Set up Claude Code (local mode) for a HIPAA-ready organization changedhipaa-setup
Nearest release: v2.1.305, published 2 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 20 Oct 2026 21:32 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 22 Oct 2026 18:07 UTC.
Upstream edited
Recorded here
Lines+27added
Lines−27removed
From line
6
where the diff opens
First seen
5 Oct 2026
this site's first read of the page
Recorded edits9to this page, all time
The whole hunk
from line 6, old and new numbered
/
from line 6
66
77> [!NOTE]
88>
9> "(local mode)" means a local session, not a [cloud session](/docs/en/claude-code-on-the-web). Local sessions run in one of these places:
9> "(local mode)" means a local session, not a [cloud session](/docs/en/claude-code-on-the-web.md). Local sessions run in one of these places:
1010>
1111> * Claude Code in the terminal
1212> * Claude Code in the Code tab of Claude Desktop
from line 42
4242| Amazon Bedrock, Google Cloud's Agent Platform, Microsoft Foundry, Claude Platform on AWS, or a [Claude apps gateway](/docs/en/claude-apps-gateway) | No |
4343| An [LLM gateway](/docs/en/llm-gateway) or any other custom `ANTHROPIC_BASE_URL` | No |
4444| `ANTHROPIC_AUTH_TOKEN` or `apiKeyHelper`, on a computer with no Claude Enterprise sign-in | No |
45| A Claude Console API key or [federation credentials](/docs/en/authentication#anthropic-profiles-and-federation-credentials) | No. These sessions belong to a Claude Console organization, which has its own agreement and settings |
45| A Claude Console API key or [federation credentials](/docs/en/authentication.md#anthropic-profiles-and-federation-credentials) | No. These sessions belong to a Claude Console organization, which has its own agreement and settings |
4646
4747#### Check how a computer connects
4848
from line 58
5858
5959### Update Claude Code and Claude Desktop
6060
61The HIPAA configuration requires Claude Code v2.1.285 or later and Claude Desktop v2.19675.0 or later. If your organization uses both the terminal and the [Claude Desktop app](/docs/en/desktop), update both.
61The HIPAA configuration requires Claude Code v2.1.285 or later and Claude Desktop v2.19675.0 or later. If your organization uses both the terminal and the [Claude Desktop app](/docs/en/desktop.md), update both.
6262
6363To read the installed Claude Code version, run this command in a terminal. It's the same in Bash, Zsh, and PowerShell:
6464
from line 68
6868
6969A supported installation prints `2.1.285 (Claude Code)` or a higher number.
7070
71To read the installed Claude Desktop version, see [Check your version](/docs/en/desktop#check-your-version).
71To read the installed Claude Desktop version, see [Check your version](/docs/en/desktop.md#check-your-version).
7272
7373#### What developers see on an older version
7474
from line 79
7979| Claude Code | Each request fails with an [`API Error`](/docs/en/errors#claude-code-does-not-support-this-model) that says the version is older than the minimum version your organization's policy requires |
8080| Claude Desktop | An **Update required** dialog that tells the developer to update Claude Desktop to continue using the **Code** tab |
8181
82To keep developers on a supported version, [keep Claude Code updated](/docs/en/setup#update-claude-code). For Claude Desktop, see [Update Claude Desktop](https://claude.com/docs/cowork/hipaa-setup#update-claude-desktop).
82To keep developers on a supported version, [keep Claude Code updated](/docs/en/setup.md#update-claude-code). For Claude Desktop, see [Update Claude Desktop](https://claude.com/docs/cowork/hipaa-setup#update-claude-desktop).
