Overview
HIPAA protects Protected Health Information (PHI). AI systems processing health data must comply with Privacy and Security Rules, including proper safeguards and Business Associate Agreements. Violations can result in penalties up to $1.5M per violation category per year.
Key Facts
Who This Law Applies To
Covered Entities
Citation: 45 CFR § 160.103
- •Healthcare Providers (who transmit health info electronically) - Doctors, clinics, hospitals, dentists, pharmacies
- •Health Plans - Health insurance companies, HMOs, Medicare, Medicaid, employer health plans
- •Healthcare Clearinghouses - Entities that process health information (billing services, repricing companies)
Business Associates
Citation: 45 CFR § 160.103
Definition: Anyone who handles PHI on behalf of a Covered Entity
In Plain English: If you're an AI company processing health data for a hospital/clinic/health plan, you're a Business Associate.
- •AI vendors processing patient data
- •Cloud storage providers hosting PHI
- •Analytics companies analyzing health data
- •Medical transcription services
Business Associate Agreements (BAAs)
⚠️ Critical Requirement
Citation: 45 CFR § 164.504(e)
Before any AI vendor can access PHI, you MUST have a signed Business Associate Agreement.
- Written contract required before accessing PHI
- Business Associate must follow all HIPAA rules
- Subcontractors also need BAAs
- Must report breaches within 60 days
Required Safeguards
Administrative Safeguards
Citation: 45 CFR § 164.308
- Security Officer: Designate someone responsible for security
- Risk Analysis: Assess potential risks to PHI
- Workforce Training: Train employees on HIPAA rules
- Incident Response: Have a plan for security incidents
Physical Safeguards
Citation: 45 CFR § 164.310
- Facility Access Controls: Control who can physically access systems with PHI
- Workstation Security: Secure computers and devices
- Device Encryption: Encrypt laptops, phones, and portable devices
Technical Safeguards
Citation: 45 CFR § 164.312
- Unique User IDs: Each person gets their own login
- Encryption: Encrypt PHI in transit and at rest
- Audit Logs: Track who accessed what and when
- Multi-Factor Authentication: Use MFA for accessing PHI systems
De-identification for AI Training
Remove 18 Identifiers
Citation: 45 CFR § 164.514(b)
To use data for AI training without HIPAA restrictions, remove all 18 identifiers:
Need Help with HIPAA Compliance?
Our platform provides automated HIPAA assessments, BAA templates, and ongoing monitoring to ensure your AI systems protect patient health information.
How to Cite This Guide
This guide is maintained by HAIEC's legal compliance team and updated regularly to reflect the latest HHS guidance. Last updated: February 2026.