AI in healthcare is moving faster than regulation can keep up. But HIPAA hasn't gone anywhere. and practices deploying AI tools that handle Protected Health Information (PHI) must ensure every vendor, every data flow, and every processing step meets HIPAA requirements. Here's the practical guide for practice owners navigating this landscape.
The BAA Requirement
Any AI vendor that creates, receives, maintains, or transmits PHI on your behalf is a Business Associate under HIPAA. No BAA, no deal. This is non-negotiable, regardless of how impressive the technology demo is.
This means they must sign a Business Associate Agreement (BAA) before any PHI is shared. If your AI receptionist handles patient names, appointment details, insurance information, or clinical notes. it's processing PHI. Ask for the BAA before the trial, not after deployment.
Minimum Necessary Standard
HIPAA's minimum necessary rule requires that AI systems access only the PHI needed for their specific function. An AI receptionist needs appointment schedules and contact information. not clinical notes or diagnosis codes. Ensure your AI vendor's data access is scoped appropriately and that integration architecture limits PHI exposure to what's operationally required. Over-broad data access creates unnecessary risk and potential HIPAA violations, even if the vendor has a valid BAA.
Data at Rest and in Transit
All PHI must be encrypted both at rest (stored data) and in transit (data moving between systems). AES-256 encryption for storage and TLS 1.2+ for transmission are the current standards. Additionally, AI systems processing voice calls must encrypt audio recordings, ensure transcriptions are stored in compliant environments, and manage retention periods appropriately. Audit logs tracking who accessed what PHI and when must be maintained for a minimum of six years.
AI-Specific Considerations
AI introduces novel HIPAA questions: Is PHI used to train models? (It shouldn't be without explicit authorization.) Are conversations with AI assistants stored and by whom? Can model outputs inadvertently expose one patient's information to another? Where is inference processing happening. on-premises, US cloud, or overseas? Responsible AI vendors have clear answers to these questions documented in their security architecture. If a vendor can't articulate their PHI data flow clearly, that's a red flag.
Breach Preparedness
Even with perfect compliance, breaches can occur. Your AI vendor's BAA should specify breach notification timelines (HIPAA requires notification within 60 days), define responsibilities for investigation and mitigation, and outline indemnification terms. Practices should maintain incident response plans that include AI-specific scenarios: what happens if the AI system is compromised, if training data is exposed, or if a model hallucination reveals PHI inappropriately. Preparedness isn't pessimism. it's professional risk management.