Summary

Even de-identified data requires careful handling. HIPAA defines two specific methods for de-identification — the Safe Harbor method and the Expert Determination method. Simply removing a name is not sufficient. If your AI model can re-identify individuals from seemingly anonymized data, you may still be in violation. HIPAA’s Security Rule requires covered entities and business associates to implement three categories of safeguards for electronic PHI (ePHI). HIPAA requires you to review and update your policies and risk assessments periodically and whenever there are significant changes to your environment — such as new product features, new vendors, or a security incident. Most compliance experts recommend a formal annual review at minimum.

HIPAA Guide for AI Companies: What You Need to Know to Stay Compliant

Artificial intelligence is transforming healthcare at an unprecedented pace. From diagnostic imaging tools to predictive analytics platforms, AI companies are increasingly working with sensitive patient data. But with that opportunity comes a serious legal responsibility: compliance with the Health Insurance Portability and Accountability Act (HIPAA).

If your AI company touches protected health information (PHI) in any way, HIPAA applies to you. This guide breaks down exactly what that means, what you need to do, and how to build a compliance framework that protects your business and your customers.

Who Does HIPAA Apply to in the AI Space?

HIPAA was originally written for healthcare providers, health plans, and clearinghouses — collectively known as covered entities. But the law also applies to business associates: any third-party company that creates, receives, maintains, or transmits PHI on behalf of a covered entity.

Most AI companies fall into the business associate category. If your platform:

Trains machine learning models on patient records
Processes clinical notes, lab results, or imaging data
Provides analytics tools to hospitals or health insurers
Offers a chatbot that collects symptom or health history data
Stores or transmits any identifiable health information

…then you are almost certainly a business associate under HIPAA, and the full weight of the law applies to your operations.

Understanding Protected Health Information (PHI) in AI Contexts

PHI is any individually identifiable health information that relates to a person’s past, present, or future physical or mental health condition, healthcare provision, or payment for care.

In AI workflows, PHI can appear in unexpected places:

Training datasets that include real patient records
Model outputs that reference specific individuals
Audit logs that capture user queries tied to patient data
API payloads sent between your platform and a hospital’s EHR system

The Business Associate Agreement (BAA): Your Legal Foundation

Before your AI company can legally receive PHI from a covered entity, you must have a signed Business Associate Agreement (BAA) in place. This contract defines:

What PHI you are permitted to use and disclose
How you will safeguard that information
Your obligations in the event of a breach
Your subcontractors’ responsibilities (they need BAAs too)
How PHI will be returned or destroyed at the end of the relationship

Never start processing PHI without a signed BAA. This is one of the most common compliance failures for early-stage AI companies, and it can result in significant civil and criminal penalties.

The Three HIPAA Safeguard Categories AI Companies Must Implement

HIPAA’s Security Rule requires covered entities and business associates to implement three categories of safeguards for electronic PHI (ePHI).

1. Administrative Safeguards

These are the policies, procedures, and training programs that govern how your team handles PHI.

Designate a HIPAA Security Officer responsible for compliance
Conduct a formal Risk Analysis to identify vulnerabilities in your systems
Develop and document a Risk Management Plan
Train all employees who access or handle PHI
Establish access controls and workforce clearance procedures
Create an incident response plan for potential breaches

2. Physical Safeguards

These protect the physical infrastructure where ePHI is stored or accessed.

Control access to servers, workstations, and data centers
Implement device and media controls (including mobile devices)
Establish policies for workstation use and security
Ensure cloud providers and data centers meet HIPAA standards

3. Technical Safeguards

These are the technology controls that protect ePHI from unauthorized access.

Encryption of ePHI at rest and in transit
Access controls with unique user IDs and automatic logoff
Audit controls that log all access to PHI-containing systems
Integrity controls to ensure ePHI is not improperly altered
Transmission security using TLS/SSL and other protocols

Special Considerations for AI and Machine Learning

Traditional HIPAA guidance was written before large language models and neural networks existed. Here are the unique challenges AI companies face:

Model Training on PHI

Using real patient data to train AI models is a high-risk activity. You must ensure:

You have a valid legal basis to use the data (BAA, de-identification, or patient authorization)
Training environments have the same security controls as production systems
Access to training data is limited to authorized personnel
Data is not retained beyond what is necessary

AI-Generated Outputs and PHI

If your model generates outputs that include or could reveal PHI — such as summarizing a patient’s medical history — those outputs are themselves PHI and must be protected accordingly.

