Summary

HIPAA’s Security Rule requires covered entities and business associates to conduct a thorough, accurate, and documented risk analysis. For AI companies, this step is especially critical because your attack surface is often broader than a traditional software company. Technical controls alone are not enough. HIPAA also requires physical and administrative safeguards. Data breaches happen—even to well-prepared companies. HIPAA’s Breach Notification Rule requires you to have a documented response plan in place before an incident occurs.

HIPAA Checklist for AI Companies: A Complete Compliance Guide

Artificial intelligence is transforming healthcare at an unprecedented pace. From diagnostic imaging tools to predictive analytics platforms, AI companies are increasingly handling protected health information (PHI)—and that means HIPAA compliance is no longer optional. Whether you’re a startup building a clinical decision-support tool or an established SaaS company integrating with electronic health records, this HIPAA checklist for AI companies will help you identify gaps, reduce risk, and build trust with healthcare clients.

Why AI Companies Must Take HIPAA Seriously

Many AI companies mistakenly assume HIPAA only applies to hospitals and insurance companies. In reality, if your AI platform receives, processes, stores, or transmits PHI on behalf of a covered entity, you are a Business Associate under HIPAA—and you carry significant legal obligations.

The consequences of non-compliance are steep: fines ranging from $100 to $50,000 per violation, reputational damage, and loss of healthcare contracts. More importantly, PHI breaches can cause real harm to real patients.

Step 1: Determine Your HIPAA Status

Before checking any boxes, you need to understand exactly where your company stands.

Are You a Business Associate?

You are likely a Business Associate if your AI company:

Processes medical records, lab results, or clinical notes on behalf of a hospital or health system
Provides a platform that stores or analyzes patient data for a covered entity
Offers AI-powered billing, coding, or prior authorization tools
Builds models trained on identifiable patient data provided by a healthcare client

If yes, you must sign a Business Associate Agreement (BAA) with every covered entity you work with before exchanging any PHI.

Step 2: Execute Business Associate Agreements

A BAA is a legally binding contract that defines how you will safeguard PHI. It is not optional—it is a HIPAA requirement.

Your BAA checklist should confirm:

[ ] BAAs are signed with all covered entity clients before data access begins
[ ] BAAs are signed with your own subcontractors and vendors who may touch PHI (cloud providers, annotation services, etc.)
[ ] Each BAA clearly defines permitted uses and disclosures of PHI
[ ] BAAs include breach notification timelines (typically 60 days)
[ ] BAAs are reviewed and updated when business relationships change
[ ] Expired or terminated BAAs are properly closed out

Major cloud providers like AWS, Google Cloud, and Microsoft Azure offer HIPAA-eligible services and will sign BAAs—but you must actively request them and configure your environment correctly.

Step 3: Conduct a Risk Analysis

Your risk analysis should cover:

[ ] All locations where PHI is stored, processed, or transmitted (databases, model training environments, APIs, logs)
[ ] Identification of potential threats and vulnerabilities specific to AI workflows (e.g., model inversion attacks, training data exposure)
[ ] Assessment of current security controls and their effectiveness
[ ] Likelihood and impact ratings for identified risks
[ ] A risk management plan with prioritized remediation steps
[ ] Documentation of the entire process for audit purposes

Risk analysis is not a one-time event. Repeat it annually and whenever you make significant changes to your systems or data flows.

Step 4: Implement Technical Safeguards

The HIPAA Security Rule outlines specific technical safeguards that AI companies must implement to protect electronic PHI (ePHI).

Encryption and Access Controls

[ ] Encrypt ePHI at rest (AES-256 or equivalent) and in transit (TLS 1.2 or higher)
[ ] Implement role-based access controls (RBAC) so only authorized personnel access PHI
[ ] Use multi-factor authentication (MFA) for all systems containing ePHI
[ ] Maintain unique user IDs—no shared logins
[ ] Implement automatic session timeouts for inactive users

Audit Controls and Monitoring

[ ] Enable audit logging for all access to ePHI
[ ] Monitor logs for anomalous activity and unauthorized access attempts
[ ] Retain audit logs for a minimum of six years
[ ] Implement intrusion detection systems (IDS) or intrusion prevention systems (IPS)

AI-Specific Technical Considerations

[ ] Evaluate whether PHI is truly necessary for model training—can de-identified or synthetic data be used instead?
[ ] Implement differential privacy or federated learning techniques where feasible
[ ] Ensure model outputs cannot be reverse-engineered to expose individual patient data
[ ] Secure your MLOps pipelines, including data preprocessing and model serving environments

Step 5: Establish Physical and Administrative Safeguards

Technical controls alone are not enough. HIPAA also requires physical and administrative safeguards.

