HIPAA Compliant AI: What It Means and What to Ask a Vendor
There is no HIPAA certification for AI. Doing it right takes three things. Each vendor that touches patient data signs a business associate agreement. That goes for the firm that runs the model too. The system has the Security Rule's safeguards built in. And it uses only the health data each task needs.
What we sign, and what we build to
| Item | Where we stand |
|---|---|
| Business associate agreement (BAA) | We sign them |
| An NDA (a non-disclosure agreement) | First, if you need one |
| HIPAA Security Rule safeguards | Built to, in the architecture: row-level security on every query, every model call traced, every database change versioned with a rollback |
| HIPAA, SOC 2, GDPR, PCI DSS, CCPA, TCPA and WCAG 2.1 AA controls | Built to, in architecture and data handling, and documented in the handover |
| Anything else your industry requires | Written into the scope of work and built to, with a certified partner wherever a framework calls for one |
HIPAA is the US law that guards patient health data. So start with what the label means. "HIPAA compliant" is not a badge a product carries. It is about the contracts and the build. It is also about how the system is used.
Before PHI goes near an AI system, three things must be true. First, each firm that touches it has signed a BAA. It signs with you, or with the vendor it works for.
Second, the system enforces the rule's safeguards. You can see them in its design. Third, it uses, sends and stores only what each task needs. That includes what goes in a prompt.
A vendor that can show you all three has the real thing. A vendor that shows you a padlock has a picture.
Is there a HIPAA certification for AI?
No. HHS is the US Department of Health and Human Services. It does not certify vendors or products as HIPAA compliant. So there is no such paper to ask for.
A "HIPAA compliant" badge on a site is the vendor's own claim. Or it is a private firm's view of the vendor. HHS issued neither one. Anyone can put a badge on a web page.
What does exist helps more. A BAA is a contract. It puts a vendor on the hook for the PHI it holds. The vendor's controls keep that promise, query after query. And a SOC 2 report shows that outside accountants checked those controls.
We call this Architecture, Not Badges. Ask for the contract, the data path and the controls. Treat the logo as a sticker.
When is an AI vendor a business associate?
HIPAA has a name for a firm that handles PHI for you. It is a business associate. In the law's words, it does one of four things for a covered entity. It "creates, receives, maintains, or transmits protected health information." A covered entity is mostly a health plan or a care provider. A clinic is one.
The same term takes in subcontractors. A firm that does that work for a business associate is one too. And the vendor may pass the data on only after one step. It must get "satisfactory assurances." Those are promises that the data will be kept safe. In practice, it signs a BAA of its own.
That clause is where AI systems catch people out. Here is how it looks. Say your clinic hires a firm to answer its phones. That firm is a business associate. It uses a speech tool and an AI model to do the work. Those two are its subcontractors. Each one needs a BAA with the firm.
And an AI system has more hops than plain software. A hop is any stop the data passes through on its way.
Follow one patient call through a common build. It comes in on the phone or chat line. A transcription service turns the voice to text. Then it reaches your app and its database. Next it goes to the model provider. It may hit a search index of your files too. Last come the tools that log and trace what happened. Each hop that gets or keeps PHI is in the chain.
A patient calls
- 01Phone or chat channelCarries the callBAA
- 02TranscriptionTurns voice into textBAA
- 03Your app and databaseKeeps the recordBAA
- 04Model providerGets the promptBAA
- 05Search indexStores your filesBAA
- 06Logs and tracesKeep prompts and outputsBAAThe hop people forget
The hop people forget is the last one. A trace is the log of one model call. It keeps what went in and what came out. Say the patient's name and date of birth were in the prompt. Then they are in the trace too.
So the tool that keeps the traces holds PHI too. It needs one like each other hop. Ask each vendor to draw its data path for you. Have it mark the BAA status beside each hop.
What does the HIPAA Security Rule ask of an AI system?
The Security Rule is a part of HIPAA. It covers data kept or sent by computer. Its technical safeguards are at 45 CFR 164.312. They name five standards. None of them mentions AI. All of them apply to it.
| Safeguard | What it means in an AI system | What to ask to see |
|---|---|---|
| Access control | The model, or an agent acting for a user, gets only that user's rights, enforced in the database rather than in each screen | A query run as a user who should see nothing, returning nothing |
| Audit controls | Every model call recorded: input, output, time, cost and who asked | The record of one call, and who can read the records |
| Integrity | Changes are recorded and can be undone, and nothing is written to a record without a check | One database change with its rollback script |
| Person or entity authentication | A voice or chat agent checks who it is talking to before it shows any record | What the agent says before identity is checked |
| Transmission security | PHI is protected in transit on every connection, including the one to the model provider | The data path, with each connection marked |
Put simply, the agent sees only what its user may see. Each model call leaves a record. Each change can be undone. The agent checks who is on the line first. Until then, it shares nothing. And the data is locked on each link. That includes the link to the model.
