Health Insurance Portability and Accountability Act (HIPAA)
Complete Legal Breakdown with Rules, Layman Explanations & Citations
Who This Law Applies To
Covered Entities
Citation: 45 CFR § 160.103
Organizations that must comply with HIPAA:
1. Healthcare Providers
(who transmit health info electronically)
Doctors, clinics, hospitals, dentists, chiropractors, nursing homes, pharmacies
2. Health Plans
Health insurance companies, HMOs, Medicare, Medicaid, employer health plans
3. Healthcare Clearinghouses
Entities that process health information (billing services, repricing companies)
Business Associates
Citation: 45 CFR § 160.103
Definition:
Anyone who handles PHI on behalf of a Covered Entity
Plain English:
If you're an AI company processing health data for a hospital/clinic/health plan, you're a Business Associate.
Examples of Business Associates:
CRITICAL RULE:
Business Associates MUST have a signed Business Associate Agreement (BAA) BEFORE touching any PHI.
Key Principle
"Patient health info is private - protect it like a secret. Minimum necessary - only access what you need for your job."
Key Definitions in Plain English
1. Protected Health Information (PHI)
LEGAL DEFINITION
Individually identifiable health information transmitted or maintained in any form
Citation: 45 CFR § 160.103
PLAIN ENGLISH
ANY health info + personally identifiable info = PHI
Examples:
✅ IS PHI:
- • Patient name + medical diagnosis
- • SSN + health insurance info
- • Email + doctor appointment
- • IP address + medical device data
- • Voice recording of patient symptoms
- • AI chatbot health conversation
- • Photo + medical condition
❌ NOT PHI:
- • De-identified data (all 18 identifiers removed)
- • Aggregate health statistics (no identifiers)
- • Employment records (not health-related)
- • Education records under FERPA
For AI Systems:
If your AI processes ANY of the above, HIPAA applies.
2. The 18 Identifiers (for De-identification)
Citation: 45 CFR § 164.514(b)(2)
To de-identify data (make it NOT PHI), you must remove ALL 18:
For AI:
De-identify data BEFORE training to avoid most HIPAA requirements.
3. Minimum Necessary Standard
Citation: 45 CFR § 164.502(b)
The Rule:
Only use/access the minimum PHI needed to accomplish the task.
Plain English:
Don't be nosy - only access what you need for your job.
Examples:
✅ Nurse treating patient: needs full medical history
✅ Billing department: needs diagnosis codes and insurance info only (NOT detailed clinical notes)
❌ Receptionist: does NOT need to read patient's medical conditions
For AI:
Train models on minimum necessary data. If building symptom checker, you need symptoms and diagnoses. You DON'T need patient name, address, insurance info (unless needed for AI's function).
Complete Rules Breakdown
Business Associate Agreement (BAA)
Citation: 45 CFR § 164.502(e) & 45 CFR § 164.308(b)(1)
The Rule:
If you're a Business Associate, you MUST have a signed BAA BEFORE touching PHI.
Plain English:
If you're an AI company processing health data for a hospital, you need a contract (BAA) that says: (1) You'll protect PHI, (2) You'll follow HIPAA, (3) You'll report breaches, (4) You'll help with patient requests.
No BAA = Illegal to handle PHI
BAA Must Include:
For AI Companies:
- ✅ Need BAA with every hospital/clinic/health plan client
- ✅ Need BAA with subcontractors (AWS, OpenAI, etc.)
- ✅ Must be signed BEFORE receiving any PHI
Compliance Requirements:
- ✅ Signed BAA for each Covered Entity client
- ✅ BAA registry (list of all active BAAs)
- ✅ Annual BAA review and renewal
- ✅ Downstream BAAs with all subcontractors
Administrative Safeguards
Citation: 45 CFR § 164.308 - Administrative safeguards
The Rule:
Policies and procedures for managing PHI security.
1. Security Officer (Required)
You must: Appoint one person responsible for security
For small companies: Founder/CTO can be Security Officer
2. Risk Analysis (Required - Annually)
You must: Document risks to PHI and how you'll mitigate them
AI-Specific Risks: Model memorization of PHI, PHI leakage through outputs, unauthorized access to training data, insufficient de-identification
3. Workforce Training (Required - Annual)
All employees handling PHI receive HIPAA training
Topics: What is PHI, permitted uses, minimum necessary, security practices, reporting incidents, AI-specific: how models can leak data
4. Sanction Policy (Required)
Document consequences for HIPAA violations
5. Incident Response Plan (Required)
Document how you handle breaches
Large Breach (500+ individuals): HHS notification within 60 days, Individual notification within 60 days, Media notification
Small Breach (<500): Individual notification within 60 days, Annual HHS notification
Physical Safeguards
Citation: 45 CFR § 164.310 - Physical safeguards
The Rule:
Protect physical access to PHI.
1. Facility Access Controls
For cloud-based AI: Rely on cloud provider's physical security (AWS/Azure/GCP have this)
2. Workstation Security (Required)
Devices accessing PHI must: Auto-lock after 15 min, require password, be encrypted, screen positioned privately
3. Device and Media Controls (Required)
Track all devices with PHI, securely dispose when done (NIST SP 800-88: minimum 3 overwrite passes or physical destruction)
Technical Safeguards
Citation: 45 CFR § 164.312 - Technical safeguards
The Rule:
Use technology to protect PHI: Encryption, access controls, audit logs, secure transmission.
