A Business Associate (BA) under HIPAA is a entity that contracts with a Covered Entity (CE) using a Business Associate Agreement (BAA). OpenAI wouldn't be considered a BA unless they had an executed BAA with a CE.

There are a wide variety of things, including communication with providers, that OpenAI can do without being regulated by HIPAA. The provider, however would most likely be covered, so they would be under an obligation to not disclose any PHI.

As an example, consider a hypothetical "email my doc" app. This app could take health information from the patient and email it to all of their doctors without falling under HIPAA at all.

What you're probably thinking of is the HIPAA Privacy Rule (there's more to HIPAA than just that, the Security Rule is pretty involved). Under the Privacy Rule, CEs and BAs can not disclose PHI without a patient's consent, with a few exceptions.

If the patient is disclosing that information though, all bets are off (aside from state level regulations).