Running Claude in Regulated Environments

Anthropic offers a HIPAA BAA for its HIPAA-ready services (the Claude API with HIPAA configuration enabled, and HIPAA-ready Enterprise plans); a BAA doesn’t require ZDR. Running Claude on AWS Bedrock or Google Vertex places it under your cloud provider’s compliance envelope. Confirm scope with Anthropic, the provider, and your compliance team.

Under an approved ZDR arrangement, Anthropic doesn’t store your inputs or outputs except as required by law or for safety enforcement (it still keeps safety classifier results). It’s available to approved Claude API and Enterprise customers.

 Yes — via AWS Bedrock or Google Vertex you choose the region, and a gateway lets you set it (with per-model overrides) and keep request data in your own regional storage.

Not necessarily — a BAA and ZDR are separate. A BAA can run with standard retention; ZDR is the control that removes storage. Choose based on whether your requirement is “no retention” or “signed BAA to process PHI.”

Apply a PII guardrail at the gateway that redacts sensitive fields on input and in tool results before the request reaches the model, so raw identifiers never leave your environment.