1. Unique User Identification (Required)
Every person accessing PHI has unique username. No shared accounts.
2. Encryption (Addressable but HIGHLY RECOMMENDED)
You must encrypt:
- • Data at rest: AES-256 for databases, files, backups
- • Data in transit: TLS 1.2+ for all network transmission
- • For AI: Encrypt training data files, model parameters if they contain PHI
Note: While technically "addressable," NOT encrypting PHI is a major red flag in audits.
3. Audit Controls (Required)
Log all access to PHI: Who accessed, what they accessed, when, what action
Retention: 6 years
For AI: Log all access to training data, model outputs containing PHI, API calls
4. Authentication (Required)
Verify identity before granting PHI access
- • Strong passwords (min 12 chars, complexity)
- • Multi-factor authentication (MFA) - REQUIRED for remote access, RECOMMENDED for all access
Note: OCR considers MFA essential for HIPAA compliance as of 2024
5. Transmission Security (Required)
Protect PHI in transit:
- • HTTPS/TLS 1.2+ for all web traffic
- • VPN for remote access
- • Encrypted email (S/MIME) when sending PHI
- • NO PHI via unencrypted channels (plain HTTP, SMS, unencrypted email)
De-identification
Citation: 45 CFR § 164.514 - De-identification
The Rule:
De-identified data is NOT PHI, so HIPAA doesn't apply.
Two Methods:
1. Safe Harbor Method
Remove ALL 18 identifiers (listed earlier)
Example: Patient record becomes: "45-year-old female, diabetes diagnosis, HbA1c 7.8%" (no name, no specific DOB, no MRN)
2. Expert Determination
Hire statistician/expert to certify: "Risk of re-identification is very small"
More flexible than Safe Harbor (can keep some dates, zip codes) but requires expert analysis
3. Prohibition on Re-identification (Required)
You must NOT attempt to re-identify individuals
Individual Rights
Citation: 45 CFR §§ 164.524-164.528 - Individual rights
1. Right of Access
Timeline: Provide data within 30 days (can extend 30 more days)
Patients can request: "Show me all my health records"
As Business Associate, you must: Help Covered Entity fulfill request
2. Accounting of Disclosures
Timeline: Must account for past 6 years
You must: Track when you share PHI (except routine treatment/payment/operations)
What to Track: Recipient, date, description of PHI, purpose
Penalties & Enforcement
Civil Penalties
Tier 1: Did not know (and could not have known)
Fine: $100 - $50,000 per violation | Annual max: $25,000 per provision
Tier 2: Reasonable cause (not willful neglect)
Fine: $1,000 - $50,000 per violation | Annual max: $100,000 per provision
Tier 3: Willful neglect, corrected within 30 days
Fine: $10,000 - $50,000 per violation | Annual max: $250,000 per provision
Tier 4: Willful neglect, not corrected
Fine: $50,000 per violation | Annual max: $1.5 million per provision
Criminal Penalties
Tier 1: Unknowing violation - Up to 1 year prison, $50,000 fine
Tier 2: Violation under false pretenses - Up to 5 years prison, $100,000 fine
Tier 3: Violation with intent to sell/transfer/use for commercial advantage - Up to 10 years prison, $250,000 fine
For AI companies:
If you're a Business Associate handling PHI, violations can end your business.
AI-Specific Guidance
1. Using De-identified Data
Best Practice:
De-identify data BEFORE AI training to avoid most HIPAA requirements
Method:
Safe Harbor (remove 18 identifiers) or Expert Determination
Caution: Models can sometimes learn patterns that enable re-identification. Test for this.
2. Model Output Leakage
Risk:
AI models might output PHI in responses, especially if trained on raw PHI
Mitigations:
- ✅ Use de-identified training data
- ✅ Implement output filtering to detect and block PHI
- ✅ Test models for memorization of training data
- ✅ Add differential privacy noise
3. Cloud AI APIs
Requirement:
BAA required if sending PHI to OpenAI, Anthropic, etc.
Alternatives if no BAA:
- • De-identify data before sending to API
- • Use on-prem models that don't share data with vendor
- • Find HIPAA-compliant alternative vendor
Compliance Action Plan
Phase 1: Immediate (Week 1)
- Identify if you handle PHI
- Execute BAAs with all Covered Entities
- Designate Security Officer
- Implement encryption (data at rest and in transit)
- Set up audit logging
- Create incident response plan
Phase 2: 30 Days
- Conduct risk analysis
- Implement MFA for PHI access
- Train all workforce on HIPAA
- Document policies and procedures
- Set up BAAs with subcontractors (AWS, etc.)
Phase 3: 90 Days
- Complete full policy manual
- Implement all technical safeguards
- Conduct vulnerability assessment
- Test incident response plan
- Review with HIPAA attorney
Official Sources & Citations
Informational Resource
This resource provides general information about HIPAA and is designed to help you understand the requirements. For specific legal advice tailored to your situation, we recommend consulting with a qualified healthcare attorney or compliance professional.