HIPAA and AI: Compliance Essentials

AI can help healthcare organizations do more with less, but it can also put protected health information (PHI) at risk. This guide covers the essentials of using AI under HIPAA and the steps that keep you compliant.

Take the free AI Governance Readiness Assessment — results on the page, no email required.

Where AI meets PHI

AI creates HIPAA exposure when PHI is entered into a tool, when an AI vendor processes PHI on your behalf, or when AI output is used in a decision about a patient. Each of these is a place to apply HIPAA controls.

Business associate agreements

Any vendor that creates, receives, maintains, or transmits PHI for you is a business associate and generally needs a BAA. Confirm a BAA exists before putting PHI into an AI tool.

Consumer AI tools are not covered entities

General-purpose chatbots typically will not sign a BAA and may use inputs to improve their models. Entering PHI into them can be a reportable breach. Use covered, contracted tools instead.

Minimum necessary and de-identification

Apply the minimum-necessary standard: use the least PHI required. Where possible, de-identify data before AI processing, and understand that de-identification under HIPAA has specific standards.

Governance and oversight

Document which AI tools are approved, who may use them, what data they may touch, and how outputs are reviewed. Combine this with your AI governance program and your existing HIPAA security and privacy policies.

Frequently asked questions

Can we use ChatGPT with patient data?

Not unless the specific tool is covered by a HIPAA-compliant agreement (for example, an enterprise offering with a BAA). Consumer chatbots generally must not receive PHI.

Does an AI vendor need a BAA?

If the vendor handles PHI on your behalf, yes — a business associate agreement is generally required before PHI is shared.

How does AI governance relate to HIPAA?

AI governance gives you the inventory, policy, and oversight structure; HIPAA adds the specific privacy and security obligations for PHI. They are complementary.