What makes a chatbot HIPAA-compliant?
No product is “HIPAA-compliant” on its own. HIPAA applies to covered entities and their business associates, so the real question is whether a clinic can use a particular chatbot in a way that meets its obligations.
Last reviewed against the HHS, FDA, FTC, and eCFR pages linked on this page on .
The short answer
If a chatbot vendor creates, receives, maintains, or transmits protected health information on a covered entity’s behalf — for example, chat transcripts that include a patient’s name and symptoms — the vendor is a business associate and needs a business associate agreement (BAA). The clinic and vendor must then protect that data under the Security Rule.
When the vendor is a business associate
HHS’s business associate guidance (opens in a new tab) covers vendors that handle PHI for a covered entity. HHS’s cloud computing guidance (opens in a new tab) adds that a service storing encrypted ePHI is still a business associate even if it lacks the encryption key. A chatbot that stores or processes patient conversations for a clinic typically falls in this group; a purely informational bot that never receives identifiable health information may not.
What the clinic still has to do
- Sign a BAA before any PHI flowsIncluding with any subcontractor that hosts or processes the conversations.
- Include the chatbot in your risk analysisWhere transcripts are stored, who can see them, and how long they are kept.
- Limit what it collectsThe minimum necessary standard applies to uses and disclosures that are not for treatment.
- Control access and keep audit logsSecurity Rule technical safeguards.
- Plan for breachesA leaked transcript of identifiable health information can trigger breach notification.
Tracking technologies on the same pages
HHS OCR’s bulletin on online tracking technologies (opens in a new tab) addresses analytics and tracking code on covered entities’ websites and apps. On June 20, 2024, a federal court vacated part of that guidance — the portion about tracking on unauthenticated public pages addressing health conditions or providers. HHS’s page notes the ruling and that it is evaluating next steps. Tracking inside a patient portal or other authenticated area is a separate question; read the current bulletin.
Common questions
- Is there a HIPAA certification for chatbots?
- No. HHS does not certify products as HIPAA-compliant. A vendor can sign a BAA and describe its safeguards; the covered entity remains responsible for how it uses the tool.
- Does a chatbot need a BAA if it only answers office-hours questions?
- If it never receives identifiable health information on the clinic’s behalf, it may not be a business associate. Once patients type in health details tied to who they are, it likely is. Ask counsel about your set-up.
Sources
- Business Associates (FAQs and guidance) (opens in a new tab) — HHS Office for Civil Rights
- Guidance on HIPAA & Cloud Computing (opens in a new tab) — HHS Office for Civil Rights
- Summary of the HIPAA Security Rule (opens in a new tab) — HHS Office for Civil Rights
- Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (opens in a new tab) — HHS Office for Civil Rights
Questions about this domain
Questions about clinicchat.ai or something explained here. There is no product, community, or demo to request, and we do not promise a response timeline. Do not send patient information through this form.
Get in touch
Last reviewed against the HHS, FDA, FTC, and eCFR pages linked on this page on .
Every rule described here is linked to the agency that publishes it. If one has changed, tell us.