Short answer
No AI tool is HIPAA compliant on its own, and HHS does not certify products. What HHS requires is that your practice sign a business associate agreement with any vendor that handles patient information for you, assess the risks of the tool, and give it only the information it needs. A “HIPAA compliant” badge replaces none of that.
Key takeaways
- HHS says it does not endorse or recognize private “HIPAA certifications,” and they do not relieve a practice of its own obligations.
- A vendor that handles patient information for you is a business associate. A contract is required, and self-certification by the vendor does not replace it (HHS FAQ).
- Using a cloud service to store or process patient data without a BAA is, in HHS’s words, a violation of the HIPAA Rules.
- A signed BAA is where the checking starts. You still owe a risk analysis and the minimum necessary standard.
The question I hear most from practice owners about AI is some version of “is this one HIPAA compliant?” It is the wrong question, and the vendor’s sales page is happy to answer it anyway. The right question is what your practice has to have in place before patient information goes into the tool, and HHS has written that down.
Can an AI tool be certified HIPAA compliant?
No. HHS says there is no requirement to certify compliance, and that it does not endorse or otherwise recognize private organizations’ certifications regarding the Security Rule. Those certifications, it says, do not absolve a covered entity of its legal obligations. A badge on a vendor’s website tells you what the vendor claims about itself. It moves no obligation off you.
The cloud guidance says the same thing from another angle: HHS’s Office for Civil Rights does not endorse, certify or recommend specific technology or products. So when a vendor says “HIPAA compliant,” read it as “we will sign the paperwork and we have controls we are willing to describe.” Then ask to see both.
When a sales rep says the tool is HIPAA compliant, ask one follow-up: will you sign our BAA, or send us yours, this week? The answer tells you more than the badge. A vendor that hesitates, or says its product is only meant for non-patient data, has told you exactly where it belongs on your approved list.
When does an AI vendor need a business associate agreement?
When it creates, receives, maintains or transmits protected health information on your behalf. HHS lets a practice share that information with a business associate only after getting satisfactory assurances in a written contract, the business associate agreement. That covers an AI scribe hearing a visit, a chatbot booking appointments, and a tool summarizing patient messages.
Two details trip practices up. First, a vendor’s own statement that it is compliant does not replace the contract. HHS answers that question directly: business associates cannot self-certify or be certified by a third party instead of signing one. Second, encryption does not get a vendor out of it. A provider that stores encrypted patient data is still a business associate even when it cannot read the data.
| Use | Patient information involved? | What to have first |
|---|---|---|
| Drafting a blog post or job ad | No, if nobody pastes patient details | A staff rule that patient details never go in |
| Ambient scribe in the exam room | Yes | BAA, risk analysis, patient notice and consent process |
| Chatbot or phone agent that books visits | Yes | BAA, handoff rules, message limits |
| Summarizing patient emails or portal messages | Yes | BAA, and a person who reads before anything is sent |
| Free consumer chatbot account | Only if staff paste it in | Treat as off-limits for patient data unless a BAA is in place |
What happens if a practice uses an AI tool without a BAA?
HHS is blunt about the storage case. Its cloud guidance says that a practice using a cloud provider to process or store electronic patient information without a business associate agreement is in violation of the HIPAA Rules. The same logic reaches any AI service that receives patient details, including the free chatbot account a staff member opened on their own.
That last case is the one that worries me most, because nobody decided it. Someone at the front desk pastes a patient complaint into a chatbot to help word a reply, and patient information has just gone to a vendor with no contract. A written staff policy that names which tools are approved for patient information closes most of this gap.
Is a signed BAA enough to use an AI tool with patient data?
No. The BAA is where the work starts. HHS describes risk analysis as the first step in meeting the Security Rule, and says the analysis should be revisited when a practice plans to bring in new technology. You also still owe the minimum necessary standard: reasonable steps to limit the patient information used or shared to what the purpose needs.
- Signed BAAWhere the work startsA written contract. Self-certification does not replace it.
