Set up Cowork (local mode) for a HIPAA-ready organization changedcowork/hipaa-setup
Nearest release: v2.1.309, published under an hour before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 22 Oct 2026 21:10 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 23 Oct 2026 18:07 UTC.
Upstream edited
Recorded here
Lines+14added
Lines−14removed
From line
14
where the diff opens
First seen
5 Oct 2026
this site's first read of the page
Recorded edits8to this page, all time
The whole hunk
from line 14, old and new numbered
/
from line 14
1414>
1515> The Claude Code extensions for VS Code and JetBrains aren't part of (local mode). They keep working with the HIPAA configuration applied, but your BAA doesn't cover them. See the [Implementation Guide](https://trust.anthropic.com/resources?s=l1wrssd9hsbi4gak0tp5a6\&name=%5Banthropic%5D-hipaa-ready-offering-implementation-guide) for the full list of Eligible Services.
1616
17This page is for the IT or security administrator who manages the macOS and Windows computers where members run [Cowork](/docs/cowork/overview.md) in Claude Desktop. Other readers start on a different page:
17This page is for the IT or security administrator who manages the macOS and Windows computers where members run [Cowork](https://claude.com/docs/cowork/overview.md) in Claude Desktop. Other readers start on a different page:
1818
1919* **The Primary Owner, who applies the HIPAA configuration**: see [Use Claude Code (local mode) and Cowork (local mode) on a HIPAA-ready Enterprise plan](https://support.claude.com/en/articles/17318731) for what your BAA covers and how to apply the configuration
2020* **Administrators who prepare computers for Claude Code in the terminal**: see [Set up Claude Code (local mode) for a HIPAA-ready organization](https://code.claude.com/docs/en/hipaa-setup)
21* **Administrators of a third-party deployment**: see [Legal and compliance](/docs/third-party/claude-desktop/legal.md). The HIPAA configuration doesn't apply to [Claude Desktop on third-party platforms](/docs/third-party/claude-desktop/overview.md)
21* **Administrators of a third-party deployment**: see [Legal and compliance](https://claude.com/docs/third-party/claude-desktop/legal.md). The HIPAA configuration doesn't apply to [Claude Desktop on third-party platforms](https://claude.com/docs/third-party/claude-desktop/overview.md)
2222
2323The table shows when to do each part of the setup:
2424
from line 48
4848On an older version, members see an **Update required** dialog that tells them to update Claude Desktop. The dialog's text names Code, but members see it in Cowork too. What the dialog offers depends on whether automatic updates are on:
4949
5050* **Automatic updates are on**: the dialog has an **Update now** button
51* **You turned off automatic updates** with the [`disableAutoUpdates`](/docs/third-party/claude-desktop/configuration#disableautoupdates) key: the dialog tells the member to ask their administrator. Deploy each new version with your device management tool. On macOS, and on Windows where Claude Desktop was installed from the `.msix` package, once the newer version is on the device the dialog has an **Update now** button instead.
51* **You turned off automatic updates** with the [`disableAutoUpdates`](https://claude.com/docs/third-party/claude-desktop/configuration#disableautoupdates) key: the dialog tells the member to ask their administrator. Deploy each new version with your device management tool. On macOS, and on Windows where Claude Desktop was installed from the `.msix` package, once the newer version is on the device the dialog has an **Update now** button instead.
5252
5353### Allow network access for Claude Desktop
5454
from line 62
6262
6363### Deploy the Claude Desktop policy
6464
65A Claude Desktop policy is a set of settings that your device management tool installs on each computer, as a configuration profile on macOS or as registry values on Windows. You can use one to restrict sign-in to your organization, turn off local MCP servers and desktop extensions, and keep session content out of [Cowork monitoring](/docs/cowork/monitoring.md) events.
65A Claude Desktop policy is a set of settings that your device management tool installs on each computer, as a configuration profile on macOS or as registry values on Windows. You can use one to restrict sign-in to your organization, turn off local MCP servers and desktop extensions, and keep session content out of [Cowork monitoring](https://claude.com/docs/cowork/monitoring.md) events.
6666
6767The policy in this section is a sample that we recommend as a starting point. Your organization is responsible for deciding what its own environment needs and for confirming that its configuration meets those needs.
6868
from line 97
9797"otlpContentCapture"="[]"
9898```
9999
100The sample writes every value as a string, including `false` and `[]`. [Value types](/docs/third-party/claude-desktop/configuration-format.md#value-types) lists the other encodings Claude Desktop accepts.
100The sample writes every value as a string, including `false` and `[]`. [Value types](https://claude.com/docs/third-party/claude-desktop/configuration-format.md#value-types) lists the other encodings Claude Desktop accepts.
101101
102102> [!NOTE]
103103>
from line 105
105105
106106#### What each Claude Desktop key does
107107
108The table shows what to set each key to and what Claude Desktop enforces for it. The key names link to the [configuration reference](/docs/third-party/claude-desktop/configuration.md), which describes third-party deployments. Some of its keys apply only to third-party deployments, such as `coworkEgressAllowedHosts` and `otlpEndpoint`.
108The table shows what to set each key to and what Claude Desktop enforces for it. The key names link to the [configuration reference](https://claude.com/docs/third-party/claude-desktop/configuration.md), which describes third-party deployments. Some of its keys apply only to third-party deployments, such as `coworkEgressAllowedHosts` and `otlpEndpoint`.