8383
8484### Allow network access
8585
from line 91
9191| `claude.ai`, `claude.com`, `platform.claude.com` | Sign-in and token refresh |
9292| `sso.claude.com` | Sign-in, when your organization uses single sign-on |
9393| `downloads.claude.ai` | The native installer and its updates |
94| `mcp-proxy.anthropic.com` | [Connectors from claude.ai](/docs/en/mcp#use-mcp-servers-from-claude-ai) |
94| `mcp-proxy.anthropic.com` | [Connectors from claude.ai](/docs/en/mcp.md#use-mcp-servers-from-claude-ai) |
9595
9696This table lists the hosts a native install of Claude Code needs in the terminal to sign in, run, and update. These pages list the rest:
9797
98* **Other install methods and optional features**: [Network access requirements](/docs/en/network-config#network-access-requirements) lists the hosts that npm and Homebrew installs check for updates, and the hosts for features such as plugin installs
99* **The Code tab and Cowork**: [Desktop network access requirements](/docs/en/desktop#network-access-requirements) lists the additional hosts Claude Desktop needs
100* **Proxies that inspect TLS**: [Custom CA certificates](/docs/en/network-config#custom-ca-certificates) shows how to trust your proxy's certificate
98* **Other install methods and optional features**: [Network access requirements](/docs/en/network-config.md#network-access-requirements) lists the hosts that npm and Homebrew installs check for updates, and the hosts for features such as plugin installs
99* **The Code tab and Cowork**: [Desktop network access requirements](/docs/en/desktop.md#network-access-requirements) lists the additional hosts Claude Desktop needs
100* **Proxies that inspect TLS**: [Custom CA certificates](/docs/en/network-config.md#custom-ca-certificates) shows how to trust your proxy's certificate
101101
102102Sessions that go through a corporate HTTPS proxy are still eligible for the HIPAA configuration, as long as the proxy can reach the hosts in the table.
103103
from line 107
107107
108108### Deploy managed settings
109109
110You can use [managed settings](/docs/en/managed-settings) to direct developers to sign in with a Claude Enterprise account, to block cloud providers and gateways, and to set how many days every computer keeps local session data. The settings apply whether or not the HIPAA configuration is in effect.
110You can use [managed settings](/docs/en/managed-settings.md) to direct developers to sign in with a Claude Enterprise account, to block cloud providers and gateways, and to set how many days every computer keeps local session data. The settings apply whether or not the HIPAA configuration is in effect.
111111
112112The settings in this section are a sample that we recommend as a starting point. Your organization is responsible for deciding what its own environment needs and for confirming that its configuration meets those needs.
113113
114The following sample sets four keys that you could add to the [managed settings](/docs/en/managed-settings#choose-a-delivery-mechanism) your organization deploys:
114The following sample sets four keys that you could add to the [managed settings](/docs/en/managed-settings.md#choose-a-delivery-mechanism) your organization deploys:
115115
116116```json theme={null}
117117{
from line 131
131131| Key | Set it to | What Claude Code enforces |
132132| :- | :- | :- |
133133| [`forceLoginMethod`](/docs/en/settings-reference#forceloginmethod) | `"claudeai"` | Claude Code directs developers to claude.ai sign-in instead of Claude Console |
134| [`forceLoginOrgUUID`](/docs/en/settings-reference#forceloginorguuid) | Your organization ID, which an [Owner](/docs/en/server-managed-settings#access-control) can copy from [claude.ai admin settings](https://claude.ai/admin-settings/organization) | Claude Code exits at startup when the claude.ai sign-in belongs to another organization |
134| [`forceLoginOrgUUID`](/docs/en/settings-reference#forceloginorguuid) | Your organization ID, which an [Owner](/docs/en/server-managed-settings.md#access-control) can copy from [claude.ai admin settings](https://claude.ai/admin-settings/organization) | Claude Code exits at startup when the claude.ai sign-in belongs to another organization |
135135| [`allowedProviders`](/docs/en/settings-reference#allowedproviders) | `["anthropic"]` | Claude Code refuses to start on a cloud provider or a gateway |
136136| [`cleanupPeriodDays`](/docs/en/settings-reference#cleanupperioddays) | The number of days your records policy lets a computer keep session data | Every computer deletes old session data after the same number of days |
137137
from line 145
145145
146146#### Confirm the settings loaded
147147
148On a computer that has the settings, run `claude`, sign in with a Claude Enterprise account, and enter `/status`. The `Setting sources` line lists `Enterprise managed settings` followed by the source in parentheses, such as `(file)`, and the `Allowed providers` line reads `Anthropic API (managed allowedProviders)`. If `Setting sources` doesn't list it, or the `Allowed providers` line is missing, see [Check that a policy is in force](/docs/en/managed-settings#check-that-a-policy-is-in-force).
