Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- The October 5 API changelog confirms availability for eligible organizations, without an exact release time. This guide was verified October 6 Shanghai time.
- Self-service eligibility requires established API usage history, organization-settings permissions and authority to accept the agreement. Not eligible yet is not a broken switch.
- Select the correct organization, open Settings > Organization > General, and review agreement, scope and organization identity before confirming.
- Active status does not replace checks of actual Org ID, Project, Modified Retention and eligible services before PHI processing. Support cannot be disabled in settings.
- API BAA, ChatGPT workspace eligibility and third-party responsibilities differ. One agreement does not establish coverage for every model, tool or data path.
October 5 adds an organization enrollment workflow
The October 5, 2026 API changelog says eligible organization administrators can now accept the standard Business Associate Agreement, or BAA, and enable HIPAA compliance support directly. This is an available eligibility workflow, not a future rollout notice; the exact release time is unpublished.
For healthcare application administrators and developers, start by confirming organization, authority and agreement scope rather than sending medical records as a trial. BAA means the applicable business-associate agreement. This guide explains the product workflow, not a determination that your application complies.
No enterprise agreement prerequisite does not mean universal access
The help page says an enterprise agreement is not required for an API BAA, but self-service enrollment requires established API usage history. The administrator needs organization-settings permissions and authority to accept for the organization. Login, an API key or a ChatGPT subscription does not replace these conditions.
Not eligible yet means the organization does not currently qualify for self-service enrollment. No required days, spending amount or request threshold is published; payment or plan purchase is not a guaranteed unlock. Confirm selected organization and identity, retain nonsensitive UI evidence and ask official support about eligibility.
Review before confirming organization identity
Sign into API Platform, select the intended organization, then open Settings > Organization > General. Under HIPAA compliance support select Enable, download and review the Business Associate and Healthcare Addendum, and check which API services may process protected health information, or PHI.
After review, confirm signing authority, understanding of agreement and scope, organization name and Organization ID before Agree and enable. Success displays Active. Administrators of multiple organizations must verify each separately. Do not test the button or eligibility with real PHI.
Active still requires Org ID, Project and retention checks
The eligible-products help page generally conditions API HIPAA eligibility on Modified Retention unless otherwise specified by OpenAI. The implementation guide further requires the relevant Org ID and Project to show that retention feature enabled before transmitting HIPAA inputs. Organization Active status is insufficient.
Modified Retention is not synonymous with zero retention. Different retention approaches have distinct processing and application-state boundaries. Match the agreement, organization/project configuration and current eligible endpoints. Responses or Chat Completions names do not establish coverage for all models, input types, third-party tools or downstream processing.
Support cannot be disabled in settings; signing is not full compliance
The help page explicitly says HIPAA compliance support cannot be disabled in API Platform settings once enabled. An authorized owner should review agreement and technical configuration before confirmation rather than enable first and look for an undo button. This UI limitation does not mean all contractual change channels are permanently unavailable.
Accepting the BAA and enabling support do not automatically make an application HIPAA-compliant. Customers remain responsible for evaluating use, access management, device protection, monitoring and backups. The July 9, 2026 configuration guide is referenced guidance, not entirely new October 5 rules. Resolve scope differences against your actual agreement and current docs.
Handle each status or agreement message separately
The help page distinguishes Try again for a BAA status that cannot load, another Agree and enable attempt when activation is incomplete, and Reload agreement when terms changed. Reload, download and review the new agreement before confirmation. Preserve the current organization and message instead of switching organizations and repeating from memory.
View agreement downloads a standard agreement accepted through self-service. Offline or custom BAAs are unavailable through that download. Use the documented contact channel for custom terms; the standard workflow does not let you edit them. Support requests, screenshots and attachments should contain no PHI.
API, ChatGPT and third-party responsibilities remain separate
Organization API BAA and ChatGPT workspace arrangements use different workflows. Current help separately discusses sales-managed Enterprise/Edu and eligible individual clinicians, and explicitly says ChatGPT Business does not offer a BAA. A working ChatGPT entry point does not prove API agreement or project retention eligibility.
Document signing authority, actual Org ID/Project, covered services, retention settings and data leaving OpenAI for your systems or third parties. Resolve each missing item against its responsibility and docs. A proxy, successful request or Active badge cannot replace review of the complete data path.
Sources
Frequently Asked Questions
Is self-service API BAA enrollment available?
The October 5 changelog announces it for eligible organization administrators. Exact release time and complete rollout are unpublished; check the selected organization and official eligibility.
What does Not eligible yet mean?
Current self-service conditions are unmet. Established API usage is required, but no days, spending or request threshold is published and payment cannot be promised to unlock it.
Must I buy an enterprise agreement first?
No. API BAA does not require an enterprise agreement, but organization eligibility, permissions and signing authority still apply.
Can I turn HIPAA support off afterward?
Not in API Platform settings. Review authority, agreement and configuration before enabling; this restriction does not establish that all contractual channels are unavailable.
Does Active allow real medical records immediately?
Not by itself. Check covered services, actual Org ID/Project, Modified Retention, application configuration and data paths. Signing does not automatically establish compliance.
Does API BAA cover ChatGPT Business or external tools?
Do not transfer coverage. The help page says Business offers no BAA. Third parties, your processing and API responsibilities require separate review of the agreement and data path.