HIPAA and AI tools
HIPAA has no separate rule for artificial intelligence. The same rules apply as for any other vendor or system: who handles the PHI, under what agreement, how much of it, and whether it is identifiable at all.
Last reviewed against the HHS, FDA, FTC, and eCFR pages linked on this page on .
The short answer
Do not put identifiable patient information into an AI tool unless the provider has signed a business associate agreement with you and the use is permitted. If the data is properly de-identified under 45 CFR 164.514, HIPAA no longer applies to it.
The questions that decide it
| Question | Why it matters |
|---|---|
| Is the information PHI? | Individually identifiable health information held by a covered entity or business associate is PHI; properly de-identified data is not. |
| Does the AI provider handle PHI for you? | Then it is a business associate and needs a BAA before any PHI is shared. |
| Is the use permitted? | Treatment, payment, and operations are permitted; other uses may need patient authorization. |
| Is it the minimum necessary? | For uses outside treatment, share only what the task needs. |
| Is it covered by your risk analysis? | The Security Rule expects every system holding ePHI to be assessed. |
De-identification: HHS’s two methods
45 CFR 164.514(b) (opens in a new tab) gives two ways to de-identify health information, explained in HHS’s de-identification guidance (opens in a new tab):
- Safe Harbor — remove 18 specified identifiers (names, most geographic detail below the state, dates other than year, contact details, record and account numbers, and others) and have no actual knowledge that the rest could identify the person.
- Expert Determination — a qualified expert determines and documents that the risk of re-identification is very small.
Free text such as visit notes and chat transcripts often contains identifiers in unexpected places, which is why de-identifying it is harder than it looks.
Common questions
- Can staff use a consumer AI chatbot with patient information?
- Not with identifiable PHI unless the provider has signed a BAA with your organisation and the use is permitted. Consumer terms of service are not a BAA.
- Does HIPAA apply to de-identified data?
- No. Health information de-identified under 45 CFR 164.514 is not PHI.
Sources
- 45 CFR § 164.514 — De-identification and minimum necessary (opens in a new tab) — Electronic Code of Federal Regulations
- Guidance Regarding Methods for De-identification of PHI (opens in a new tab) — HHS Office for Civil Rights
- Business Associates (FAQs and guidance) (opens in a new tab) — HHS Office for Civil Rights
- Summary of the HIPAA Security Rule (opens in a new tab) — HHS Office for Civil Rights
Questions about this domain
Questions about clinicchat.ai or something explained here. There is no product, community, or demo to request, and we do not promise a response timeline. Do not send patient information through this form.
Get in touch
Last reviewed against the HHS, FDA, FTC, and eCFR pages linked on this page on .
Every rule described here is linked to the agency that publishes it. If one has changed, tell us.