148On a computer that has the settings, run `claude`, sign in with a Claude Enterprise account, and enter `/status`. The `Setting sources` line lists `Enterprise managed settings` followed by the source in parentheses, such as `(file)`, and the `Allowed providers` line reads `Anthropic API (managed allowedProviders)`. If `Setting sources` doesn't list it, or the `Allowed providers` line is missing, see [Check that a policy is in force](/docs/en/managed-settings.md#check-that-a-policy-is-in-force).
149149
150150#### Sessions the managed settings keys don't block
151151
152152Even with these keys deployed, some sessions can still run without the HIPAA configuration:
153153
154* **Claude Console sign-ins and federation credentials**: `forceLoginOrgUUID` checks only claude.ai sign-ins. [Restrict login to your organization](/docs/en/authentication#restrict-login-to-your-organization) lists what Claude Code checks for each sign-in path and credential.
155* **Server-managed settings**: if your organization also uses [server-managed settings](/docs/en/server-managed-settings), have an Owner add the same keys there. [How Claude Code combines managed sources](/docs/en/managed-settings#how-claude-code-combines-managed-sources) explains which source applies.
154* **Claude Console sign-ins and federation credentials**: `forceLoginOrgUUID` checks only claude.ai sign-ins. [Restrict login to your organization](/docs/en/authentication.md#restrict-login-to-your-organization) lists what Claude Code checks for each sign-in path and credential.
155* **Server-managed settings**: if your organization also uses [server-managed settings](/docs/en/server-managed-settings.md), have an Owner add the same keys there. [How Claude Code combines managed sources](/docs/en/managed-settings.md#how-claude-code-combines-managed-sources) explains which source applies.
156156* **Versions older than v2.1.285**: these versions ignore `allowedProviders`, so they can still start on a cloud provider or a gateway. To make v2.1.163 through v2.1.284 refuse to start, you can add [`requiredMinimumVersion`](/docs/en/settings-reference#requiredminimumversion) set to `"2.1.285"` to the same managed settings as the [sample keys](#deploy-managed-settings). Versions before v2.1.163 ignore `requiredMinimumVersion` as well as `allowedProviders`, so [update those computers](#update-claude-code-and-claude-desktop).
157157
158158To find out whether your BAA covers a session that runs without the HIPAA configuration, see [Use Claude Code (local mode) and Cowork (local mode) on a HIPAA-ready Enterprise plan](https://support.claude.com/en/articles/17318731).
from line 196
196196| What a developer notices | Why |
197197| :- | :- |
198198| The WebFetch tool is unavailable | WebFetch is off. Web search still works |
199| `--cloud`, `/teleport`, and [Remote Control](/docs/en/remote-control) are refused | [Cloud sessions](/docs/en/claude-code-on-the-web) and Remote Control are off |
199| `--cloud`, `/teleport`, and [Remote Control](/docs/en/remote-control.md) are refused | [Cloud sessions](/docs/en/claude-code-on-the-web.md) and Remote Control are off |
200200| `/feedback` and `/bug` are unavailable | Feedback submission is off |
201| Claude can't publish an [artifact](/docs/en/artifacts) | Artifact publishing is off |
202| MCP tools load into context upfront | [MCP tool search](/docs/en/mcp#configure-tool-search) is off. Neither `ENABLE_TOOL_SEARCH` nor managed settings turns it back on |
201| Claude can't publish an [artifact](/docs/en/artifacts.md) | Artifact publishing is off |
202| MCP tools load into context upfront | [MCP tool search](/docs/en/mcp.md#configure-tool-search) is off. Neither `ENABLE_TOOL_SEARCH` nor managed settings turns it back on |
203203| An MCP server or hook that reads `ANTHROPIC_API_KEY` stops authenticating | Claude Code [removes Anthropic credentials](#anthropic-credentials-in-commands-hooks-and-mcp-servers) from the processes it starts |
204204| Restrictions remain after `/login` to a different organization | The HIPAA status lasts until Claude Code restarts |
205205
from line 209
209209
210210The HIPAA configuration doesn't remove cloud provider or GitHub credentials, so a command that pushes to GitHub or calls another service still works with that developer's access. Your BAA with Anthropic doesn't cover the data it sends there. See the [Implementation Guide](https://trust.anthropic.com/resources?s=l1wrssd9hsbi4gak0tp5a6\&name=%5Banthropic%5D-hipaa-ready-offering-implementation-guide) for the full list of Eligible Services.
