokenization, BAA agreements, control over data retention, clinical modes, transcription services, file management, patient record handling, as well as integration with tools like Healthie and Zoom. Its independent API allows medical software to utilize its chat capabilities along with its functions for masking PHI data.

Truly safe use still depends on signing a BAA, proper configuration, principle of least privilege, management of the data lifecycle, and professional oversight. Viewing it as a controlled assistant for clinical documentation, rather than an automatic decision-maker in medical matters, is more in line with the product’s capabilities and its risk profile.