HIPAA and AI in 2026: A Security and Governance Guide for Healthcare Teams
HIPAA and AI meet wherever AI touches protected health information. A vendor that handles PHI for a covered entity is generally a business associate and needs a BAA, while a paste into a personal AI account is presumed a breach unless a documented four-factor assessment shows a low probability of compromise. We read the eCFR and the Federal Register to map each rule to AI tools and agents, confirm the 2025 Security Rule update is still a proposal, and set out a 90-day plan.
S
Sofia Reyes
Head of Compliance
Nov 3, 2026
HIPAA and AI meet wherever AI touches protected health information. A vendor that creates, receives, maintains or transmits PHI for a covered entity is generally a business associate and needs a BAA. Personal AI accounts usually have none, so a paste there is presumed a breach unless a documented four-factor assessment shows a low probability of compromise.
HIPAA has no AI chapter. Its Privacy, Security and Breach Notification Rules apply to a chatbot, an ambient scribe or an agent just as they apply to an EHR. This hub walks the three rules, what changed in 2026, and a 90-day plan. For prompt-level detail, read the companion post on PHI in AI prompts.
Last verified: 3 November 2026, against the eCFR text of 45 CFR Parts 160, 164 and 92 (current to 30 October 2026), the Federal Register, NIST and Anthropic's BAA article. HHS.gov refused our requests, so two HHS pages were read from Internet Archive copies of 23 October 2026 and are not linked.
Figure 1. The BAA question is asked per vendor, per plan and per feature, not once per brand.
Who does HIPAA cover, and where does an AI vendor fit?
Covered entities, defined in 45 CFR 160.103, are health plans, health care clearinghouses, and providers who transmit health information electronically in covered transactions. A business associate is a person who, on their behalf and outside the workforce, "creates, receives, maintains, or transmits protected health information" for a regulated function. An AI vendor whose model drafts a patient letter from a discharge summary fits that language closely.
Section 164.502(e) lets a covered entity disclose PHI to a business associate only after it "obtains satisfactory assurance" the data will be safeguarded. Section 164.504(e) lists what the contract, the BAA, must say: permitted uses, "appropriate safeguards," Security Rule compliance for electronic PHI, reporting of breaches, and flow-down to subcontractors.
Encryption is no way out. HHS's cloud computing guidance says a provider storing encrypted ePHI without the key is still a business associate: "Lacking an encryption key does not exempt a CSP from business associate status."
Scope is the trap. Vendors offer BAAs for some plans and features, not all. Anthropic's BAA article, for example, says its BAA "only covers the single organization that accepted it" and leaves connectors and some beta features outside it. Personal accounts usually carry no BAA, so one product can be a covered tool in one tab and an impermissible disclosure in the next. Our reviews of ChatGPT and Claude go plan by plan.
What does the Privacy Rule mean for prompts and uploads?
Under 164.502(a), PHI may not be used or disclosed "except as permitted or required." Treatment, payment and operations are permitted purposes, but sending PHI to an outside AI provider working for you still runs through 164.502(e), which means a BAA.
Minimum necessary, in 164.502(b), applies inside a BAA too: reasonable efforts to limit PHI "to the minimum necessary to accomplish the intended purpose." A coder drafting an appeal rarely needs the patient's name and member number in the prompt. Some disclosures are exempt, such as those to a provider for treatment; whether an exemption fits an AI workflow is for your privacy officer to decide.
De-identification under 164.514 has two routes. Safe Harbor removes 18 listed identifiers and requires no "actual knowledge" that the rest could identify someone. Expert Determination needs a qualified person to find the risk "very small" and document why. Redacting a prompt is neither. It cuts what is disclosed, but a rare diagnosis, a small town and an admission date can identify a patient with no name left.
What does the Security Rule expect when the system is an AI assistant or an agent?
The Security Rule in 45 CFR Part 164, Subpart C is technology-neutral. Treat the AI as an information system and the agent as a user, and every standard applies.
Risk analysis comes first. Section 164.308(a)(1)(ii)(A) requires "an accurate and thorough assessment" of risks to ePHI, and (B) requires measures that cut them "to a reasonable and appropriate level." An AI tool missing from the analysis makes it inaccurate. In its January 2025 proposal, HHS wrote that the analysis must consider "the type and amount of ePHI accessed by the AI tool, to whom the data is disclosed, and to whom the output is provided." That is preamble text, though its footnote cites the current provisions.
