Is Codex HIPAA Compliant? Local, API, and Cloud Eligibility

Is Codex HIPAA compliant? OpenAI's public documentation gives a conditional answer tied to the exact route. Codex Local signed into an eligible ChatGPT workspace can send PHI to OpenAI under that workspace's BAA. Codex Local using API credentials needs API Services with Modified Retention covered by the customer's BAA. Codex Cloud sits outside BAA coverage. Local execution and third-party services accessed by Codex also remain outside OpenAI's agreement.

TL;DR

• Codex Local is eligible when the CLI or IDE is signed into a HIPAA-eligible ChatGPT workspace. The desktop client is eligible under the same conditions when it sends PHI to OpenAI under the applicable BAA.
• Local client execution and third-party services reached by Codex fall outside OpenAI's BAA, so the customer must assess the workstation and every connected service.
• An API route needs an OpenAI BAA that covers API Services with Modified Retention for the selected organization and endpoints.
• Codex Cloud is explicitly outside BAA coverage. PHI should stay out of that hosted execution route.

Is Codex HIPAA compliant for local use

OpenAI's HIPAA-eligible products and functionality page lists Codex Local in the CLI or IDE when the client is signed into a HIPAA-eligible ChatGPT account. The same listing covers the desktop app under those conditions. When that client transmits PHI to OpenAI for processing, OpenAI says it protects the customer PHI according to the BAA.

The approval object should therefore name the client and sign-in method. It should also name the workspace and user role, plus the task and data class. A general approval for "Codex" hides the facts that establish eligibility. Confirm the eligible workspace and enabled role before testing. Then retain evidence showing the user authenticated through that workspace and the task used the approved route.

The ChatGPT Enterprise controls guide covers the broader workspace controls. A healthcare approval adds the executed BAA and PHI purpose. It also adds covered functionality and route evidence.

Local execution and third-party services stay outside the BAA

OpenAI states that its BAA excludes execution of the Codex Local Client on the customer's machines. It also excludes third-party services accessed by the local client because of customer instructions or use. OpenAI assigns the customer responsibility for the installation, operating environment, and managed configuration used with PHI.

Local execution remains the customer's responsibility. Codex can read files available to the client and run local commands under its configured permissions. It may also contact a source repository, package registry, issue tracker, or another service. Each connection creates a separate PHI decision and may require its own business-associate analysis.

Picture the review on a security architect's screen: the eligible OpenAI route is one highlighted arrow, while the workstation and every external service remain separate boxes. A green OpenAI box cannot color the other boxes green. The HIPAA BAA guide for AI vendors explains why covered-service evidence must remain attached to the actual data route.

API use requires BAA scope and Modified Retention

OpenAI lists API with Modified Retention as a HIPAA-eligible product. Its API BAA enrollment guide says an organization must enter a BAA before using the API with PHI. Eligible organizations can accept the standard agreement in the API Platform. The completed flow enables HIPAA compliance support for the selected organization and displays an Active status.

For Codex Local authenticated with an API key, record the organization ID and BAA version. Also capture the Active status and Modified Retention configuration, then the project and permitted endpoints. Add the review date. Verify that the key belongs to that organization. A key copied from another project can silently move the request outside the approved record.

I would block PHI until the reviewer can put the executed BAA and the API organization ID in the same evidence package. A sales email or generic trust page leaves the exact service and organization unresolved.

Codex Cloud is outside OpenAI's BAA coverage

The same OpenAI eligibility page lists "Use Codex in the cloud" among functionality excluded from BAA coverage and says PHI should stay out of uncovered functionality. Codex Cloud uses hosted task execution. Its cloud documentation says users select repositories and publish an environment before starting tasks in separate cloud workspaces that can contain project tools and service access.

That makes Codex Cloud a different data route from local Codex. Repository contents and task instructions enter an OpenAI-managed execution environment. Configured network access or service credentials can extend the path. A BAA covering eligible Codex Local functionality does not extend to this hosted route.

Keep the denial explicit in policy: PHI workloads use an approved local sign-in or covered API route; Codex Cloud remains unavailable for those workloads. Recheck OpenAI's published list after a product change because newly added functionality receives no automatic coverage.

HIPAA still requires customer safeguards

A BAA establishes contractual terms for the covered service. 45 CFR 164.504 requires business-associate contracts to define permitted and required uses and disclosures, then require safeguards. The contracts must also address subcontractors and specify handling at termination. The agreement sets the relationship; the deployment still needs operating controls.

45 CFR 164.308 requires risk analysis and risk management. It also requires workforce security and access management, along with activity review and incident procedures. Periodic evaluation is required. Apply those duties to the selected Codex route. Limit who can use it and define approved repositories and data classes. Review activity and manage credentials. Test denial behavior and reopen the assessment after a material change.

The PHI redaction guide for AI prompts covers data minimization before a routed model call. Redaction complements route eligibility; it cannot make Codex Cloud BAA-covered.

DeepInspect

DeepInspect can govern supported Codex Local or API traffic only when the authenticated HTTP model request is deliberately routed through it. It can evaluate identity and data policy before transmission and preserve a per-decision audit record for that request.

DeepInspect does not govern Codex Cloud's hosted execution, local commands, workstation security, or third-party services merely because Codex initiated the action. It also cannot expand OpenAI's BAA. Contract eligibility comes first; request-boundary enforcement applies to the covered route the customer controls. Book a technical deep dive at deepinspect.ai.