How to Ensure HIPAA Compliance When Using AI in Healthcare

How to Ensure HIPAA Compliance When Using AI in Healthcare

Artificial intelligence (AI) in healthcare can have many benefits in healthcare, such as streamlined documentation, support of clinical decisions, and improvement of patient engagement. However, any AI system that touches protected health information (PHI) must comply with the HIPAA Privacy and Security Rules. In 2026, the HIPAA rules remain technology‑neutral, meaning the same requirements that apply to electronic health records, billing software, and patient portals also apply to AI tools that create, receive, maintain, or transmit PHI.

This blog article walks you through a practical, step‑by‑step approach to using AI responsibly and safely in healthcare while staying inside HIPAA's guardrails. Remember, every healthcare organization is different so this is not a guarantee of compliance, but a best‑practice framework that can help you operationalize HIPAA‑AI training, BAA templates, and risk assessment tools.

Step 1: Assess and Map AI Use Cases Involving PHI

HIPAA compliance with AI begins with understanding where PHI appears in your AI workflows. The HIPAA Security Rule's guidance[1] published by the Department of Health and Human Services (HHS) explains that conducting a Security Risk Analysis is one of the first steps covered entities should take to ensure all electronic PHI (ePHI) they create, receive, maintain, or transmit remains secure. That scope should also include AI systems.

Start by identifying AI use cases in these four primary categories and subcategories:

• Administrative: Scheduling, intake, coding support, and documentation drafting.
• Clinical: Decision support, imaging analysis, triage systems, or symptom evaluators.
• Patient‑facing: Chatbots, virtual assistants, remote monitoring tools.
• Analytics: Population health models, predictive analytics, quality improvement tools.

Odds are you found one or more ways in which AI is being used in your organization just from these examples. In conjunction, the HIPAA Privacy Rule protects individually identifiable health information. If an AI use case involves names, contact details, dates, record numbers, or any identifiers linked to health, care, or payment, treat its inputs and outputs as PHI and protect it accordingly.

As part of your Security Risk Analysis, map where data flows within your organization. Here are a few areas to consider when creating a data map:

1. Note where PHI originates (EHR, practice management, patient app)
2. Document how PHI moves into AI tools (APIs, file uploads, messaging)
3. Record where AI outputs are stored (EHR, vendor cloud, local systems)
4. Identify each internal system and external vendor that handles PHI

The OCR continues to stress the importance of documenting the scope of ePHI, systems, data flows, and environmental or operational changes that affect security. Creating simple diagrams or tables of your AI workflows will make future risk assessments, vendor evaluations, and audit activities much easier and is consistent.

Step 2: Evaluate AI Vendors and Tools for HIPAA Alignment

Any AI vendor that creates, receives, maintains, or transmits PHI for you is a business associate under the HIPAA rules. HARD STOP. No matter what an AI vendor says this is the definition of a business associate from the HHS and the ownness is on your organization as the creator of the PHI to have compliant Business Associate Agreements (BAAs) in place. If an AI vendor meets the definition of a business associate, and is not willing to sign an agreement, that is a strong indication you should not do business with that organization.

When performing due diligence checks on a potential vendor evaluate some of these areas:

• Whether the vendor will execute a HIPAA‑compliant BAA
• How the vendor safeguards ePHI. Use the administrative, physical, technical safeguards listed in the HIPAA Security Rule[2] as your guide.
• Audit logging and security monitoring around AI systems the vendor uses/provides
• Experience with HIPAA and United States healthcare operations. This is especially crucial if the vendor is an offshore service provider.

Also consider the provisions the HHS requires within BAAs:

• Defining permitted and required uses and disclosures of PHI
• Defining prohibited uses or disclosures not authorized by the agreement or required by law
• Evaluation of required and addressable safeguards to prevent unauthorized uses or disclosures
• Mandated breach notification to the covered entity
• Flow down protections to any subcontractors handling PHI
• Addressing PHI return or destruction at contract termination[3]

For AI vendors, a "must‑have" clause is explicit language about model training. The BAA should state that the vendor will not use your PHI to train, improve, or refine their AI models for general or unrelated purposes unless expressly authorized by the covered entity and consistent with the HIPAA privacy and security rules. This aligns with the HHS's requirement that business associates only use PHI as permitted and help contain risk from large‑scale model training on clinical data.

