Does HIPAA apply to AI?

Yes. HIPAA applies whenever AI systems create, receive, maintain, or transmit Protected Health Information on behalf of covered entities or business associates.

What is Protected Health Information (PHI)?

PHI is individually identifiable health information maintained or transmitted by covered entities or their business associates in any form or medium.

Does every AI vendor require a Business Associate Agreement (BAA)?

If an AI vendor creates, receives, maintains, or transmits PHI on behalf of a covered entity, a Business Associate Agreement may be required under HIPAA.

Does HIPAA prohibit the use of AI?

No. HIPAA is technology-neutral. Organizations may adopt AI provided they implement appropriate privacy and security safeguards for PHI.

What is the Minimum Necessary Standard?

HIPAA generally requires organizations to limit the use, disclosure, and request of PHI to the minimum amount necessary to accomplish the intended purpose.

How does HIPAA relate to SOC 2?

HIPAA is a healthcare regulation governing PHI, while SOC 2 is an attestation framework evaluating organizational controls. Many healthcare technology providers pursue SOC 2 while complying with HIPAA.

HIPAA & AI Compliance

Understand how HIPAA applies to AI systems that create, receive, maintain, or process Protected Health Information (PHI), and the safeguards organizations should implement to protect patient data.

Published: U.S. Department of Health and Human Services (HHS)Type: U.S. Healthcare Privacy & Security RegulationScope: Protected Health Information (PHI)

What Is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) establishes national standards for protecting the privacy and security of Protected Health Information (PHI). The regulation applies to covered entities, such as healthcare providers, health plans, and healthcare clearinghouses, as well as their business associates that create, receive, maintain, or transmit PHI.

While HIPAA was enacted before modern AI technologies, its Privacy Rule, Security Rule, and Breach Notification Rule continue to apply whenever AI systems process PHI. Organizations adopting AI in healthcare remain responsible for ensuring patient information is collected, accessed, used, disclosed, and protected in accordance with HIPAA requirements.

HIPAA & AI Compliance

Understand how HIPAA applies to AI systems that create, receive, maintain, or process Protected Health Information (PHI), and the safeguards organizations should implement to protect patient data.

Published: U.S. Department of Health and Human Services (HHS)Type: U.S. Healthcare Privacy & Security RegulationScope: Protected Health Information (PHI)

What Is HIPAA?

What Does HIPAA Require?

HIPAA establishes administrative, physical, and technical safeguards for protecting PHI. Organizations using AI must ensure those safeguards extend to AI-powered applications, workflows, and third-party vendors.

Privacy Rule (45 CFR Part 160 & Part 164, Subpart E)

Privacy of PHI

Protect PHI and govern how it may be used, disclosed, and shared.

Security Rule (45 CFR Part 160 & Part 164, Subpart C)

Security Safeguards

Implement administrative, physical, and technical safeguards to protect electronic PHI (ePHI).

Privacy Rule §164.502(b)

Minimum Necessary Standard

Limit the use and disclosure of PHI to the minimum necessary for a specific purpose.

Security Rule §164.312(a)

Access Controls & Authentication

Restrict access to PHI and ensure only authorized users and systems can access sensitive information.

Security Rule §164.312(b)

Audit Controls

Maintain audit logs and monitoring capabilities to record access to electronic PHI.

Security Rule §164.312(c)

Integrity Controls

Protect PHI from unauthorized alteration or destruction.

Security Rule §164.312(e)

Transmission Security

Protect PHI transmitted over electronic networks from unauthorized access.

Privacy Rule §164.502(e)

Business Associate Agreements (BAAs)

Establish Business Associate Agreements with vendors that create, receive, maintain, or transmit PHI on behalf of covered entities.

Breach Notification Rule (45 CFR Part 164, Subpart D)

Breach Notification

Notify affected individuals, HHS, and, where applicable, the media following certain breaches involving unsecured PHI.

What Does HIPAA Require?

Privacy Rule (45 CFR Part 160 & Part 164, Subpart E)

Privacy of PHI

Protect PHI and govern how it may be used, disclosed, and shared.

Security Rule (45 CFR Part 160 & Part 164, Subpart C)

Security Safeguards

Implement administrative, physical, and technical safeguards to protect electronic PHI (ePHI).

