OpenAI’s compliance documents cover defined business offerings, and eligible enterprise and API customers can enter into a HIPAA Business Associate Agreement. Those documents describe OpenAI’s controls over OpenAI’s systems. They say little about what an employee pastes into a prompt, and that prompt is where much of the ChatGPT compliance exposure forms.