One more rule sits beside them, at 164.502(b). It is the minimum necessary standard. It binds both covered entities and business associates. Each must make reasonable efforts to limit PHI. The limit is "the minimum necessary" for each use, disclosure or request. In short, use as little as the job needs.
For AI, the prompt is a disclosure. It hands data to the model. Say a patient asks what time her visit is. The model needs the time, the place and the doctor. It does not need her diagnosis, her notes or what she owes.
Now say the system pastes her whole record in the prompt. That is far more than it needs. Build each prompt from approved fields only.
What a HIPAA-built AI system looks like in practice
Take the phone system we are building for a medical practice. It has several sites. A caller wants to move her Thursday visit. First, the agent asks for her name and date of birth. No data comes up before that.
Then it reads only approved fields. That means the time, the place and the doctor. It asks her to confirm. Only then does it write the change to her records. When she asks about a test result, it hands her to staff. Any question off the script goes to a person. The practice's compliance team signed off on the design first. Then the build began.
Gate 1Check who is calling firstPerson or entity authentication
AgentBefore I look anything up, can I have your full name and date of birth?
Gate 2Approved fields onlyMinimum necessary
- Appointment time: approved
- Location: approved
- Provider: approved
- Diagnosis: out of reach
- Clinical notes: out of reach
- Balance: out of reach
Gate 3Confirm, then writeIntegrity
AgentThat’s Thursday morning at the north clinic. Shall I book it?
Gate 4A person for the restHumans approve where it matters
Off the scriptA question about a result goes to staff, with the call so far attached.
Each of those gates maps to a safeguard above. You can test each one on a call of your own.
What we sign, and what we build to
This is where we stand, in full. The same terms are on our commitments page. Each control is built to, not a third-party certification.
| Item | Where we stand | Why a reviewer asks |
|---|---|---|
| Business associate agreement (BAA) | We sign them | It is the contract that makes a vendor answerable for PHI |
| An NDA (a non-disclosure agreement) | First, if you need one | So the design and data path can be shared before price |
| HIPAA Security Rule safeguards | Built to, in the architecture: row-level security on every query, every model call traced, every database change versioned with a rollback | These are the controls an auditor asks to see |
| HIPAA, SOC 2, GDPR, PCI DSS, CCPA, TCPA and WCAG 2.1 AA controls | Built to, in architecture and data handling, and documented in the handover | Health data rarely travels alone: card data, privacy law and consent rules come with it |
| Anything else your industry requires | Written into the scope of work and built to, with a certified partner wherever a framework calls for one | A contract that names a framework needs it met, by name |
SOC 2 Type I vs Type II: what a report proves
A SOC 2 report is an attestation. That is a formal opinion, signed by an independent CPA firm. CPAs are licensed accountants. The firm tests the vendor against the AICPA's Trust Services Criteria. Those are a set of control standards. The AICPA is the US body for CPAs.
Type I looks at how the controls were designed. It checks one point in time. Type II covers a span of time. So it says whether the controls kept working. Type I is like a snapshot. Type II is like a film.
Ask who issued the report. Ask for the date or span it covers. And see if you can read it under NDA.
Attestation report[CPA firm]
SOC 2 Type II
- Issued by
- An independent CPA firm, named
- Written against
- The AICPA Trust Services Criteria
- Covers
- A period: [start] to [end]
- Can you read it
- Ask: under NDA
Type I is a point in time. Type II covers a period.
A logo that says “SOC 2”
- Issued by
- Not stated
- Written against
- Not stated
- Covers
- Not stated
- Can you read it
- There is nothing to read
A picture.
A report and a BAA each answer their own question. The report tells you that someone outside looked. The BAA tells you who is on the hook for your patients' data. You want both. And you still want the data path.
