ChatGPT security for businesses

What ChatGPT is and how organizations use it

ChatGPT is OpenAI's conversational AI product. It is available as consumer plans for individuals, as business and enterprise workspaces administered by an organization, and indirectly through the OpenAI API, which your own software or vendors' software may call.

Typical business uses include drafting and editing documents, summarizing long files, analyzing spreadsheets, writing and reviewing code, research, and customer-communication drafting. Each of these can involve internal or regulated information, which is why account type and configuration matter.

What ChatGPT can access

A plain chat session only sees what a user types or uploads. Modern ChatGPT is considerably more capable than that, and each capability widens what the tool can reach:

• Uploaded files — documents, spreadsheets, images, and code that users attach. Uploaded content is processed by the vendor and may be retained according to the account's retention settings.
• Connectors — integrations that let ChatGPT search or read from services such as cloud drives, email, calendars, or code repositories through OAuth. A connector acts with the permissions of the user who authorized it.
• Custom GPTs and actions — configurable assistants that can call external APIs. An action can send data to, or retrieve data from, a third-party endpoint defined by whoever built the GPT.
• Agent and browsing modes — modes in which ChatGPT browses the web and takes multi-step actions on a user's behalf. Content it reads on the web is untrusted input.
• Memory and history — saved preferences and conversation history that persist across sessions, which means sensitive details shared once can be retained.

Key ChatGPT security risks

1. Consumer accounts used for work

The most common exposure is not a sophisticated attack; it is employees using personal or free accounts for work. The organization cannot see those accounts, cannot enforce retention or training settings, cannot require MFA, and cannot recover data when the employee leaves. Depending on the plan and the user's own data-control settings, consumer conversations may be used to improve models.

2. Sensitive data in prompts and uploads

Patient information, privileged legal matters, customer records, financial data, and source code routinely end up in prompts because they are exactly the material people want help with. Once submitted, that data is governed by the vendor's terms for that account, not your internal policies.

3. Connectors and OAuth scope

When a user connects a drive or mailbox, ChatGPT can read what that user can read. Broad OAuth grants often persist long after the original purpose, and users rarely review them. From a security perspective, a connector is a new identity with delegated access to company data.

4. Prompt injection through web content, files, and actions

When ChatGPT reads web pages, shared documents, or API responses, hidden instructions in that content can attempt to redirect the model — for example, to summarize a document and include data from another source in a link. This is indirect prompt injection, and the risk grows when the same session also has access to sensitive data or can take actions.

5. Unreviewed outbound communication

Drafts produced by ChatGPT are usually reviewed by a person. Agentic modes and actions that can send messages, submit forms, or post content change that assumption and should be governed like any other system that can speak for your organization.

Is ChatGPT HIPAA compliant?

No AI tool is "HIPAA compliant" on its own. HIPAA obligations attach to how a covered entity or business associate uses a service: whether a Business Associate Agreement (BAA) is in place that covers the specific product and plan, how the service is configured (retention, sharing, access controls, audit logging), and whether workforce use stays within what the BAA and your policies permit.

For ChatGPT specifically, the practical questions are: Does OpenAI offer a BAA for the exact product and plan you use? Is PHI limited to accounts covered by that BAA? Are consumer accounts prohibited for PHI and technically discouraged? Are retention and sharing settings configured to match your policies? If you cannot answer yes to each, PHI should not be entered.

FlashTower flags vendor-hosted AI systems with access to PHI and no recorded BAA as a Critical finding (FT-DAT-010), and flags any use of consumer accounts with highly sensitive data as Critical (FT-DAT-011). See our guide to HIPAA and generative AI.

Questions every organization should answer

• Which ChatGPT account types are in use today — including personal accounts used for work?
• Is there an approved business or enterprise workspace, and is it connected to SSO with MFA enforced?
• Which connectors are enabled, who authorized them, and what scopes were granted?
• What are the workspace's retention settings, and are they documented?
• Is there contractual confirmation that business content is not used for model training?
• Which custom GPTs with actions are in use, and where do those actions send data?
• Is agent or browsing mode permitted, and for which roles?
• What does your acceptable-use policy say employees may and may not enter?

Recommended controls

1. Provide an approved business workspace so employees have a sanctioned option. Prohibition without an alternative drives usage to personal accounts.
2. Connect it to SSO and enforce MFA, so access is removed automatically at offboarding.
3. Review and restrict connectors. Enable only those with a documented business purpose; review OAuth grants quarterly.
4. Configure retention to the shortest period that meets business needs and document the setting.
5. Publish an acceptable-use policy that names prohibited data categories and the approved tool. See our AI acceptable-use policy guide.
6. Govern custom GPTs and actions — require review before an action can send data to an external endpoint.
7. Detect shadow use through OAuth grant reviews and expense reports. See shadow AI discovery.
8. Record the tool in your AI inventory with owner, purpose, data accessed, and vendor terms.

How FlashTower assesses this

When you add ChatGPT to a FlashTower Scan, the Risk Engine evaluates how it is actually used in your organization — account type, data accessed, capabilities, autonomy, credentials, logging, and vendor terms — against a versioned, deterministic ruleset. These rules are the most relevant for ChatGPT. Each fires only when its stated condition is met. See how scoring works.