HIPAA Wasn't Built for AI. You Still Have to Comply.

Every AI system touching patient data at your health center is subject to HIPAA. That is not debatable. What is debatable — and largely unresolved — is how a law written in 1996 applies to technology that generates, infers, and sometimes fabricates protected health information.

Your compliance team knows HIPAA inside out. Your AI vendors know AI inside out. Neither knows enough about the other's domain to protect you. You sit in the middle, holding the liability.

PHI in Training Data Is Not a Hypothetical

Large language models are trained on massive datasets. Some of those datasets include clinical text — discharge summaries, clinical notes, radiology reports — scraped from the open web or licensed from data brokers. If a vendor's model was trained on PHI from other health systems, you have a problem that your Business Associate Agreement almost certainly does not address.

Ask the question directly: Was this model trained on protected health information? Most vendors will say no, or say they de-identified everything. Press harder. De-identification under HIPAA has two methods — Safe Harbor (remove 18 identifiers) and Expert Determination (statistical verification that re-identification risk is very small). "We anonymized it" is not a HIPAA-compliant answer.

If the vendor cannot demonstrate compliant de-identification of training data, you are deploying a model with unknown PHI exposure into your clinical environment. That is a risk your compliance officer needs to evaluate before procurement, not after deployment.

Your BAA Has Gaps You Haven't Found Yet

A Business Associate Agreement covers the relationship between a covered entity and a vendor that handles PHI on its behalf. Standard BAAs were written for EHR vendors, clearinghouses, and billing services — organizations that store and transmit PHI in predictable ways.

AI vendors do not handle PHI in predictable ways. Consider what happens when you deploy an ambient documentation tool:

Patient speech is captured, processed, and converted to text. That is PHI creation, not just PHI storage.
The AI generates a clinical note. If it fabricates a medication, allergy, or diagnosis, it has created false PHI — a category HIPAA never contemplated.
The vendor may retain interaction data for model improvement. Does your BAA permit secondary use of PHI for the vendor's product development? Under which HIPAA provision — treatment, payment, or healthcare operations?

Most BAAs do not address AI-generated content, model training on interaction data, or the vendor's obligation when their system creates clinically inaccurate PHI. If your BAA reads like it was written for a standard SaaS platform, it was. And it is insufficient.

The Minimum Necessary Standard Applies to Model Inputs

HIPAA's minimum necessary standard requires covered entities to limit PHI disclosures to the minimum needed for the intended purpose. This principle applies to every piece of patient data you feed into an AI system.

If your AI-powered clinical decision support tool receives a patient's full medical record when it only needs the current medication list and chief complaint, you are violating the minimum necessary standard. The fact that the AI "needs more context to work better" is not a HIPAA exception.

Audit what data flows into each AI system. Map the inputs. Determine whether each data element is necessary for the stated function. If you cannot articulate why the AI needs a specific data element, it should not receive it.

This is straightforward compliance work — the same analysis you would do for any PHI disclosure. The difference is that most health centers have never applied it to AI inputs because nobody asked.

When AI Fabricates Clinical Content

Ambient documentation AI, clinical note generators, and summarization tools all share a common failure mode: they sometimes make things up. In the AI industry, this is called hallucination. In your clinical environment, it is a fabricated medical record entry.

If an AI writes "Patient is currently taking metformin 500mg" and the patient has never been prescribed metformin, you now have false information in a medical record that constitutes PHI. This creates overlapping problems:

Clinical safety — a downstream provider may act on fabricated information
Medical records integrity — state laws govern the accuracy of medical records
HIPAA implications — the patient has a right to request amendment of inaccurate PHI under 45 CFR 164.526, but can they request amendment of AI-generated content they never knew existed?

There is no published OCR guidance on AI-fabricated PHI. The regulatory framework has not caught up. That does not mean you are off the hook — it means you are operating in a gap where the first enforcement actions will set precedent, and you do not want to be the precedent.

State Privacy Laws Add Layers

HIPAA is the floor, not the ceiling. At least 15 states have enacted or proposed AI-specific privacy legislation that affects healthcare. Washington's My Health My Data Act (2024) creates a private right of action for unauthorized collection of health data — broader than HIPAA's definition of PHI. Colorado's AI Act requires impact assessments for high-risk AI systems, which includes most clinical applications. Tribal health organizations face additional sovereignty and data governance considerations.

If you operate across state lines, refer patients across state lines, or use a cloud-hosted AI service whose servers sit in another jurisdiction, you are potentially subject to multiple regulatory frameworks simultaneously. Your HIPAA compliance program does not cover these additional obligations unless you have specifically extended it.

Five Questions to Ask Your AI Vendors This Week

Your compliance team should be putting these to every AI vendor with access to PHI:

Was your model trained on protected health information from any source? Demand specifics on training data provenance and de-identification methodology.
Does your system retain patient interaction data, and if so, for what purpose? If the answer includes "model improvement," your BAA needs secondary use provisions.
What happens when your system generates clinically inaccurate content? You need a documented process for detection, correction, and notification.
What data elements does your system require as inputs, and why? Map this against the minimum necessary standard.
Which state privacy laws apply to your processing of our patients' data? If the vendor cannot answer this, they have not done the analysis — and neither have you.

If a vendor cannot answer these questions clearly, that is not a red flag about the vendor. It is a red flag about the maturity of AI compliance across the entire healthcare industry. Which means you need to do the analysis yourself.

The Compliance Gap Is the Liability

The core problem is not that HIPAA is inadequate. HIPAA's principles — minimum necessary, access controls, breach notification, patient rights, business associate accountability — all apply to AI. The problem is that nobody has mapped those principles to the specific ways AI systems create, process, infer, and sometimes fabricate PHI.

That mapping is your responsibility as a covered entity. Not your vendor's. Not OCR's. Yours.

Community health centers, critical access hospitals, and tribal health organizations face this challenge with fewer compliance resources than large health systems. The AI vendor's sales team will tell you their product is "HIPAA compliant." That phrase means almost nothing. HIPAA compliance is not a product feature — it is an organizational obligation that extends to every system touching PHI, including the ones that did not exist when the law was written.

Assess your organization's AI governance readiness.

This article is provided for informational purposes and does not constitute legal or compliance advice. Organizations should consult qualified HIPAA counsel before deploying AI systems that process protected health information. LumenHealth provides AI governance assessments for community health organizations and is not affiliated with any AI vendor or EHR platform.