Ten questions to ask an AI vendor about HIPAA
Send these in writing. Do it before the second call.
| # | Ask the vendor | A good answer |
|---|---|---|
| 1 | Will you sign a BAA? | "Yes, here is the template," before price comes up |
| 2 | Which reports and certifications do you hold, and which controls do you build to? | Each one named, with the issuer and the period it covers |
| 3 | What is the data path? | A diagram of every system, region and subprocessor, the model provider and logging tools included, with the BAA status of each |
| 4 | Is our data used to train any model, yours or a provider's? | "No," and the contract clause that says so |
| 5 | Where is access enforced? | In the database engine, on every query |
| 6 | Can you show the source behind any answer? | The document, the page and the supporting line, for an answer you pick |
| 7 | Is every model call recorded? | Input, output, time and cost, with a named role that can read the records |
| 8 | Which actions wait for a person's approval? | A written list |
| 9 | How are changes controlled? | One database change with its rollback script, and one architecture decision record |
| 10 | Whose cloud, repository and keys is it built on? | Yours, from day 0, with everything handed over if you cancel |
Questions 1 to 4 decide the contract and the data path. Get those wrong, and nothing built later fixes it. For more on question 10, see who owns the code your AI vendor writes.
When not to stop at HIPAA
A contract names one more framework. A federal contract may pass down FedRAMP or CMMC. FedRAMP is the program that clears cloud services for federal use. CMMC is how the Defense Department certifies the firms it hires as secure. A HIPAA review covers neither. Put the framework in the scope. Then ask how it is met, and by whom.
The system calls or texts patients. The TCPA is the US law on calls and texts. Consent counts on each channel, no matter what HIPAA allows.
No one on your side will read the answers. Ten questions answered and never read are theater. Name the person who will read them before you send them.
This guide covers design and how to ask. It is not legal advice. Your lawyer reads the law for your case.
Questions buyers ask
FAQ
Is there an official HIPAA certification for AI?
No. HHS does not certify vendors or products as HIPAA compliant. So there is no official stamp for an AI tool. Three things count instead. First, a signed BAA with each firm that handles PHI. Second, the safeguards the system does enforce. Third, a data path you can check for yourself. When a vendor says it is certified, ask who did it.
Is ChatGPT HIPAA compliant?
No AI product is HIPAA compliant on its own. What matters first is the BAA. Will the maker sign one? It must cover the exact product and plan you would use. And it matters how your system sends it data. Don't put PHI in a public chat app that has no BAA. Check the maker's current terms for that product. Do it before any patient data goes in.
Do AI vendors need to sign a BAA?
Yes, if they create, receive, maintain or transmit PHI for you. That makes them a business associate. Their own subcontractors that handle it need BAAs with them too. Think of a model provider, a transcription service or a logging tool. Ask for the template first. Then ask for the data path. It shows who else is in the chain.
What is the difference between SOC 2 Type I and Type II?
Type I is a point in time. It shows the controls were designed well on one date. Type II covers a span of time. So it shows the controls kept working. Both are signed by an independent CPA firm. Both test against the AICPA Trust Services Criteria. Ask who issued the report and for what dates. And ask if you can read it under NDA.
Can AI be used with patient data?
Yes, when three things hold. Each firm in the data path has signed a BAA. The system has the Security Rule's five safeguards built in. And each prompt holds only the minimum PHI the task needs. The systems that pass a compliance review do two more things. They check who is asking before they show any data. And they send any action that matters to a person.
Sources
- 45 CFR 160.103, definition of "business associate" (Legal Information Institute): law.cornell.edu
- 45 CFR 164.312, Security Rule technical safeguards (Legal Information Institute): law.cornell.edu
- 45 CFR 164.502, minimum necessary and business associate disclosures (Legal Information Institute): law.cornell.edu
- General regulatory facts used in this post: HHS does not certify vendors as HIPAA compliant; a SOC 2 report is an attestation issued by an independent CPA firm against the AICPA Trust Services Criteria, Type I at a point in time and Type II over a period; FedRAMP is the federal cloud authorization program; CMMC is the Defense Department's cybersecurity certification for contractors; the TCPA governs calls and texts, and consent matters on every channel.
- What Techify signs and builds to: commitments, security and compliance.
Cameron Sullivan
Founder & CEO, Techify AI
Cameron Sullivan is the founder and CEO of Techify AI, a revenue-first AI engineering team. He has taught hundreds of thousands of students about AI, and his team has shipped 30+ enterprise-grade AI systems.
The studio