If an AI service creates, receives, maintains or transmits protected health information on behalf of a covered entity, it fits the definition of a business associate, and the rule expects satisfactory assurances in a written contract. Pasting PHI into a consumer tool with no agreement is the pattern to avoid. Ask counsel about your exact setup.
The test is what the tool does with PHI
The definition does not mention AI. It turns on function: a person or entity that, on behalf of a covered entity, creates, receives, maintains or transmits PHI for a regulated function, or provides certain services where the service involves disclosure of PHI to it. A chat assistant, transcription tool, coding agent or summariser that receives patient data for your organisation falls inside that logic.
Common scenarios
| Scenario | PHI involved | What to do |
|---|---|---|
| Clinician pastes notes into a public chatbot | Yes | Stop, and offer an approved alternative |
| Company deploys an AI scribe with a signed agreement | Yes | Review the agreement and the vendor's subcontractors, including the model host |
| Developer asks an assistant to debug code with synthetic data | No | Allowed with a clear rule on test data |
| Developer pastes a production log with patient identifiers | Yes | Treat as an incident to assess |
| Assistant sees de identified data | Depends on the method used | Confirm the method with counsel |
Questions for an AI vendor
- Will you sign our business associate agreement?
- Is our data used to train or improve models? Can that be switched off in writing?
- Where is data stored, for how long, and who can read it?
- Which subprocessors, including model hosts, touch the data?
- How do you log and report security incidents?
- Can we delete data at the end of the contract and get written confirmation?
Controls on your side
- Publish a short rule that says which tools may receive PHI.
- Block or monitor unapproved tools where you can.
- Apply the minimum necessary idea: send the fewest fields needed.
- Scrub prompts and attachments in tools you build.
- Keep agents on short lived, narrowly scoped credentials.
The minimum necessary rule applies when using or disclosing PHI or requesting it from another covered entity or business associate. Treat prompts as disclosures.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis, continuous monitoring and evidence automation that can support a vendor review. You can run a free scan at gold.safeguard.sh/scan. It does not make any organisation compliant with HIPAA, and this post is not legal advice.
Quick check
Is a vendor's HIPAA ready statement the same as a signed agreement?
No. Marketing language does not replace a signed business associate agreement or your own review.
Does de identified data need a BAA?
It depends on whether the data truly meets the de identification standard. Confirm with counsel before you rely on that.
Sources
Last reviewed: 19 October 2026.
