Claude Code for healthcare websites: HIPAA considerations

Most work on a healthcare practice's website, such as page copy, layout, speed fixes, schema and redirects, never needs patient data, and the safest way to use Claude Code there is to keep it that way. If Claude Code will touch protected health information (PHI), Anthropic offers a Business Associate Agreement (BAA), but only for specific commercial setups: as of October 2026, that means Claude Code in the terminal or the desktop app's Code tab on a HIPAA-ready Claude Enterprise organization with Anthropic's "HIPAA configuration" applied, or Claude Code in an organization that has zero data retention (ZDR), such as a Console API organization with ZDR enabled. Many other ways of running Claude Code are not covered, including the VS Code and JetBrains extensions, cloud sessions and MCP connections to other services.

This guide explains what the coverage actually includes, where website teams most often stray outside it, and how to set up work so PHI stays out. This is not legal advice. Whether your practice, your agency or your developer is a covered entity or a business associate, and what your contracts must say, are questions for a healthcare privacy attorney. Anthropic's own pages say covered status only means the BAA applies; your organization still decides what to allow.

Does your website work involve PHI at all?

Federal regulations define PHI as "individually identifiable health information" held or sent in any form. On a practice website, that tends to show up in a few predictable places:

• Form submissions: appointment requests, symptom checkers, intake forms, "ask the doctor" boxes.
• Databases and exports: a CMS or CRM that stores submissions, a spreadsheet of leads, an email inbox the form writes to.
• Patient portals and booking tools connected to the site.
• Server logs and analytics that tie a visitor to a condition-specific page or form.
• Testimonials and case content drafted from real patient stories.

If the task is to rewrite the "Knee Pain Treatment" page or fix a slow homepage, none of that is needed. The risk comes when a developer clones the live database to a laptop, pastes a failed form submission into a prompt to debug it, or connects Claude to the inbox where leads arrive. Under the HIPAA rules in 45 CFR 160.103, a business associate is someone who, on behalf of a covered entity, "creates, receives, maintains, or transmits protected health information" for a regulated function, or provides certain services that involve PHI, and that includes subcontractors. Whether your web vendor fits that definition depends on what they actually touch, which is one more reason to design the work so they touch none of it.

What Anthropic's BAA covers for Claude Code

Anthropic's legal and compliance page says that if a customer has signed a BAA, it extends to Claude Code in two configurations: the HIPAA configuration ("the Claude Code CLI or the Code tab in Claude Desktop, used with a Claude for Enterprise account") and Zero Data Retention ("ZDR isn't available for all organizations"). The support article on BAAs for commercial customers (updated October 13, 2026) breaks this down by surface. A shortened version:

Two more points from the same article. The BAA "only covers the single organization that accepted it," and the coverage table for Enterprise features is marked as applying to BAA versions accepted after December 2, 2025, so check when yours was signed. And if your organization enabled HIPAA but did not apply the HIPAA configuration, Claude Code without ZDR is "Not covered."

The gaps website teams fall into

The coverage table is clear, but website work pulls in exactly the tools that sit outside it.

The editor extension

Many developers run Claude Code inside VS Code. Under the HIPAA configuration those sessions still work, but Anthropic marks them "Not covered," because "Claude Code (local mode) includes only the terminal and the Code tab." A team that thinks it is covered because it bought the right plan can be outside the BAA simply because of where it typed.

MCP servers and connectors

Connecting Claude to your CMS, CRM, analytics or email is useful, and our guide to MCP servers for website teams covers how. For PHI, though, Anthropic is explicit: connectors, the built-in GitHub integration, local MCP servers, desktop extensions and Claude in Chrome are all "Not covered." Data sent to those services is governed by your agreement with that vendor, if you have one.

Skills, plugins and fetches

Skills and plugins of every kind are listed as "Not covered," and Anthropic notes that skill and plugin security scanning "isn't available while the HIPAA configuration is applied." Web fetch, computer use and the built-in browser are not available under the configuration. Web search is covered.

Credentials that still work

Anthropic's HIPAA setup guide warns that the configuration "doesn't remove cloud provider or GitHub credentials, so a command that pushes to GitHub or calls another service still works with that developer's access. Your BAA with Anthropic doesn't cover the data it sends there." A deploy script that uploads a database export to a host is a data flow you need to account for separately.

Managed settings an IT admin deploys

Anthropic's setup guide gives a sample managed settings file, which it calls "a sample that we recommend as a starting point," adding that your organization "is responsible for deciding what its own environment needs." It sets four keys:

• forceLoginMethod set to "claudeai", so developers sign in with claude.ai rather than a Console key.
• forceLoginOrgUUID set to your organization ID, so Claude Code exits if someone signs in to a different organization.
• allowedProviders set to ["anthropic"], so Claude Code refuses to start on a cloud provider or gateway (Claude Code v2.1.285 or later; older versions ignore it).
• cleanupPeriodDays, so every computer deletes old local session data after the same number of days.

That last one matters because session transcripts are stored on each developer's computer, and Anthropic says "securing and deleting that data is your organization's responsibility." The retention sweep only runs when someone starts Claude Code, so an unused laptop keeps its data. Delivery mechanisms and verification are covered in our guide to managed settings and admin controls. Note too that organizations with the HIPAA configuration start sessions in Manual permission mode (v2.1.285 or later), and that Anthropic says whether to allow a mode such as bypass permissions "is your organization's decision." On a healthcare site, block it.

Keeping PHI out of website work

For most practices, the better plan is not to need the BAA for website work at all. A setup that achieves that:

1. Separate the site from patient data. Keep form submissions out of the website's own database where you can, and route them to a system covered by your own agreements.
2. Work on a copy with no real submissions. If a staging database is needed, strip or replace personal data before it reaches a developer's laptop. Our guide to setting up a staging copy covers the basics.
3. Debug forms with fake data. Reproduce a failure with a test submission, never by pasting a real one into a prompt.
4. Deny access to exports and logs. Add permission deny rules for folders that hold exports, backups and logs, and keep secrets out of reach as described in keeping API keys and passwords away from Claude Code.
5. Don't connect patient-facing systems such as the inbox, CRM or booking tool through MCP for routine site work, and keep the site itself patched and locked down using a website security checklist.
6. Review everything before it ships, with a person approving each deploy. The general rules are in whether Claude Code is safe for a live website.

Questions to settle with counsel and your vendor

Health claims are a separate issue from HIPAA. Anthropic's Usage Policy in force until November 12, 2026 (the September 15, 2025 version) treats healthcare as a high-risk use and requires a qualified professional to review advice "directly affecting individuals or consumers" before it goes out; Anthropic says the update taking effect that day doesn't change those requirements. Clinician review of health content, plus which website jobs suit Claude Code in a practice, is covered in our guide to Claude Code for healthcare practice websites.

Conclusion

Claude Code can be used on a healthcare website responsibly, but "HIPAA-compliant Claude Code" is not a plan you buy. Anthropic's BAA reaches a narrow set of setups on HIPAA-ready Enterprise or ZDR organizations, and common website tools, from the VS Code extension to MCP connectors, sit outside it. For most practices, the stronger approach is to keep patient data out of website work entirely, work on scrubbed copies, block risky modes, and have a clinician review health content and a person approve every deploy. Confirm the details with a healthcare privacy attorney before you start. If you want a website team that works this way, see our Claude Code development services. More guides are in our Claude Code Guide.

Frequently asked questions