Agents change access control. Section 164.312(a)(1) allows access "only to those persons or software programs that have been granted access rights." An agent that reads the EHR or sends messages is such a program: it needs its own identity, the narrowest grant, and an owner. Audit controls (164.312(b)) must "record and examine activity" in systems that use ePHI. Integrity (164.312(c)(1)) guards against "improper alteration or destruction," which matters once an agent can write to a record.
Keep the paper for 6 years from creation or last effective date, whichever is later (164.316(b)(2)(i)). NIST SP 800-66 Rev. 2 (February 2024) is the federal guide to implementing these safeguards.
HIPAA requirement
What it means for AI tools and agents
Evidence to keep
BAA, 164.502(e) and 164.504(e)
Each vendor whose AI handles PHI, for the plan and features in use
Signed BAA, covered feature list, plan per team
Minimum necessary, 164.502(b)
Prompts carry only what the task needs, even under a BAA
Rule per use case, redact and block settings
De-identification, 164.514(a) and (b)
Only Safe Harbor or Expert Determination; redaction is neither
Expert report or Safe Harbor review
Risk analysis and management, 164.308(a)(1)(ii)(A) and (B)
One entry per AI tool or agent: data seen, destination, output
Updated analysis, risk register, owners and dates
Activity review, 164.308(a)(1)(ii)(D)
AI activity records reviewed on a schedule
Review log and follow-up tickets
Training, 164.308(a)(5)
Staff know approved tools, accounts and prompt rules
Material with AI examples, completions
Access control, 164.312(a)(1)
Each agent has its own identity and least privilege
Agent identities, scopes, approvers
Audit controls, 164.312(b)
What went to which tool under which account; agent tool calls
Logs in the SIEM, retention setting
Integrity, 164.312(c)(1)
Agents writing to records need guardrails
Write permissions, human approvals
Transmission security, 164.312(e)(1)
Prompts and files cross networks to the model provider
Vendor encryption terms, data flow diagram
Is a paste into a personal AI account a reportable breach?
The rule starts from yes. Under 164.402, a disclosure the Privacy Rule does not permit "is presumed to be a breach" unless the organization "demonstrates that there is a low probability that the protected health information has been compromised," based on a risk assessment of at least four factors.
Take a fictional case: Rachel Torres, a care coordinator, pastes a fictional patient's discharge summary into a free chatbot on her personal account.
Nature and extent of the PHI, "including the types of identifiers and the likelihood of re-identification." Name, birth date and diagnoses weigh far more than one lab value.
Who received it. An AI provider under consumer terms. Record the retention and training settings that applied that day.
Whether it was actually acquired or viewed. A submitted prompt reached the provider's systems, so this factor rarely helps.
Mitigation. Deleting the conversation or account, and any written assurance from the provider, with dates.
One exclusion covers a good-faith belief that the recipient "would not reasonably have been able to retain" the data, a hard case to make for a service built to store chats. The burden is yours (164.414(b)). If notice is due, individuals must hear within 60 calendar days of discovery; HHS hears at the same time for 500 or more people, or within 60 days after year end for fewer.
Figure 2. Write the assessment down either way, because the burden of proof sits with the organization.
What changed or is still pending in 2026?
The Security Rule update is still a proposal
HHS published its proposed Security Rule update on 6 January 2025 (90 FR 898). It would remove the "addressable" versus "required" distinction, require a written technology asset inventory and network map, require encryption of ePHI at rest and in transit with limited exceptions, and require procedures to restore critical systems and data within 72 hours.
We found no final rule as of 3 November 2026. The Federal Register's list of documents affecting 45 CFR Part 164 since December 2024 shows only the proposal and a January 2026 tribal consultation notice on a separate Privacy Rule proposal. In the eCFR, current to 30 October 2026, 164.308 and 164.312 were last amended in 2013. HHS's proposal page, in the archived copy, says "the current Security Rule remains in effect." Plan for the proposal; audit against the rule in force.
Section 1557 covers AI used in clinical decisions
45 CFR 92.210 bars covered entities, such as recipients of HHS funding, from discriminating on race, color, national origin, sex, age or disability "through the use of patient care decision support tools," defined in 92.4 as any tool or technology "used by a covered entity to support clinical decision-making." Paragraph (b) sets "an ongoing duty to make reasonable efforts to identify" tools whose inputs measure those traits; paragraph (c) requires reasonable efforts to mitigate the risk for each.
