HIPAA AI Compliance

HIPAA AI Compliance for Healthcare Organisations

AI scribes, clinical documentation tools, and consumer AI are widely used in healthcare, often without BAAs, IT approval, or compliance review. Aona discovers AI use on covered endpoints, applies configured data-protection policies to supported interactions and provides evidence for your HIPAA review.

Book a demo All Compliance Frameworks →

policy framework template: HIPAA
supported data protection: Policy-led
usage and policy evidence: Endpoint
supported tool policies: Role-based

What HIPAA Requires for AI Tools

HIPAA was not written for AI, but its requirements apply fully to how AI tools handle PHI.

Business Associate AgreementsRequired

Review Business Associate Requirements

Determine whether the AI vendor acts as a business associate for the proposed use. Where it does, put the required BAA or other permitted arrangement in place before sharing PHI. Verify the exact service and account, permitted uses and disclosures, and the applicable safeguards. A vendor's general eligibility statement does not establish that every service or account is approved for PHI.

Minimum Necessary StandardPrivacy Rule

Only Share the PHI You Need

Where HIPAA's minimum necessary standard applies, covered entities and business associates must make reasonable efforts to limit PHI to what the intended purpose requires. Exceptions include disclosures to or requests by a healthcare provider for treatment. Assess the use, purpose and applicable exceptions before sharing a patient record with an AI service.

Audit ControlsSecurity Rule

Activity Logs for AI Access to PHI

The HIPAA Security Rule requires technical security measures to record and examine access to PHI. This includes AI tools that access, process, or generate PHI. Without audit controls in place, organisations cannot demonstrate HIPAA compliance or investigate breaches involving AI.

PHI SafeguardsSecurity Rule

Technical Safeguards for AI-Processed Data

HIPAA requires administrative, physical, and technical safeguards to protect PHI. As AI tools become part of clinical and administrative workflows, these safeguards must extend to AI-generated outputs, AI prompts containing PHI, and any data stored or transmitted by AI services.

The Shadow AI Problem in Healthcare

Clinical and administrative staff are adopting AI tools rapidly, often faster than IT and compliance can review them. These tools frequently access PHI without the safeguards HIPAA requires.

AI Scribes
Clinical documentation AI tools are widely adopted by clinicians looking to reduce documentation burden. Many are used without IT review, BAAs in place, or data residency checks.
Clinical Documentation Tools
AI-assisted note-taking, discharge summaries, and prior authorisation tools frequently process full patient records, often deployed at the department level without central oversight.
Diagnostic AI
Radiology AI, pathology AI, and clinical decision support tools may be evaluated or adopted by clinical teams before IT and compliance have assessed their HIPAA posture.

Aona in practice

From requirement to a practical control

Connect your PHI safeguards to the moment a staff member uses AI.

Minimum necessary → configured data protection

Limit the patient data in an AI input

The requirement: Where the minimum necessary standard applies, limit PHI to what the purpose requires.
What Aona contributes: Apply configured block or redaction policies when sensitive data is detected in a supported prompt or file input.
Evidence to review: Review the policy configuration and recorded events. Test the intended input with synthetic patient data before rollout.
Your organisation owns: Determine the permitted purpose, relevant exceptions and necessary information. Masking alone does not establish HIPAA de-identification.

Primary referenceHHS: Minimum necessary requirement

Business associate review → approved tool rules

Turn vendor decisions into tool policies

The requirement: Assess whether an AI vendor is a business associate and put the required agreement and safeguards in place before sharing PHI.
What Aona contributes: Use covered-endpoint AI visibility to locate tools for review, then approve, restrict or block supported tools according to your decision.
Evidence to review: Compare observed tool use and configured policies with your organisation's approved vendor list and contracts.
Your organisation owns: Verify the exact service, account and BAA terms. Discuss Aona's own contractual and deployment requirements before processing PHI.

Primary referenceHHS: Business associates

Audit controls → usage and policy evidence

Bring AI activity into a security review

The requirement: The Security Rule requires mechanisms to record and examine activity in information systems that contain or use electronic PHI.
What Aona contributes: Review recorded AI usage and policy events from covered endpoints to investigate the employee AI activity in scope.
Evidence to review: Retain relevant events alongside your investigation notes, endpoint coverage and applicable policy configuration.
Your organisation owns: Set appropriate access and retention. Combine Aona records with clinical-system, identity and vendor evidence to assess the full activity.

Primary referenceHHS: Summary of the Security Rule

Coverage starts with an installed Aona client and a supported AI interaction. Your HIPAA programme also needs appropriate agreements, risk analysis and safeguards across all systems handling PHI.

Work through a specific PHI decision

Use a focused guide and worked example for the question in front of your team.

FAQ

Frequently Asked Questions

Is using ChatGPT with patient data a HIPAA violation?

It depends on the information, service and use. Where an AI vendor acts as a business associate, the required BAA or other permitted arrangement must be in place before PHI is disclosed. Confirm the exact service and account, permitted use and safeguards. Apply the minimum necessary standard where it applies. A BAA alone does not establish HIPAA compliance.

What AI tools are HIPAA compliant?

Assess the exact service, configuration and intended use. Where the vendor acts as a business associate, a BAA or other permitted arrangement is required alongside applicable administrative, physical and technical safeguards and Privacy Rule requirements. A vendor's eligibility statement or signed BAA does not by itself make your organisation's use HIPAA compliant.

Does Aona sign a Business Associate Agreement (BAA)?

Discuss BAA requirements with our team as part of your security and contracting review. Confirm the applicable agreement, supported deployment and data-handling requirements before using Aona with PHI.

How do I prevent employees from putting PHI into AI tools?

Protecting PHI requires technical controls, approved tools and employee education. On covered endpoints and supported input paths, Aona can detect sensitive data and apply configured blocking or redaction policies. Recorded usage and policy events can support your review, subject to deployment coverage and retention settings. Your organisation verifies BAAs and other HIPAA requirements.

Get started

Secure AI in Your Healthcare Organisation

Explore covered-endpoint visibility, supported data-protection controls and evidence for your HIPAA review. Discuss BAA and deployment requirements with our team.