Privacy Rule §164.502(b)

Minimum Necessary Standard

Limit the use and disclosure of PHI to the minimum necessary for a specific purpose.

Security Rule §164.312(a)

Access Controls & Authentication

Restrict access to PHI and ensure only authorized users and systems can access sensitive information.

Security Rule §164.312(b)

Audit Controls

Maintain audit logs and monitoring capabilities to record access to electronic PHI.

Security Rule §164.312(c)

Integrity Controls

Protect PHI from unauthorized alteration or destruction.

Security Rule §164.312(e)

Transmission Security

Protect PHI transmitted over electronic networks from unauthorized access.

Privacy Rule §164.502(e)

Business Associate Agreements (BAAs)

Establish Business Associate Agreements with vendors that create, receive, maintain, or transmit PHI on behalf of covered entities.

Breach Notification Rule (45 CFR Part 164, Subpart D)

Breach Notification

Notify affected individuals, HHS, and, where applicable, the media following certain breaches involving unsecured PHI.

HIPAA at a Glance

Get a quick overview of HIPAA, including its scope, applicability, and core privacy and security requirements. Understand the safeguards organizations need to protect PHI across healthcare and AI-enabled workflows.

REGULATIONHIPAA

ENACTED1996

REGULATORU.S. Department of Health and Human Services (HHS)

APPLIES TOCovered Entities & Business Associates

PROTECTED DATAProtected Health Information (PHI)

CORE RULESPrivacy Rule, Security Rule, Breach Notification Rule

PRIMARY FOCUSPrivacy, Security, and Availability of PHI

APPLICABILITYOrganizations handling Protected Health Information

HIPAA is designed to protect individually identifiable health information while allowing healthcare organizations to adopt technologies that improve patient care, provided appropriate safeguards are implemented.

Who Should Consider HIPAA?

HIPAA applies to organizations that handle Protected Health Information directly or on behalf of regulated healthcare organizations.

Healthcare Providers

Hospitals, clinics, physician practices, laboratories, and other providers using AI in clinical or administrative workflows.

Health Plans

Health insurers and payer organizations processing PHI through AI-powered systems.

Healthcare Technology Companies

Organizations building AI applications that process, analyze, or store PHI for healthcare customers.

Business Associates

Cloud providers, AI vendors, software providers, and service organizations that create, receive, maintain, or transmit PHI on behalf of covered entities.

Healthcare AI Developers

Organizations developing AI assistants, clinical documentation tools, medical copilots, or other AI-enabled healthcare solutions.

HIPAA Readiness Checklist

Define where AI systems process PHI

Determine whether vendors qualify as Business Associates

Execute Business Associate Agreements (BAAs) where required

Apply the Minimum Necessary Standard to AI workflows

Restrict AI access to authorized users and systems

Implement technical safeguards for electronic PHI

Enable audit logging for AI interactions involving PHI

Encrypt PHI at rest and in transit

Conduct regular security risk assessments

Train workforce members on AI and HIPAA responsibilities

Establish breach response and notification procedures

Continuously review AI systems handling PHI

How HIPAA fits into the AI compliance landscape

HIPAA governs the protection of health information, but organizations often implement it alongside broader AI governance and security frameworks.

SOC 2

SOC 2 demonstrates that security controls are operating effectively. HIPAA establishes the legal requirements for protecting PHI, while SOC 2 provides assurance over operational controls.

ISO/IEC 42001

ISO/IEC 42001 establishes an AI Management System (AIMS). HIPAA focuses specifically on protecting health information when AI systems are used in healthcare environments.

NIST AI Risk Management Framework

NIST AI RMF provides guidance for identifying and managing AI risks. Healthcare organizations can use it alongside HIPAA to strengthen AI governance.

Frequently Asked Questions

Official Resources

For authoritative information about HIPAA, refer to the official sources:

HIPAA Privacy Rule Summary (HHS)

Solution Brief

HIPAA & AI

Strengthen AI Security for HIPAA

Learn how LangProtect helps healthcare organizations secure AI interactions, protect PHI, and support HIPAA compliance initiatives.

Download Solution Brief