109109
110110| Key | Value | What Claude Desktop enforces |
111111| :- | :- | :- |
112112| `forceLoginOrgUUID` | Your organization ID, which an Owner can copy from [claude.ai admin settings](https://claude.ai/admin-settings/organization) | After a member of your organization signs in, Claude Desktop switches them to your organization. Anyone else sees a page that reads "This account is not approved by your enterprise admin" and can only log out |
113| [`isLocalDevMcpEnabled`](/docs/third-party/claude-desktop/configuration#islocaldevmcpenabled) | `false` | Members can't add local MCP servers to chat or Cowork. Local MCP servers that plugins provide stop loading too, including plugins your organization distributes. Claude Desktop also skips the setup that connects it to the Claude in Chrome extension |
114| [`isDesktopExtensionEnabled`](/docs/third-party/claude-desktop/configuration#isdesktopextensionenabled) | `false` | Installed desktop extensions stop loading, and members can't install new ones |
115| [`otlpContentCapture`](/docs/third-party/claude-desktop/configuration#otlpcontentcapture) | `[]` | Cowork monitoring events carry metadata only |
113| [`isLocalDevMcpEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#islocaldevmcpenabled) | `false` | Members can't add local MCP servers to chat or Cowork. Local MCP servers that plugins provide stop loading too, including plugins your organization distributes. Claude Desktop also skips the setup that connects it to the Claude in Chrome extension |
114| [`isDesktopExtensionEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#isdesktopextensionenabled) | `false` | Installed desktop extensions stop loading, and members can't install new ones |
115| [`otlpContentCapture`](https://claude.com/docs/third-party/claude-desktop/configuration#otlpcontentcapture) | `[]` | Cowork monitoring events carry metadata only |
116116
117117Cowork monitoring sends events to the OpenTelemetry collector that your organization sets up. When `otlpContentCapture` isn't set, those events can include prompt text, model responses, and tool inputs.
118118
from line 132
132132| `isLocalDevMcpEnabled` | Open **Settings** in Claude Desktop. The list of entries has no **Developer** entry |
133133| `isDesktopExtensionEnabled` | Open **Settings** in Claude Desktop. The list of entries has no **Extensions** entry |
134134| `forceLoginOrgUUID` | Sign in with an account that isn't in your organization. Claude Desktop shows "This account is not approved by your enterprise admin" |
135| `otlpContentCapture` | Run a Cowork task and read the events your [Cowork monitoring](/docs/cowork/monitoring.md) collector receives. They contain no prompt text, model responses, or tool inputs |
135| `otlpContentCapture` | Run a Cowork task and read the events your [Cowork monitoring](https://claude.com/docs/cowork/monitoring.md) collector receives. They contain no prompt text, model responses, or tool inputs |
136136
137137### Check which Claude Code managed settings apply in Cowork
138138
from line 168
168168
169169To restrict which hosts the VM reaches, you can ask an Owner to go to [**Organization settings > Capabilities**](https://claude.ai/admin-settings/capabilities) and turn off the **Allow network egress** toggle under **Code execution**. Turning the toggle off has these effects:
170170
171* **Cowork**: the VM reaches only `anthropic.com` and `claude.com` hosts, plus your OpenTelemetry collector if [Cowork monitoring](/docs/cowork/monitoring.md) is set up
171* **Cowork**: the VM reaches only `anthropic.com` and `claude.com` hosts, plus your OpenTelemetry collector if [Cowork monitoring](https://claude.com/docs/cowork/monitoring.md) is set up
172172* **Chat**: the toggle also applies to code execution in chat
173173* **[Web search](#turn-off-web-search-in-cowork) and connectors**: neither goes through the VM, so the toggle doesn't limit them
174174
from line 184
184184Web search in Cowork follows your organization's web search setting. Applying the HIPAA configuration doesn't change it. If web search is on and your organization's own policy forbids it, turn it off at one of these levels:
185185
186186* **For your whole organization, in chat and Cowork**: ask an Owner to go to [**Organization settings > Capabilities**](https://claude.ai/admin-settings/capabilities) and turn off the **Web search** toggle under **Data sources**
187* **For Cowork and the Code tab on managed computers**: add the [`disabledBuiltinTools`](/docs/third-party/claude-desktop/configuration#disabledbuiltintools) key to the [Claude Desktop policy](#deploy-the-claude-desktop-policy)
187* **For Cowork and the Code tab on managed computers**: add the [`disabledBuiltinTools`](https://claude.com/docs/third-party/claude-desktop/configuration#disabledbuiltintools) key to the [Claude Desktop policy](#deploy-the-claude-desktop-policy)
188188
189189The `disabledBuiltinTools` key takes a list of tool names, written as a string:
190190
from line 229
229229
230230**4. Check your monitoring events**
231231
232If your organization uses [Cowork monitoring](/docs/cowork/monitoring.md), run a Cowork task. Confirm that the events your collector receives contain no prompt text, model responses, or tool inputs.
232If your organization uses [Cowork monitoring](https://claude.com/docs/cowork/monitoring.md), run a Cowork task. Confirm that the events your collector receives contain no prompt text, model responses, or tool inputs.
233233
234234The [HIPAA feature availability table](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers) lists which Cowork features are off with the HIPAA configuration applied, and which ones an Owner can turn back on.
235235
from line 314
314314## Related resources
315315
316316* [Set up Claude Code (local mode) for a HIPAA-ready organization](https://code.claude.com/docs/en/hipaa-setup)
317* [Cowork monitoring](/docs/cowork/monitoring.md)
317* [Cowork monitoring](https://claude.com/docs/cowork/monitoring.md)
318318* [Claude Code managed settings](https://code.claude.com/docs/en/managed-settings)
319319
No line in this hunk matches that.