Is Doximity GPT HIPAA Compliant?
Free, physician-verified, and covered for the individual, not the organization. The two are not the same question.
The Verdict
Doximity attaches a BAA to every verified clinician's membership at registration, and Doximity GPT is free for verified U.S. physicians, NPs, PAs, and medical students. Two open items keep this conditional, the BAA text does not name Doximity GPT among covered tools explicitly, and no vendor page states whether prompts are used for model training.
Individual coverage is real; organizational coverage requires the enterprise BAA.
| BAA | Member-level at registration; enterprise BAA exists per support center (unverifiable by automated fetch) |
| Trains on your data | UNVERIFIED |
| Enterprise controls | Identity verification gate; SSO, audit, and retention UNVERIFIED |
| Sources | doximity.com/baa, blog.doximity.com GPT articles; support articles 403-blocked |
The Catch
Doximity's own FAQ answers "Is Doximity Ask HIPAA compliant?" with an unqualified yes: "Users can securely include PHI in prompts, thanks to strict HIPAA-compliant protocols." That framing should give a compliance officer pause. HIPAA compliance is not a property a tool grants by assertion, it depends on whose BAA covers the disclosure and whether the clinician's employer authorized it.
A member-level BAA is real for the individual and useless for the organization, it does not add up to organizational compliance, visibility, or audit trails, and an employed clinician pasting PHI into a personal-membership tool may be making a disclosure their covered entity never sanctioned.
If Your Staff Use It
Likely your most widespread clinician AI tool because it is free and physician-verified. The org-level questions, training policy, enterprise BAA, logs, are exactly the ones only your organization can ask.
Related Resources
Continue across the compliance directory and the core governance hubs
AI Tool HIPAA Compliance Directory
Every "is X HIPAA compliant" verdict in one sourced, dated directory
Read article →HIPAA & AI Compliance
How HIPAA applies to AI tools and what OCR expects in 2026
Read article →Healthcare Shadow AI Use Cases
Where shadow AI shows up across clinical and administrative workflows
Read article →Best HIPAA Compliant AI Platforms
An independent comparison of governed AI platforms for healthcare
Read article →The Policy Question Comes Before The Membership Question
Whether it is Doximity GPT or another clinician-membership tool, the first control is a policy your staff can follow. Generate a healthcare-ready draft in minutes, then decide which tools earn a place in it.