Third-Party AI Services and Subcontractors

If you use third-party APIs (including large language model APIs) to process PHI, those vendors become subcontractors under HIPAA. You are responsible for ensuring they sign a BAA and meet HIPAA requirements. Many general-purpose AI APIs are not HIPAA-compliant by default — always verify before integrating.

HIPAA Breach Notification Requirements

If a breach of unsecured PHI occurs, your company must:

Notify affected individuals within 60 days of discovering the breach
Notify the covered entity (your customer) promptly so they can fulfill their obligations
Notify the HHS Office for Civil Rights — timing depends on the number of affected individuals
Notify media outlets if the breach affects more than 500 residents in a state or jurisdiction

Document everything. The burden of proof is on you to demonstrate that a breach did not occur or that notification requirements were met.

Building Your HIPAA Compliance Program: A Quick-Start Checklist

[ ] Determine if your company qualifies as a business associate
[ ] Identify all PHI and ePHI in your systems and workflows
[ ] Appoint a HIPAA Security Officer and Privacy Officer
[ ] Conduct a formal Risk Analysis
[ ] Implement administrative, physical, and technical safeguards
[ ] Develop and sign BAAs with all covered entity customers
[ ] Execute BAAs with all subcontractors who touch PHI
[ ] Train your entire workforce on HIPAA requirements
[ ] Create a breach response and notification plan
[ ] Document everything — policies, procedures, training records, and risk assessments

Frequently Asked Questions

Do AI companies always need to be HIPAA compliant?

Not always — but usually. If your AI company never touches PHI (for example, you only work with fully de-identified datasets or non-healthcare industries), HIPAA may not apply. However, if there is any chance your platform processes identifiable patient data, you should assume HIPAA applies and build your compliance program accordingly.

Can I use ChatGPT or other general AI tools to process PHI?

Not without a signed BAA with the provider. As of now, many general-purpose AI services do not offer HIPAA-compliant tiers or BAAs. Sending PHI through a non-compliant tool — even for internal productivity purposes — is a HIPAA violation.

What are the penalties for HIPAA non-compliance?

Penalties range from $100 to $50,000 per violation, with annual caps up to $1.9 million per violation category. Criminal violations can result in fines up to $250,000 and imprisonment. The reputational damage from a public breach or HHS investigation can be even more costly.

How often do we need to update our HIPAA compliance program?

HIPAA requires you to review and update your policies and risk assessments periodically and whenever there are significant changes to your environment — such as new product features, new vendors, or a security incident. Most compliance experts recommend a formal annual review at minimum.

Does HIPAA apply to AI companies outside the United States?

If your AI company is based outside the U.S. but provides services to U.S.-based covered entities and handles PHI of U.S. patients, HIPAA still applies to you as a business associate. Geographic location does not exempt you from the law.

Build Your HIPAA Compliance Foundation Faster

Getting HIPAA compliance right from the start is one of the most important investments your AI company can make. But building every policy, procedure, and agreement from scratch is time-consuming and expensive.

Our ready-to-use HIPAA compliance template bundle gives AI companies and business associates everything they need to get compliant quickly:

✅ Business Associate Agreement (BAA) template
✅ HIPAA Risk Analysis and Risk Management Plan templates
✅ Security Policies and Procedures (administrative, physical, and technical)
✅ Employee HIPAA Training Acknowledgment forms
✅ Breach Notification Policy and Incident Response Plan
✅ Vendor and Subcontractor Management Checklist

Written by compliance professionals, legally reviewed, and formatted for immediate use. Stop spending months building documentation from scratch — download your HIPAA compliance template bundle today and start closing enterprise healthcare deals with confidence.