HIPAA-Compliant AI: What Healthcare Organizations Can and Cannot Do

AI can save healthcare teams enormous time: summarizing records, drafting letters, extracting data from faxes and documents, and answering patient questions. But healthcare data is regulated, and using the wrong tool with patient information can create a reportable breach. The rules are manageable once you know them.

This article is general guidance, not legal advice. Involve your privacy officer and counsel in decisions about AI and PHI.

The BAA question comes first

Under HIPAA, a vendor that creates, receives, maintains or transmits PHI on behalf of a covered entity is a business associate and must sign a business associate agreement. Several major cloud and AI providers offer BAAs for specific services and configurations, but not for every product they sell. Confirm that the exact service you use, including any AI features, is covered, and that the configuration matches the vendor’s requirements.

What not to do

• Paste patient information into consumer AI chat tools that are not covered by a BAA.
• Use AI browser extensions or note-taking tools on screens showing PHI without vetting them.
• Send PHI to AI services whose terms allow training on your data or retention beyond what you have agreed.
• Let staff choose their own AI tools for clinical or patient data.

De-identification opens doors

HIPAA defines two methods for de-identifying data. Safe Harbor removes 18 specified identifiers, such as names, most geographic subdivisions smaller than a state, dates directly related to the individual other than the year, contact details and record numbers, with no actual knowledge that the remaining data could identify someone. Expert Determination relies on a qualified expert concluding that the risk of re-identification is very small. Properly de-identified data is not PHI, which makes it suitable for analytics and some AI development, but de-identification must be done carefully.

Minimum necessary

Even with a BAA, send AI tools only the data a task requires. A tool drafting an appointment letter does not need the full medical history. Designing prompts and integrations around minimum necessary data reduces risk and often improves results.

Nondiscrimination in AI tools

The HHS rule implementing Section 1557 of the Affordable Care Act, finalized in 2024, requires covered entities to make reasonable efforts to identify patient care decision support tools that use variables such as race, color, national origin, sex, age or disability, and to mitigate the risk of discrimination from their use. That provision applied from May 1, 2025. If AI tools influence clinical or access decisions, document how they were evaluated.

An AI governance checklist for healthcare

1. An approved list of AI tools and what data each may receive.
2. BAAs in place for every AI service handling PHI.
3. Risk analysis updated to include AI data flows.
4. Human review of AI output used in patient communication or clinical work.
5. Logging of AI use with PHI.
6. Evaluation of AI tools that support care decisions for accuracy and bias.
7. Staff training and a clear policy on personal AI tools.

Good starting use cases

• Drafting non-clinical letters and messages from templates, with review.
• Extracting data from referral faxes and forms into structured records.
• Summarizing long administrative records for staff.
• Answering general questions from approved, non-PHI knowledge content.

Our AI solutions team builds healthcare AI workflows on covered services with minimum-necessary data and human review.

Frequently asked questions