- Risk analysisThe first stepRevisit it when the practice plans to bring in new technology.
- Minimum necessaryOnly the fields it needsReasonable steps to limit patient information to what the purpose needs.
In practice, the minimum necessary standard means the AI tool gets the fields it needs and no more. A reminder tool needs a name, a phone number and an appointment time. It does not need the chart. HHS notes that the standard does not apply to disclosures between providers for treatment, so the rule bites hardest on the administrative tools, which is where most practices start.
What should a practice owner ask an AI vendor?
Ask for things you can hold, not reassurance. The signed BAA itself. Where patient data is stored and for how long. Whether your data is used to train their models, in writing. Who at the vendor can access recordings or transcripts. How you get your data back or deleted when you leave. What they do, and how fast, after a breach.
- Decide whether patient information will touch the tool at all. If not, write the rule that keeps it out and train on it.
- If it will, get the BAA before any patient data goes in, including during a trial.
- Update your risk analysis for the new tool, and record what you found.
- Set the tool up with the smallest set of patient fields it can work with.
- Add the tool to your staff policy and your training, and name who can use it.
Get the answers in writing and keep them with the BAA. If a vendor will not put its data retention and model training terms in writing, treat the spoken answer as a no. Terms change, so note the date you read them and check again when the contract renews.
What this post cannot settle for you
HIPAA is the federal floor. Some states add their own rules for health data, recording and AI disclosures, and they change more often than federal guidance does. I am not a lawyer, and this is not legal advice. Take this list to whoever handles compliance for your practice, and ask them to add what your state requires.
Questions people ask
Is ChatGPT HIPAA compliant?
No product is HIPAA compliant on its own. The question is whether the vendor will sign a business associate agreement for the specific plan you use, and whether you have assessed the risk. Without a BAA, keep patient information out of it entirely.
Does HHS approve or certify AI tools for healthcare use under HIPAA?
No. HHS says its Office for Civil Rights does not endorse, certify or recommend specific technology or products, and it does not recognize private HIPAA certifications as meeting a practice’s obligations.
If the vendor encrypts everything, do I still need a BAA?
Yes. HHS guidance says a provider that maintains patient data for you is a business associate even if it stores only encrypted data and has no key to read it.
Can I remove the patient’s name and paste the rest into an AI tool?
Removing the name alone is not de-identification. HHS recognizes two methods, one of which removes eighteen types of identifiers, including dates and record numbers. If you cannot meet one of them, treat the data as protected.
Who is responsible if the AI vendor has a breach?
Both of you can be. HHS says business associates are directly liable for complying with certain HIPAA provisions, and the practice still has to have had a BAA and a risk analysis in place. Read the breach terms before you sign.
Sources
- HHS, FAQ: Are we required to certify our organization’s compliance with the Security Rule? (read 2026): No certification requirement. HHS does not recognize private certifications, and they do not absolve obligations.
- HHS, FAQ 237: Can business associates self-certify instead of signing a contract? (read 2026): A written contract is required. Self-certification or third-party certification does not replace it.
- HHS Office for Civil Rights, Business Associates guidance (read 2026): Definition of a business associate, the BAA requirement and direct liability of business associates.
- HHS Office for Civil Rights, Guidance on HIPAA and Cloud Computing (read 2026): Encrypted storage still makes a vendor a business associate. Using one without a BAA violates the HIPAA Rules. OCR does not certify products.
- HHS, Guidance on Risk Analysis (read 2026): Risk analysis is the first step under the Security Rule and should be revisited for new technology.
- HHS, Minimum Necessary Requirement guidance (read 2026): Reasonable steps to limit information to what is needed, and the treatment exception.
- HHS, Guidance on De-identification of Protected Health Information (read 2026): The two de-identification methods and the Safe Harbor identifier list.
Published . Last reviewed .
Want this in your business?
Book a call and we will scope exactly which part of your operation an agent should take first.
Book a call with the team