So, when was the last time you or your legal counsel reviewed your organization's BAA language in the context of AI? If it hasn't been in the last 2-3 years, it's long overdue. Odds are many of your vendors are already using AI themselves and with their own vendors. This means your organization may be operating without proper ePHI protection in place with your business associates.

Step 3: Implement Minimum Necessary and Data Minimization Protocols

The HIPAA Privacy Rule emphasizes the principle of "minimum necessary" use and disclosure. Healthcare organizations must make reasonable efforts to use, disclose, and request only the minimum amount of PHI needed for a purpose. AI tools should be configured and governed with that standard in mind as well. If they aren't, it's time to make a change.

From a practical standpoint, there are several things to consider when applying the minimum necessary standard, such as limiting the fields sent to AI systems, using de-identified information when possible, and separating development and testing of AI systems from production/live environments. De‑identified PHI, when properly processed according to the Safe Harbor or expert determination method, is no longer considered PHI. This means it is no longer subject to the Privacy Rule. When training general or cross‑customer AI models use de‑identified or synthetic data wherever possible as it dramatically lowers compliance risk.

When considering regular operations and access, enforce the minimum necessary standard by creating role‑based rules for who can send PHI to AI tools and for what purposes. Configure your AI integrations to exclude nonessential identifiers wherever possible. This can be effectively done by periodically reviewing AI queries and outputs to ensure staff are not using AI tools in ways that violate your AI-use policy.

Step 4: Apply Robust Security Safeguards and Continuous Monitoring

The HIPAA Security Rule requires covered entities and business associates to implement administrative, physical, and technical safeguards to protect ePHI. Some safeguards include access controls, authentication, encryption when ePHI is in transit and at rest, audit controls to record access and activity, and implementing data integrity and transmission security measures.

Any AI system that handles ePHI needs to be treated like any other ePHI system in your environment. Consider these key areas to ensure adequate protection is in place:

• Use strong encryption, such as TLS for data in transit and appropriate encryption at rest, consistent with Security Rule implementation specifications.
• Enforce unique user IDs, robust authentication, including multi‑factor authentication where feasible, and role‑based access to AI interfaces.
• Configure and retain audit logs that capture who accessed AI tools, what PHI was processed, and key administrative actions.
• Review logs regularly as part of your risk management program.

The OCR's Security Risk Analysis guidance stresses that healthcare entities must document security measures and review them periodically in response to environmental or operational changes. The introduction of AI systems is exactly such a change, so it should trigger updates to your Security Risk Analysis and safeguard.

Here is an example of a simple AI audit trail table:

Field	Example entry	HIPAA link
User ID	Clinician123	Unique user identification
Timestamp	2026‑07‑15 10:32	Audit controls record activity
AI system	Triage‑Bot v2	System holding/transmitting ePHI
PHI scope	Symptoms + DOB (no SSN)	Minimum necessary principle
Action	Generated triage recommendation stored in EHR	Treatment use under Privacy Rule

Maintaining and reviewing this kind of audit trail makes it easier to demonstrate to the OCR that AI systems are integrated into your overall compliance program.

Step 5: Address Transparency, Bias, and Explainability in Healthcare AI

It's important to remember the HIPAA rules do not specifically regulate algorithmic bias or explainability, but they do require reasonable safeguards, respect for individual rights, and appropriate uses for treatment, payment, and health care operations. Meanwhile, the HHS's AI Strategy describes a vision for trustworthy AI, emphasizing transparency, fairness, and accountability in health and human services.[4]

Healthcare organizations using AI that influences clinical decisions need to take appropriate actions to ensure any potential harm to patients is addressed and mitigated before implementation. They should require AI vendors to provide documentation about model training data, performance metrics, and limitations so clinicians and AI administrators can understand and appropriately rely on outputs. Remember, even with the best AI solutions in place, clinicians remain ultimately responsible for decisions. AI should be used as an aid rather than a replacement for clinical judgement. This aligns with HIPAA's framework of professional judgment and permitted uses for treatment.[5]

As the responsible party, healthcare organizations and leaders are perfectly within their rights to ask vendors for evidence of bias testing and mitigation, particularly for tools used in triage, risk scoring, or resource allocation. This avoids discriminatory impacts that could trigger broader legal and ethical concerns.

