Need to confirm BAA coverage

Probably yes, but the model name and deployment type don’t settle it on their own.

GPT-5.4-mini (version 2026-03-17) is available on Azure, and DataZoneStandard is a supported deployment type for it. That deployment type just means your requests are processed inside a specific Microsoft data zone. It’s about where your data is handled, not about whether the BAA applies.

BAA coverage is a separate question. Microsoft applies it to the Azure OpenAI service as a whole, through your agreement with them, rather than model by model. So what matters is whether your subscription is covered by the BAA and whether you’re using the service the way it’s covered, which for Azure OpenAI generally means production, text-based workloads.

Before putting PHI through it, confirm both points with your Microsoft agreement or account team.

Before processing protected health information (PHI), obtain written confirmation from Microsoft that GPT-5.4-mini, version 2026-03-17, using DataZoneStandard through your specific Azure service, is within the scope of its HIPAA BAA.

Official references:

Microsoft HIPAA compliance and BAA

Microsoft Foundry deployment types

Microsoft Foundry GPT-5.4-mini catalog