Using AI with patient data: a HIPAA checklist for practices
AI tools can take real work off a practice’s plate, and many of the big ones will sign a Business Associate Agreement on the right plan. The risk is in the details: the wrong plan, a feature outside the agreement, or a staff member’s personal account. Work through these ten steps for each tool before patient information goes in.
List every AI tool your team actually uses
Include the ones nobody approved: free chatbot accounts, browser extensions, note-takers that join video calls, phone systems with AI summaries. Paste the list into our tool list checker to see each vendor’s BAA status at once.
Confirm the vendor signs a BAA on your plan
A vendor that signs a BAA for its enterprise plan doesn’t cover a staff member’s personal or free account. Check the plan rows on the tool’s page, then check which plan you’re actually paying for.
Check that the AI features are inside the BAA
Vendors often leave newer AI features out of the BAA or switch them off in HIPAA mode. Each tool page lists the AI features the vendor says are excluded or only partly covered.
Sign the BAA before anyone enters patient data
HIPAA requires the BAA to be in place before the vendor handles PHI, not after a pilot.1 Keep a copy of the signed agreement and note the date and the plan it covers.
Turn on the settings the BAA depends on
Some BAAs only apply once you enable a HIPAA mode, zero data retention, a dedicated workspace or a specific region. Turn off model training on your data where the vendor allows it, and set retention as short as your work allows.
Keep PHI in covered accounts only
Give staff accounts in the covered workspace and tell them personal accounts are off limits for patient information. Use single sign-on and turn off sharing features you don’t need, so data stays where the BAA applies.
Share the minimum, and de-identify when you can
HIPAA’s minimum necessary standard applies to AI prompts like any other disclosure. Data that’s properly de-identified is no longer PHI.3 HHS recognizes two ways to get there: an expert determination that the risk of re-identification is very small, or the “safe harbor” method of removing 18 kinds of identifiers. Those include names, addresses smaller than a state, all dates except the year, phone numbers, email addresses, record numbers and full-face photos. Swapping a name for initials isn’t enough.
Add each tool to your risk analysis
The HIPAA Security Rule expects you to assess risks to electronic PHI, and HHS says you should understand a cloud vendor’s setup well enough to do that.2 Record what data goes into the tool, where it’s stored, who can see it, and how you get it back or have it deleted when you stop using the service.
Write a one-page AI policy and train your staff
Name the approved tools and plans, what may and may not go into them, and who to ask. A common gap isn’t the approved tool at all: it’s a well-meaning staff member using a personal account.
Re-check when the vendor changes its terms
Plans, features and BAA scope change often. Use “Watch this tool” on a tool’s page to get an email when its BAA terms change, or follow what changed.
New to the agreement itself? Read what a BAA must include, or browse every AI tool that signs one.
Sources
- Business Associates (guidance)
- Guidance on HIPAA & Cloud Computing
- Guidance Regarding Methods for De-identification of PHI
This guide explains HIPAA in plain terms for people choosing AI tools. It isn’t legal advice; confirm with your counsel and the vendor before sending protected health information.