Set up Cowork (local mode) for a HIPAA-ready organization changedcowork/hipaa-setup
Nearest release: v2.1.291, published under an hour after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 6 Oct 2026 03:05 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 20 Oct 2026 18:07 UTC.
Upstream edited
Recorded here
Lines+80added
Lines−86removed
From line
4
where the diff opens
First seen
5 Oct 2026
this site's first read of the page
Recorded edits4to this page, all time
The whole hunk
from line 4, old and new numbered
/
from line 4
44
55The HIPAA configuration is an organization setting on Claude Enterprise plans, for organizations that handle protected health information (PHI) and have a [Business Associate Agreement (BAA)](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers) with Anthropic. It applies to Claude Code (local mode) and Cowork (local mode), and it restricts features in both products.
66
7<Note>
8 "(local mode)" means a local session, not a session that runs in the cloud. Local sessions run in one of these places:
7> [!NOTE]
8>
9> "(local mode)" means a local session, not a session that runs in the cloud. Local sessions run in one of these places:
10>
11> * Claude Code in the terminal
12> * Claude Code in the Code tab of Claude Desktop
13> * Cowork in Claude Desktop
14>
15> The Claude Code extensions for VS Code and JetBrains aren't part of (local mode). They keep working with the HIPAA configuration applied, but your BAA doesn't cover them. See the [Implementation Guide](https://trust.anthropic.com/resources?s=l1wrssd9hsbi4gak0tp5a6\&name=%5Banthropic%5D-hipaa-ready-offering-implementation-guide) for the full list of Eligible Services.
916
10 * Claude Code in the terminal
11 * Claude Code in the Code tab of Claude Desktop
12 * Cowork in Claude Desktop
13
14 The Claude Code extensions for VS Code and JetBrains aren't part of (local mode). They keep working with the HIPAA configuration applied, but your BAA doesn't cover them. See the [Implementation Guide](https://trust.anthropic.com/resources?s=l1wrssd9hsbi4gak0tp5a6\&name=%5Banthropic%5D-hipaa-ready-offering-implementation-guide) for the full list of Eligible Services.
15</Note>
16
1717This page is for the IT or security administrator who manages the macOS and Windows computers where members run [Cowork](/docs/cowork/overview) in Claude Desktop. Other readers start on a different page:
1818
1919* **The Primary Owner, who applies the HIPAA configuration**: see [Use Claude Code (local mode) and Cowork (local mode) on a HIPAA-ready Enterprise plan](https://support.claude.com/en/articles/17318731) for what your BAA covers and how to apply the configuration
from line 68
6868
6969The following sample sets four keys that you could add to the Claude Desktop policy your organization deploys. If your organization doesn't deploy one yet, [Enterprise configuration](https://support.claude.com/en/articles/12622667-enterprise-configuration) explains how to deliver a policy with your device management tool.
7070
71<Tabs>
72 <Tab title="macOS">
73 Add these keys to a configuration profile for the `com.anthropic.claudefordesktop` preference domain:
71**macOS**
7472
75 ```xml theme={null}
76 <key>forceLoginOrgUUID</key>
77 <string>xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx</string>
78 <key>isLocalDevMcpEnabled</key>
79 <string>false</string>
80 <key>isDesktopExtensionEnabled</key>
81 <string>false</string>
82 <key>otlpContentCapture</key>
83 <string>[]</string>
84 ```
85 </Tab>
73Add these keys to a configuration profile for the `com.anthropic.claudefordesktop` preference domain:
8674
87 <Tab title="Windows">
88 Write these values under `HKLM\SOFTWARE\Policies\Claude`:
75```xml theme={null}
76<key>forceLoginOrgUUID</key>
77<string>xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx</string>
78<key>isLocalDevMcpEnabled</key>
79<string>false</string>
80<key>isDesktopExtensionEnabled</key>
81<string>false</string>
82<key>otlpContentCapture</key>
83<string>[]</string>
84```
8985
90 ```reg theme={null}
91 Windows Registry Editor Version 5.00
86**Windows**
9287
93 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Claude]
94 "forceLoginOrgUUID"="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
95 "isLocalDevMcpEnabled"="false"
96 "isDesktopExtensionEnabled"="false"
97 "otlpContentCapture"="[]"
98 ```
99 </Tab>
100</Tabs>
88Write these values under `HKLM\SOFTWARE\Policies\Claude`:
10189
90```reg theme={null}
91Windows Registry Editor Version 5.00
92
93[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Claude]
94"forceLoginOrgUUID"="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
95"isLocalDevMcpEnabled"="false"
96"isDesktopExtensionEnabled"="false"
97"otlpContentCapture"="[]"
98```
99
102100The sample writes every value as a string, including `false` and `[]`. [Value types](/docs/third-party/claude-desktop/configuration#value-types) lists the other encodings Claude Desktop accepts.
103101
104<Note>
105 The Claude Desktop policy is separate from Claude Code's managed settings, which [also apply to Cowork](#check-which-claude-code-managed-settings-apply-in-cowork).
