AI does not create a separate shortcut around HIPAA. When a service creates, receives, maintains, or transmits electronic protected health information on behalf of a regulated entity, the organization must evaluate the relationship, safeguards, contract, data flow, and actual use. A business associate agreement is important where required, but it does not make an unsafe workflow compliant by itself.
Current as of 2026-08-15
HHS cloud-computing guidance explains that a cloud provider maintaining ePHI is generally a business associate even when it cannot view encrypted data. HHS business-associate guidance describes required agreements and responsibilities.
Decision summary
- Determine whether ePHI enters, is retrieved by, or is retained by the AI workflow.
- Execute an appropriate business associate agreement when required, then verify operational safeguards.
- Apply minimum-necessary access and validated use-case boundaries.
- Keep clinical and administrative humans accountable for consequential decisions.
Start with the regulated data flow
Map prompts, attachments, retrieval indexes, plugins, model endpoints, logs, human review queues, exports, and support access. Identify covered entities, business associates, subcontractors, and any consumer account outside the approved relationship. Do not rely on a product name alone; the same vendor may offer different protections across products and tiers.
Perform risk analysis and contracting
HHS expects risk analysis and risk management for ePHI. Document threats, vulnerabilities, likelihood, impact, safeguards, residual risk, and accountable acceptance. Where a vendor is a business associate, the agreement should address permitted uses, safeguards, reporting, subcontractors, return or destruction, and other required terms. This article is operational guidance, not legal advice.
Constrain and validate the use case
- Use only the minimum data and permissions necessary.
- Separate experimentation from clinical or production systems.
- Test accuracy, bias, privacy, security, and failure modes for the intended population and workflow.
- Require qualified review for clinical, billing, legal, or patient-facing output.
- Keep a change-control trigger for models, prompts, connectors, and data sources.
Monitor and prepare for incidents
NIST AI 600-1 supports governance, measurement, and management of generative-AI risks. Retain evidence appropriate to the system: access, configuration, model version, validation, exceptions, user reports, and incidents. Coordinate privacy, security, compliance, clinical leadership, and counsel before a live event.
Next step for your environment
Choose one proposed AI workflow and complete an information-flow map, business-associate determination, risk analysis, minimum-necessary review, validation plan, and incident owner before approval. If you need a documented baseline before changing production systems, start with an ITECS technology and security assessment.
Record the accountable owner, current baseline, source date, decision, exceptions, acceptance evidence, and review trigger. Test consequential changes in a bounded environment, maintain a rollback path, and verify the real result before closing the work. Product names, model availability, pricing, legal requirements, and security guidance can change; recheck the primary sources whenever the decision is renewed or the environment changes.
Sources and update trigger
Review trigger: Review when HHS guidance, vendor terms, data flow, model, connector, intended use, or risk profile changes.