Administrative Safeguards

[ ] Designate a HIPAA Privacy Officer and a Security Officer
[ ] Develop and maintain written HIPAA policies and procedures
[ ] Conduct workforce training on HIPAA requirements at onboarding and annually thereafter
[ ] Implement a sanction policy for employees who violate HIPAA rules
[ ] Establish a contingency plan for data backup and disaster recovery
[ ] Perform periodic internal audits of your HIPAA program

Physical Safeguards

[ ] Restrict physical access to servers and workstations that process ePHI
[ ] Implement workstation use policies for remote employees handling ePHI
[ ] Establish device and media disposal procedures (secure wiping or destruction)
[ ] Maintain an inventory of hardware and devices that store or access ePHI

Step 6: Build a Breach Notification Plan

Data breaches happen—even to well-prepared companies. HIPAA’s Breach Notification Rule requires you to have a documented response plan in place before an incident occurs.

Your breach response checklist:

[ ] Define what constitutes a breach under HIPAA (unauthorized acquisition, access, use, or disclosure of PHI)
[ ] Establish an internal incident response team with clear roles
[ ] Document procedures for investigating and containing a breach
[ ] Notify affected covered entities within 60 days of discovering a breach
[ ] Maintain records of all breach investigations and notifications
[ ] Report breaches affecting 500 or more individuals to HHS and local media simultaneously with covered entity notification

Step 7: Manage Third-Party and Vendor Risk

AI companies rely heavily on third-party services—cloud infrastructure, data labeling platforms, open-source tools, and more. Each vendor that may encounter PHI must be evaluated and managed.

[ ] Maintain a complete inventory of all vendors with potential PHI access
[ ] Sign BAAs with all applicable subcontractors
[ ] Conduct security assessments or review SOC 2 reports for critical vendors
[ ] Include HIPAA compliance requirements in vendor contracts
[ ] Reassess vendor relationships annually or when vendors undergo significant changes

Step 8: Document Everything

If it isn’t documented, it didn’t happen—especially during a HIPAA audit. Maintain thorough records of:

[ ] Risk analyses and risk management plans
[ ] All signed BAAs
[ ] Policies and procedures (retain for six years from creation or last effective date)
[ ] Employee training records
[ ] Security incident reports and breach notifications
[ ] Audit logs and access reviews

Frequently Asked Questions

Do AI companies that only use de-identified data need to comply with HIPAA?

Properly de-identified data under HIPAA’s Safe Harbor or Expert Determination method is not considered PHI, so HIPAA’s rules do not apply to that data. However, de-identification must be done correctly—and if your company receives identifiable data during any part of the process, those workflows remain subject to HIPAA. Many AI companies receive raw PHI, de-identify it, and then train models, meaning the initial data handling still requires compliance.

Does using a HIPAA-compliant cloud provider make my AI company HIPAA compliant?

No. Using a HIPAA-eligible cloud service (like AWS GovCloud or Google Cloud Healthcare API) is an important step, but it only covers the infrastructure layer. You are still responsible for configuring services securely, signing a BAA with the provider, training your workforce, implementing access controls, and maintaining all other required safeguards.

How often should AI companies update their HIPAA policies?

At minimum, review your HIPAA policies and procedures annually. You should also update them whenever you launch new products, change data flows, onboard new healthcare clients, or experience a security incident. HIPAA requires your documentation to reflect your actual current practices.

What is the biggest HIPAA risk specific to AI companies?

One of the most overlooked risks is training data governance. AI companies sometimes use PHI to train models without proper authorization, retain training data longer than permitted, or fail to account for PHI embedded in model logs and outputs. Establishing clear data lifecycle policies for your AI pipelines is essential.

Can AI companies get HIPAA certified?

HIPAA does not offer an official certification program. However, companies can pursue third-party audits, achieve SOC 2 Type II certification, and implement frameworks like NIST CSF to demonstrate their security posture. Many healthcare clients will request evidence of these assessments before signing contracts.

Build Your HIPAA Compliance Program Faster

Working through this checklist is a strong start—but building every policy, procedure, and agreement from scratch is time-consuming and expensive. Mistakes in your documentation can expose your company to significant liability.

Our ready-to-use HIPAA compliance template bundle for AI companies includes:

Business Associate Agreement (BAA) template
HIPAA Risk Analysis and Risk Management Plan templates
Security Incident Response Policy
Workforce Training Policy and acknowledgment forms
Breach Notification Procedure
Vendor Management Policy
Complete HIPAA Policies and Procedures Manual

These attorney-reviewed, editable templates are built specifically for technology and AI companies handling PHI. Skip the months of drafting and get compliant faster.

👉 Download the HIPAA Compliance Template Bundle for AI Companies →

Protect your business, protect your clients, and build the trust that healthcare partnerships demand.