Is AI HIPAA compliant? What do I need from a vendor?
HIPAA does not approve tools. It sets duties. If a vendor handles patient information for you, you need a signed business associate agreement, and you must include the tool in your own risk analysis. Ask how data is stored, who sees it, and what happens if there is a breach.
No tool is "HIPAA compliant" by itself. HIPAA puts duties on you and on the vendor.
What HHS says about cloud services, which also guides AI tools that run online:
- If a vendor creates, receives, stores or sends protected health information for you, it is a business associate. You need a signed business associate agreement (BAA). Using one without a BAA is a violation.
- A vendor that stores only encrypted data is still a business associate, even without the key.
- You and the vendor should agree in writing who handles each security duty.
- You still must do your own risk analysis.
- Phones and tablets can be used if safeguards are in place.
What to ask a vendor:
- Will you sign a BAA?
- Where is my data stored, and who can see it?
- Is my data used to train models for other customers?
- How do you tell me about a breach?
- Can I get my data back, and is it deleted when I leave?
- Do you keep a log of who looked at what?
For general-purpose chat tools, do not paste client names or details unless you have a BAA.
This is not legal advice. For your own setup, speak with a HIPAA privacy lawyer or consultant.
Sources
- Guidance on HIPAA and Cloud Computing · HHS Office for Civil Rights
- AI Meets HIPAA Security: Understanding HHS’s Risk Strategies and Proposed Changes · JD Supra (law firm commentary on the January 2025 HHS proposed rule)
Reviewed by Beth Bledsoe, Care Business Advisor®, 28 Oct 2026. Rules change. Confirm with your state Medicaid agency before you act.
Want to see where this is costing your agency money? Four minutes, your agency’s name on the answer.