Can Cowork be used in HIPAA scenarios now?
It depends. By default, per the documentation, Cowork is outside the BAA and must not handle PHI. On Enterprise, though, a Primary Owner can apply the HIPAA configuration, and once an Owner turns on "Enable for your organization," Cowork in Claude Desktop local mode becomes covered. Non-Enterprise plans have no such path.
Why does applying the configuration switch off cloud Cowork and connectors?
The documentation does not explain each item, but its structure shows the outline: local mode is what gets covered, while cloud and remote features, connectors, MCP, plugins and Claude in Chrome are listed as not covered. A reasonable inference is that the configuration turns off data paths outside coverage so members cannot drift into them by accident. That is inference, not an official statement.
After applying it, how do I confirm it actually took effect?
The documentation has members restart both apps and confirm that HIPAA appears in /status or that the "HIPAA configured" label shows. Do not process PHI until they confirm. Claude Code and Claude Desktop also need to be on the latest versions, since Anthropic's servers reject versions older than the minimum after application.
What should my team do now?
Confirm the plan first: only Enterprise has this path. Then inventory the connectors, plugins and scheduled tasks you rely on, since they get switched off or expire once applied. Next, confirm IT can protect local data, including full-disk encryption and deletion of session transcripts. Teams not on Enterprise keep the old rule: do not put PHI into Cowork.
The claim that circulated earlier was that "Cowork isn't covered under Anthropic's HIPAA BAA in any configuration." Anthropic now has a dedicated document describing a HIPAA-ready Enterprise configuration for "Claude Code (local mode) and Cowork (local mode)," and that claim needs updating: Cowork is still not covered by default, but on an Enterprise plan, once the configuration is applied, Cowork in Claude Desktop can be covered.
The document says it is for Enterprise plans only, and only the Primary Owner with a verified email can apply it. The "Apply HIPAA configuration" button stays grayed out until Anthropic enables it, so you ask your account team. Before applying you must accept the updated BAA and download the Implementation Guide for HIPAA Entities. Enabling HIPAA alone does not bring these local products under the BAA, and the document stresses that compliance remains your organization's responsibility.
Per the document, Cowork in Claude Desktop is covered once an Owner turns on "Enable for your organization" under Organization settings > Cowork. Before the configuration is applied, without ZDR for Claude Code neither product is covered; with ZDR, Claude Code is covered through ZDR but Cowork is not, and should not be used for PHI.
The price is substantial. Cowork and the Desktop Code section turn off until an Owner re-enables them. Connectors turn off and their tool permissions become "Blocked" unless an Owner accepted the terms earlier. The built-in GitHub integration turns off, and desktop extensions are removed from the allowlist. Claude Code on the web and cloud Cowork sessions cannot start, and running sessions stop. Remote Control and Claude Tag become unavailable, and scheduled task approvals expire.
Connectors, MCP servers, plugins, desktop extensions, Claude in Chrome and skills remain outside coverage, as do features labeled beta or research preview and cloud or remote features. What is covered is Cowork in local mode itself, not the ecosystem around it.
Healthcare-related teams now have a path worth evaluating, but it is a trade-off, not a checkbox. Confirm you are on Enterprise and can get Anthropic to enable the button. Then check each connector, plugin and scheduled task you depend on against what gets switched off. Finally, confirm IT can meet the listed requirements, including managed settings, full-disk encryption, deleting local session transcripts and disabling OpenTelemetry content capture. Do not process PHI until members confirm the HIPAA label appears. On non-Enterprise plans the earlier conclusion stands: do not put PHI into Cowork.