From a documentation standpoint, it is important to record which AI systems influence care or operations, how you validated them before deployment and how clinicians are instructed to use or override recommendations based on professional judgement. Although these steps go beyond the HIPAA Privacy and Security Rule's current text, they complement HIPAA's requirement that organizations maintain reasonable safeguards and support individuals' rights and expectations about how their information is used.

Step 6: Train Staff and Update Policies for AI

The OCR notes that administrative safeguards under the HIPAA Security Rule include security awareness and training for all workforce members who handle ePHI. The HHS's HIPAA materials emphasize that covered entities must train staff on their own policies and procedures, not just general HIPAA concepts.[6]

Considering AI specifically, staff training should cover the following topics:

• Which AI tools are approved, what they do, and which ones process PHI
• How to apply minimum necessary and de‑identification when using AI
• Prohibition on entering PHI into non‑approved or non‑BAA consumer tools
• How to recognize and report AI‑related incidents, such as unexpected data exposure or suspicious outputs

Training records should document the date, content, and attendees, or users who have completed training if you're using an LMS. The OCR routinely requests evidence of training in investigations and compliance reviews so having this information is a vital piece of being compliant. The proposed HIPAA Security Rule updates and sector guidance highlight even more explicit expectations for annual security training and documentation. AI‑specific content should be part of that cycle and clearly identifiable[7].

Policies and procedures should also be updated to reflect AI workflows. The HIPAA rules require covered entities and business associates to implement policies and procedures to comply with the Privacy and Security Rules and to document them. For AI, policies should address at least these four key topics:

• Approval and risk assessment of AI tools before they are allowed to handle PHI
• Vendor management and BAAs for AI services
• Acceptable uses of AI for treatment, payment, and operations
• Logging, monitoring, and incident response processes that include AI systems

Step 7: Conduct Ongoing Risk Assessments and Compliance Audits

The Security Risk Analysis and risk management plan are not one‑time tasks. The OCR's guidance emphasizes that entities must "conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI[8]" and periodically review and update that analysis as conditions change. Introducing AI into your environment is precisely such a change.

A structured HIPAA‑AI risk assessment should use your AI inventory and data flow maps to define scope, identify threats and vulnerabilities specific to AI, evaluate existing safeguards, and assess the likelihood and impact of each risk. The HHS's guidance on the Security Risk Analysis explains that assessments should consider likelihood, impact, and mitigation activities, including thorough documentation for how the identified threats will be mitigated. For AI, remediation might include revising BAAs, tightening minimum necessary rules, enhancing monitoring, or discontinuing higher‑risk tools.

A compliance program audit can test whether policies and safeguards are working in practice. That can include:

• Sampling AI transactions to verify that PHI is only used in approved tools
• Confirming that staff are following AI policies and training
• Checking logs and configurations against your documented standards

FAQs: HIPAA Compliance and AI in Healthcare (2026)

Is HIPAA different when I use AI?
No. HIPAA is technologically neutral. The same Privacy and Security Rules govern any system that creates, receives, maintains, or transmits PHI, including AI tools. You must follow the usual rules for permissible uses and disclosures, minimum necessary, safeguards, and BAAs.

Do all AI vendors need BAAs?
Any vendor that creates, receives, maintains, or transmits PHI on your behalf is a business associate, regardless of whether it is "AI" or traditional information technology. A signed BAA that meets HHS's standards is required before PHI is shared.

Can I use public AI tools with PHI?
Not without a compliant BAA and appropriate safeguards. Entering PHI into consumer AI services that are not business associates risks impermissible disclosure under the Privacy Rule.

How often should AI‑related risk assessments be updated?
OCR states that risk analysis must be periodic and updated as environmental or operational changes occur. Adding or significantly modifying AI systems should trigger an update, and many organizations also perform annual comprehensive assessments. Industry best-practice is to conduct a risk analysis at least once per year if an environmental/operational change has not triggered an update in the prior 12 months.