Part 92 took effect 5 July 2024, with "within 300 days" to comply with (b) and (c), which by our arithmetic is 1 May 2025. A June 2026 Federal Register notice reports a court vacating the rule's gender-identity provisions; 92.210 is not among them, and "the other provisions of the Section 1557 Rule remain in force."
ONC is removing EHR "model card" requirements
ONC's final rule of 28 October 2026 removes the source attribute and risk management requirements for decision support interventions, 170.315(b)(11)(iv) through (vi), effective 28 December 2026. They came from HTI-1 in January 2024, and ONC calls them "model cards." ONC urges users to ask developers for the information anyway and points them to 92.210. If your reviews relied on those disclosures, get them by contract instead. Payer-side rules are in our CMS AI guidance briefing.
What should a healthcare team do in the next 90 days?
Inventory AI touching PHI, with account and plan (weeks 1 to 3). Chat tools, AI features inside existing products, scribes, and agents on clinical machines.
Confirm a BAA per vendor and per plan (weeks 2 to 5), matched to the vendor's covered-feature list.
Add AI to the risk analysis (weeks 4 to 7), one entry per tool or agent.
Set redact and block defaults and minimum-necessary rules (weeks 5 to 8) per destination and data type.
Give agents least-privilege access and log their actions (weeks 6 to 9), with human approval for writes.
Update breach assessment procedures (weeks 7 to 10) with an AI section in the four-factor template.
Train staff (weeks 9 to 12) with fictional examples built from real workflows.
Review quarterly, because tools, plans and BAA terms keep changing.
Figure 3. One inventory feeds the BAA check, the risk analysis and the Section 1557 identification duty.
The free Healthcare AI Security Playbook helps here because it puts these HIPAA steps beside the Section 1557 and CMS duties, so one program answers all three.
What can software do here, and what is still your job?
No tool makes an organization HIPAA compliant. BAAs, risk analysis, policy and training are organizational work. Software gives you inventory, enforcement and evidence, and it has limits: detection misses context, managed-device controls do nothing for a personal phone, and no detector answers whether the destination is under a BAA.
Within that scope, AccuroAI recognizes 1,400+ AI tools in the browser and on managed devices, each with the signed-in account (personal or business) and the plan. Policies allow, redact or block per app, account type and data type, so uploads to personal accounts can be blocked while the licensed tool keeps working. Inline redaction runs 40+ classifiers, covering data such as Social Security numbers, account numbers and email addresses, in under 38 ms p99. Healthcare teams usually run AccuroAI on-prem or in their own cloud, so patient data stays inside their environment. For customers who choose AccuroAI-hosted deployment, AccuroAI signs a BAA. Whether any other deployment needs its own agreement is a question for your counsel. See our healthcare page.
Where should you go deeper?
PHI in AI prompts: identifiers, detection, and redact, block or allow.
No. Compliance describes how a covered entity or business associate handles PHI, not a product. A vendor can sign a BAA and offer settings that support compliant use, but your risk analysis, minimum-necessary rules, access controls and training decide whether a deployment meets the rules.
Does an AI vendor need a BAA if it keeps nothing?
Generally yes, if it receives or transmits PHI on your behalf. The definition covers anyone who "creates, receives, maintains, or transmits" PHI for a covered entity, so short retention does not remove the role. Retention lowers risk; it does not replace the contract.
Is redacting names enough to use a personal AI account?
Usually not. Redaction reduces what is disclosed but is not de-identification, which needs Safe Harbor (18 identifiers removed, no actual knowledge of re-identification) or Expert Determination. Dates, places and rare conditions left in the text can still point to one patient.
Is the new HIPAA Security Rule final?
Not as of 3 November 2026. HHS proposed it on 6 January 2025, and we found no final rule in the Federal Register or the eCFR. The current Security Rule, last amended in 2013, is the one in force and the one audits use.
Does Section 1557 apply to generative AI tools?
It applies to patient care decision support tools, meaning any tool or technology a covered entity uses to support clinical decision-making. A generative AI tool used that way falls inside the definition, so it belongs on the 92.210(b) identification list and in the mitigation review.
This guide is general information about federal rules, not legal advice. Confirm how they apply to you with counsel.
See it on your own devices: a 72-hour pilot maps the AI already in use before any policy is enforced, including the tools that already see patient data. Start a free pilot.
