Set up Cowork (local mode) for a HIPAA-ready organization changedcowork/hipaa-setup
Nearest release: v2.1.291, published under an hour after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 6 Oct 2026 03:05 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 22 Oct 2026 18:07 UTC.
Upstream edited
Recorded here
Lines+9added
Lines−9removed
From line
14
where the diff opens
First seen
5 Oct 2026
this site's first read of the page
Recorded edits8to this page, all time
The whole hunk
from line 14, old and new numbered
/
from line 14
1414>
1515> The Claude Code extensions for VS Code and JetBrains aren't part of (local mode). They keep working with the HIPAA configuration applied, but your BAA doesn't cover them. See the [Implementation Guide](https://trust.anthropic.com/resources?s=l1wrssd9hsbi4gak0tp5a6\&name=%5Banthropic%5D-hipaa-ready-offering-implementation-guide) for the full list of Eligible Services.
1616
17This page is for the IT or security administrator who manages the macOS and Windows computers where members run [Cowork](/docs/cowork/overview) in Claude Desktop. Other readers start on a different page:
17This page is for the IT or security administrator who manages the macOS and Windows computers where members run [Cowork](/docs/cowork/overview.md) in Claude Desktop. Other readers start on a different page:
1818
1919* **The Primary Owner, who applies the HIPAA configuration**: see [Use Claude Code (local mode) and Cowork (local mode) on a HIPAA-ready Enterprise plan](https://support.claude.com/en/articles/17318731) for what your BAA covers and how to apply the configuration
2020* **Administrators who prepare computers for Claude Code in the terminal**: see [Set up Claude Code (local mode) for a HIPAA-ready organization](https://code.claude.com/docs/en/hipaa-setup)
21* **Administrators of a third-party deployment**: see [Legal and compliance](/docs/third-party/claude-desktop/legal). The HIPAA configuration doesn't apply to [Claude Desktop on third-party platforms](/docs/third-party/claude-desktop/overview)
21* **Administrators of a third-party deployment**: see [Legal and compliance](/docs/third-party/claude-desktop/legal.md). The HIPAA configuration doesn't apply to [Claude Desktop on third-party platforms](/docs/third-party/claude-desktop/overview.md)
2222
2323The table shows when to do each part of the setup:
2424
from line 62
6262
6363### Deploy the Claude Desktop policy
6464
65A Claude Desktop policy is a set of settings that your device management tool installs on each computer, as a configuration profile on macOS or as registry values on Windows. You can use one to restrict sign-in to your organization, turn off local MCP servers and desktop extensions, and keep session content out of [Cowork monitoring](/docs/cowork/monitoring) events.
65A Claude Desktop policy is a set of settings that your device management tool installs on each computer, as a configuration profile on macOS or as registry values on Windows. You can use one to restrict sign-in to your organization, turn off local MCP servers and desktop extensions, and keep session content out of [Cowork monitoring](/docs/cowork/monitoring.md) events.
6666
6767The policy in this section is a sample that we recommend as a starting point. Your organization is responsible for deciding what its own environment needs and for confirming that its configuration meets those needs.
6868
from line 97
9797"otlpContentCapture"="[]"
9898```
9999
100The sample writes every value as a string, including `false` and `[]`. [Value types](/docs/third-party/claude-desktop/configuration#value-types) lists the other encodings Claude Desktop accepts.
100The sample writes every value as a string, including `false` and `[]`. [Value types](/docs/third-party/claude-desktop/configuration.md#value-types) lists the other encodings Claude Desktop accepts.
101101
102102> [!NOTE]
103103>
from line 105
105105
106106#### What each Claude Desktop key does
107107
108The table shows what to set each key to and what Claude Desktop enforces for it. The key names link to the [configuration reference](/docs/third-party/claude-desktop/configuration), which describes third-party deployments. Some of its keys apply only to third-party deployments, such as `coworkEgressAllowedHosts` and `otlpEndpoint`.
108The table shows what to set each key to and what Claude Desktop enforces for it. The key names link to the [configuration reference](/docs/third-party/claude-desktop/configuration.md), which describes third-party deployments. Some of its keys apply only to third-party deployments, such as `coworkEgressAllowedHosts` and `otlpEndpoint`.
109109
110110| Key | Value | What Claude Desktop enforces |
111111| :- | :- | :- |
from line 132
132132| `isLocalDevMcpEnabled` | Open **Settings** in Claude Desktop. The list of entries has no **Developer** entry |
133133| `isDesktopExtensionEnabled` | Open **Settings** in Claude Desktop. The list of entries has no **Extensions** entry |
134134| `forceLoginOrgUUID` | Sign in with an account that isn't in your organization. Claude Desktop shows "This account is not approved by your enterprise admin" |
135| `otlpContentCapture` | Run a Cowork task and read the events your [Cowork monitoring](/docs/cowork/monitoring) collector receives. They contain no prompt text, model responses, or tool inputs |
135| `otlpContentCapture` | Run a Cowork task and read the events your [Cowork monitoring](/docs/cowork/monitoring.md) collector receives. They contain no prompt text, model responses, or tool inputs |
136136
137137### Check which Claude Code managed settings apply in Cowork
138138
from line 168
168168
169169To restrict which hosts the VM reaches, you can ask an Owner to go to [**Organization settings > Capabilities**](https://claude.ai/admin-settings/capabilities) and turn off the **Allow network egress** toggle under **Code execution**. Turning the toggle off has these effects:
170170
171* **Cowork**: the VM reaches only `anthropic.com` and `claude.com` hosts, plus your OpenTelemetry collector if [Cowork monitoring](/docs/cowork/monitoring) is set up
171* **Cowork**: the VM reaches only `anthropic.com` and `claude.com` hosts, plus your OpenTelemetry collector if [Cowork monitoring](/docs/cowork/monitoring.md) is set up
172172* **Chat**: the toggle also applies to code execution in chat
173173* **[Web search](#turn-off-web-search-in-cowork) and connectors**: neither goes through the VM, so the toggle doesn't limit them
174174
from line 229
229229
230230**4. Check your monitoring events**
231231
232If your organization uses [Cowork monitoring](/docs/cowork/monitoring), run a Cowork task. Confirm that the events your collector receives contain no prompt text, model responses, or tool inputs.
232If your organization uses [Cowork monitoring](/docs/cowork/monitoring.md), run a Cowork task. Confirm that the events your collector receives contain no prompt text, model responses, or tool inputs.
233233
234234The [HIPAA feature availability table](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers) lists which Cowork features are off with the HIPAA configuration applied, and which ones an Owner can turn back on.
235235
from line 314
314314## Related resources
315315
316316* [Set up Claude Code (local mode) for a HIPAA-ready organization](https://code.claude.com/docs/en/hipaa-setup)
317* [Cowork monitoring](/docs/cowork/monitoring)
317* [Cowork monitoring](/docs/cowork/monitoring.md)
318318* [Claude Code managed settings](https://code.claude.com/docs/en/managed-settings)
319319
No line in this hunk matches that.