CompliantChatGPT

CompliantChatGPT is a clinical AI copilot from Light-it that wraps frontier large language models in a compliance shell able to sign a BAA. It reads lab reports, drafts SOAP notes, and summarizes sessions and treatment plans on behalf of practicing physicians, psychotherapists, and small clinics. The centerpiece is PHI Guard: before content reaches an upstream model, all eighteen HIPAA identifiers are swapped for tokens, and the answer is re-identified inside the vendor's own service.

Core capabilities

• PHI Guard de-identification: identifiers are replaced before anything reaches the model, and the re-identification map stays inside the vendor's own service
• Prebuilt clinical modes: lab reports, differential diagnosis, treatment plans, and SOAP/DAP templates, with team guidelines attachable
• Deep document reading: PDFs, scans, handwritten OCR, and spreadsheets are all ingested, with page limits set per tier
• BAA on every tier: all three subscription tiers include a standard BAA, it can be signed during the trial, and upstream disclosure covers AWS, GCP, and OpenAI
• Configurable retention: multiple settings from off to unlimited, pushed down at the team level and read-only for members
• Dual API: a Chat Completion proxy and a Redact PHI endpoint, so de-identification is sold on its own

Where it fits Independent practitioners, small clinics of two to ten people, solo psychotherapy practices, and roles at law firms, insurance claims teams, and health-tech companies that handle regulated records without prescribing. It suits people who want to sign a BAA and set retention to zero on the same day.

What sets it apart At this price point most competitors lock the BAA behind an enterprise tier; this one puts the BAA in the entry tier. Under the hood it is a self-built Laravel application plus two APIs, not a thin wrapper. The trade-off is a shallow moat: models can be swapped and modes can be copied.

Editorial take Worth a try, but do not treat the compliance copy as evidence. There is no publicly downloadable SOC 2, HITRUST, or ISO audit report anywhere on the site; the homepage says every message is protected by PHI Guard and that this is by design, yet the terms state it can be switched off, after which the model handles the full PHI context. Reputation is close to zero: no Trustpilot profile, no Capterra listing, and only single-digit upvotes on Product Hunt. The parent company is an OpenAI partner, yet the site carries no "unofficial" statement; the comparison page writes the same annual total for all three tiers. Before going to production, get the BAA text yourself and test the de-identification.