211211
212To limit which commands and hosts Claude can use, see [permission rules](/docs/en/permissions) and the [sandbox](/docs/en/sandboxing).
212To limit which commands and hosts Claude can use, see [permission rules](/docs/en/permissions.md) and the [sandbox](/docs/en/sandboxing.md).
213213
214214## Manage local session data
215215
from line 217
217217
218218### Claude Code data
219219
220[Application data](/docs/en/claude-directory#application-data) lists what Claude Code (local mode) stores on a computer, what its retention sweep deletes after `cleanupPeriodDays`, and what stays until someone deletes it. The same page states what differs in an organization with the HIPAA configuration applied.
220[Application data](/docs/en/claude-directory.md#application-data) lists what Claude Code (local mode) stores on a computer, what its retention sweep deletes after `cleanupPeriodDays`, and what stays until someone deletes it. The same page states what differs in an organization with the HIPAA configuration applied.
221221
222222The retention sweep runs only when someone starts Claude Code, so a computer where nobody starts it keeps its data.
223223
from line 225
225225
226226The Code tab stores data in these places:
227227
228* **Transcripts**: in `~/.claude/projects/`, alongside terminal transcripts. [Cleaned up automatically](/docs/en/claude-directory#cleaned-up-automatically) states when the retention sweep deletes them.
228* **Transcripts**: in `~/.claude/projects/`, alongside terminal transcripts. [Cleaned up automatically](/docs/en/claude-directory.md#cleaned-up-automatically) states when the retention sweep deletes them.
229229* **The Claude Desktop data folder**: `~/Library/Application Support/Claude` on macOS. On Windows, `%APPDATA%\Claude`, or `%LOCALAPPDATA%\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude` for the installer downloaded from Anthropic, so check both. With the HIPAA configuration applied, Claude Desktop deletes local Code tab sessions that have been inactive for longer than `cleanupPeriodDays`, including starred ones. It deletes them only while it's running. Claude Desktop handles a deleted session's worktree in one of these ways:
230230 * **No uncommitted changes, the session isn't starred or pinned, and no other session is using the worktree**: Claude Desktop removes the worktree
231231 * **Any other case**: the worktree stays on the computer
from line 254
254254
255255Either command deletes every project's transcripts and auto memory, the entries in `tasks/`, `debug/`, and `file-history/`, `history.jsonl`, and the project entries in `~/.claude.json`. Without `--yes`, it prints the plan and asks first.
256256
257The purge leaves other paths that can hold session content, such as pasted text in `paste-cache/`. [Clear local data](/docs/en/claude-directory#clear-local-data) lists the paths you can delete by hand. To clear a computer completely, for example before you reassign it, [wipe it](#offboard-a-developer).
257The purge leaves other paths that can hold session content, such as pasted text in `paste-cache/`. [Clear local data](/docs/en/claude-directory.md#clear-local-data) lists the paths you can delete by hand. To clear a computer completely, for example before you reassign it, [wipe it](#offboard-a-developer).
258258
259259### Offboard a developer
260260
from line 263
263263## Related resources
264264
265265* [Set up Cowork (local mode) for a HIPAA-ready organization](https://claude.com/docs/cowork/hipaa-setup)
266* [Deploy managed settings](/docs/en/managed-settings)
266* [Deploy managed settings](/docs/en/managed-settings.md)
267267* [HIPAA settings example](https://github.com/anthropics/claude-code/tree/main/examples/settings)
268* [Enterprise network configuration](/docs/en/network-config)
269* [Zero data retention](/docs/en/zero-data-retention)
270* [Legal and compliance](/docs/en/legal-and-compliance)
271* [Data usage](/docs/en/data-usage)
268* [Enterprise network configuration](/docs/en/network-config.md)
269* [Zero data retention](/docs/en/zero-data-retention.md)
270* [Legal and compliance](/docs/en/legal-and-compliance.md)
271* [Data usage](/docs/en/data-usage.md)
272272
No line in this hunk matches that.