106</Note>
102> [!NOTE]
103>
104> The Claude Desktop policy is separate from Claude Code's managed settings, which [also apply to Cowork](#check-which-claude-code-managed-settings-apply-in-cowork).
107105
108106#### What each Claude Desktop key does
109107
from line 116
118116
119117Cowork monitoring sends events to the OpenTelemetry collector that your organization sets up. When `otlpContentCapture` isn't set, those events can include prompt text, model responses, and tool inputs.
120118
121<Warning>
122 Check these values before you deploy:
119> [!WARNING]
120>
121> Check these values before you deploy:
122>
123> * **`otlpContentCapture`**: write the two characters `[]`. Claude Desktop reads an empty string as if the key weren't set, and Cowork monitoring events can then include prompt text, model responses, and tool inputs.
124> * **`forceLoginOrgUUID`**: if you deploy a value that Claude Desktop can't read as an organization ID, nobody can use the app on that computer. Members see "Sign-in is blocked by this device’s configuration".
123125
124 * **`otlpContentCapture`**: write the two characters `[]`. Claude Desktop reads an empty string as if the key weren't set, and Cowork monitoring events can then include prompt text, model responses, and tool inputs.
125 * **`forceLoginOrgUUID`**: if you deploy a value that Claude Desktop can't read as an organization ID, nobody can use the app on that computer. Members see "Sign-in is blocked by this device’s configuration".
126</Warning>
127
128126#### Confirm the Claude Desktop policy loaded
129127
130128Claude Desktop applies these keys when it starts, so quit Claude Desktop on a managed computer and open it again first. The table shows how to check each key.
from line 188
190188
191189The `disabledBuiltinTools` key takes a list of tool names, written as a string:
192190
193<Tabs>
194 <Tab title="macOS">
195 Add the key to the profile for the `com.anthropic.claudefordesktop` preference domain:
191**macOS**
196192
197 ```xml theme={null}
198 <key>disabledBuiltinTools</key>
199 <string>["WebSearch"]</string>
200 ```
201 </Tab>
193Add the key to the profile for the `com.anthropic.claudefordesktop` preference domain:
202194
203 <Tab title="Windows">
204 Add the value under `HKLM\SOFTWARE\Policies\Claude`:
195```xml theme={null}
196<key>disabledBuiltinTools</key>
197<string>["WebSearch"]</string>
198```
205199
206 ```reg theme={null}
207 "disabledBuiltinTools"="[\"WebSearch\"]"
208 ```
209 </Tab>
210</Tabs>
200**Windows**
211201
202Add the value under `HKLM\SOFTWARE\Policies\Claude`:
203
204```reg theme={null}
205"disabledBuiltinTools"="[\"WebSearch\"]"
206```
207
212208After a member restarts Claude Desktop, Claude can't search the web in Cowork tasks or Code tab sessions on that computer.
213209
214<Warning>
215 If you deploy a `disabledBuiltinTools` value that Claude Desktop can't read as a list, Claude Desktop turns off every built-in tool.
216</Warning>
210> [!WARNING]
211>
212> If you deploy a `disabledBuiltinTools` value that Claude Desktop can't read as a list, Claude Desktop turns off every built-in tool.
217213
218214## Confirm the HIPAA configuration in Claude Desktop
219215
220216Run this check on one managed computer after the Primary Owner applies the HIPAA configuration.
221217
222<Steps>
223 <Step title="Ask an Owner to turn Cowork back on">
224 Applying the HIPAA configuration turns Cowork off for your organization. Ask an Owner to go to [**Organization settings > Cowork**](https://claude.ai/admin-settings/cowork) and turn on the **Enable for your organization** toggle.
225 </Step>
218**1. Ask an Owner to turn Cowork back on**
226219
227 <Step title="Restart Claude Desktop">
228 Quit Claude Desktop and open it again.
229 </Step>
220Applying the HIPAA configuration turns Cowork off for your organization. Ask an Owner to go to [**Organization settings > Cowork**](https://claude.ai/admin-settings/cowork) and turn on the **Enable for your organization** toggle.
230221
231 <Step title="Check the title bar">
232 Confirm that the title bar shows a **HIPAA configured** label. On a Mac, open the sidebar to see it.
233 </Step>
222**2. Restart Claude Desktop**
234223
235 <Step title="Check your monitoring events">
236 If your organization uses [Cowork monitoring](/docs/cowork/monitoring), run a Cowork task. Confirm that the events your collector receives contain no prompt text, model responses, or tool inputs.
237 </Step>
238</Steps>
224Quit Claude Desktop and open it again.
225
226**3. Check the title bar**
227
228Confirm that the title bar shows a **HIPAA configured** label. On a Mac, open the sidebar to see it.
229
230**4. Check your monitoring events**
231
232If your organization uses [Cowork monitoring](/docs/cowork/monitoring), run a Cowork task. Confirm that the events your collector receives contain no prompt text, model responses, or tool inputs.
239233
240234The [HIPAA feature availability table](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers) lists which Cowork features are off with the HIPAA configuration applied, and which ones an Owner can turn back on.
241235
No line in this hunk matches that.