$20 vs $150: ChatGPT or an AI scribe

$20 a month buys ChatGPT Plus, the tool most practice managers already have open in a browser tab. $150 a month buys Heidi Health's Clinician plan, a documentation tool built specifically for clinicians. Both can turn a description of a patient visit into a structured note in seconds. Only one of them will sign the paperwork that makes putting a real patient's information into it legal.

That paperwork is a Business Associate Agreement, the contract HIPAA requires between a covered entity and any vendor that creates, receives, maintains, or transmits protected health information on its behalf. Without a signed BAA, using a tool with a real patient's name, diagnosis, or session content is a HIPAA violation no matter how good the output looks. "Can't we just use ChatGPT for this" comes up in almost every independent practice eventually. The honest answer depends entirely on which plan, and what is going into it.

The question every practice manager eventually asks

It usually starts with a staff member, or the owner, noticing that ChatGPT, Claude, or Gemini already produces a decent draft note or a passable patient letter, then asking why the practice is paying $150 a month for something that looks similar. That is a fair question. For a practice manager building the business case for any new tool, checking the free or cheap option first is exactly the right instinct, covered in more detail in our HIPAA questions solo clinicians ask about AI. The mistake is stopping the research at "does it work" instead of continuing to "is it legal to use with this specific piece of information."

This question sits underneath most AI decisions a small practice makes. With dozens of tools claiming to save admin time, the honest goal is not finding the single best AI product on the market, it is finding a short, defensible list of what to buy first without getting burned by a tool that looked like the obvious cheap option. A signed BAA is the cleanest filter available: it turns a subjective "which AI is best" debate into a factual "which AI is actually allowed here" answer, before a single feature gets compared.

So what for you: before comparing features, check compliance status first. A tool that produces a slightly rougher note but includes a signed BAA is usable. A tool that produces a better note but has no BAA at the price tier you can actually afford is not, regardless of how impressive it looked in a demo.

What $20 a month actually buys, and does not

OpenAI will sign a HIPAA BAA for ChatGPT Enterprise, ChatGPT Edu, eligible API endpoints, and ChatGPT for Healthcare, the enterprise product it launched in January 2026. It will not sign one for ChatGPT Free, Plus, or Team. Standard ChatGPT Plus, the $20-a-month personal plan most people already use, carries no BAA at all, and OpenAI has stated there are no circumstances in which it will enter a BAA with a ChatGPT Health user, since that product is designed for personal health literacy rather than regulated clinical operations (HIPAA Journal, "Is ChatGPT HIPAA Compliant? Updated for 2026," checked July 2026).

Anthropic's Claude follows a similar shape. A BAA is available for the Claude API under a signed agreement with specific configuration, and for Claude Enterprise on its HIPAA-ready offering. It is not available on Claude Free, Pro, Max, or Team, the plans most individuals and small teams actually use. Reaching the Enterprise tier requires a sales process, a 50-seat minimum, and an annual contract, terms built for a hospital system's IT department, not a 3-clinician independent practice (Strac, "Is Claude HIPAA Compliant? 2026 Guide," checked July 2026).

Google's Gemini sits slightly differently. A BAA is available when Gemini is accessed inside a covered Google Workspace plan or through Vertex AI on Google Cloud, correctly configured, without the same large seat minimum Claude requires. The free consumer Gemini app is not covered by any BAA (Strac, "Is Gemini HIPAA Compliant? 2026 Guide," checked July 2026). Of the three major generalist AI platforms, Google's route into compliance is the closest to something a small practice could plausibly set up itself, though it still means moving the practice's email and documents onto a business Workspace plan, not simply opening a browser tab.

So what for you: none of the roughly $20-a-month consumer plans that most staff are already using personally include a BAA. The compliant tier exists for all three platforms, but it is priced, sold, and configured for organizations far larger than a typical independent practice, exactly the kind of decision-paralysis moment our look at the real cost of AI for independent practices addresses from the other direction.

What $15 to $150 already includes

Purpose-built practice AI tools handle this differently. Jane App's native AI Scribe costs $15 per practitioner per month on its unlimited tier, and Jane's terms of use commit to entering its standard BAA with any subscriber that requests one, no sales call and no minimum seat count required. Heidi Health, priced from $40 to $180 a month depending on tier with its Clinician plan at $150 per user per month, executes a BAA as a standard part of onboarding for US customers and holds ISO 27001 and SOC 2 Type II certifications. Full pricing detail for both, alongside other AI scribe options, is in our bundled versus standalone AI scribe decision.

The pattern holds outside documentation tools too. Practice-specific AI products, whether for scribing, scheduling, or recall, are built around the assumption that the customer is a healthcare provider handling PHI from day one, so the compliance paperwork ships with the product rather than sitting behind a separate enterprise sales conversation.

So what for you: the gap between general-purpose AI and specialty practice AI is not about intelligence or writing quality. It is that specialty tools are built and priced for a practice your size, while generalist AI treats healthcare compliance as a separate, higher-priced product line.

When general-purpose AI is still the right tool

None of this means ChatGPT, Claude, or Gemini have no place in an independent practice. Drafting a patient newsletter, writing a job posting, summarizing publicly available research, building a staff training outline, or brainstorming marketing copy, none of these require a single identifiable patient detail, so the BAA question never comes up. Psychology practices weighing AI for administrative work rather than clinical notes face the same split, addressed directly in our compliance rules for AI in therapy notes.

The failure mode worth watching for is the small, well-intentioned shortcut: a clinician with five minutes before the next patient pastes a session transcript into a personal ChatGPT account to get a quick summary, or a front-desk staff member drops a scanned referral letter into Gemini to reformat it. Neither action requires malice or carelessness, only a browser tab that was already open. That single paste is the moment a practice moves from a gray area into an actual reportable incident, and it happens at the individual staff level, not in a boardroom decision.

So what for you: the decision is not "never use consumer AI tools." It is "never paste a real patient's name, date of birth, diagnosis, or session content into an account that has not signed a BAA." Everything else is a judgment call about output quality, not compliance.

The recommendation

If the task touches protected health information in any form, a patient name attached to clinical content, a chart note, a referral letter with identifying detail, use the tool with the signed BAA, even though the sticker price looks higher. At $15 to $150 a month, that is a smaller bill than a single HIPAA breach investigation, and it removes the question from every future conversation about what staff can and cannot type into a browser.

If the task is administrative and contains no patient identifiers, the $20-a-month consumer tier most staff already have is genuinely fine. Do not buy an enterprise AI contract to solve a problem a $20 subscription already handles.

If a practice has a real reason to run general-purpose AI on actual patient data at scale, a multi-site group building a custom workflow, for example, budget for the enterprise sales process from the start, and if the platform is Claude, plan around the 50-seat minimum well before it becomes a blocker. That is a genuine option for larger groups. It is rarely the right starting point for a solo or small independent practice weighing its first AI purchase.

If you want a ranked recommendation for your specific practice rather than a generic list of tools, the AI Opportunity and Growth Assessment scores your actual workflows against compliance requirements first. The starting point is a free 20-minute discovery call.

Related: 6 HIPAA questions solo clinicians ask about AI, answered · $15 vs $150: the physio AI scribe decision · From $0 to $150: the real cost of AI for an independent practice