HIPAA compliant AI is an artificial intelligence system that handles protected health information under the same safeguards HIPAA imposes on any covered entity or business associate: enforced access controls, encryption, audit logging, minimum necessary use, and a signed business associate agreement with every vendor that touches the data.
There is no HIPAA certification for AI products. No regulator issues one. Compliance is a property of how you deploy and govern the system, not a badge a vendor buys. The table below shows where a general-purpose AI assistant diverges from a deployment a healthcare compliance officer can defend.
| REQUIREMENT | GENERAL-PURPOSE AI | HIPAA COMPLIANT AI |
|---|---|---|
| Vendor agreement | Standard terms of service | Signed business associate agreement |
| Data location | Vendor cloud, often multi-tenant | Your environment or a boundary you control |
| Access control | Same answers for every user | Access enforced per user role and attribute |
| Audit logging | Prompt history at best | Record of what was retrieved and why |
| Source of answers | Open web and model memory | Approved internal sources only |
| Knowledge freshness | Static index, silently stale | Expired content pulled from circulation |
| Training on your data | Often permitted by default | Contractually prohibited and verified |
What HIPAA Actually Requires of AI Systems
The HIPAA Security Rule predates large language models by two decades, but its requirements map onto AI cleanly. The rule demands administrative, physical, and technical safeguards for electronic protected health information. An AI assistant that retrieves clinical policies, prior authorization criteria, or patient records is a system processing ePHI, and every technical safeguard applies to it. The US Department of Health and Human Services makes no exception for systems that are merely reading data rather than storing it.
The Business Associate Agreement Is the Threshold
If a vendor processes PHI on your behalf, it is a business associate and needs a signed BAA. Most consumer AI tiers will not sign one. Some enterprise tiers will, but the agreement is only as good as the architecture behind it. Read what the BAA actually covers: whether prompts and retrieved documents are retained, whether they are used for model improvement, which subprocessors see the data, and what the breach notification window is. A BAA that permits training on your inputs is not a control, it is a disclosure.
Minimum Necessary and the Audit Control Rule
Two provisions do most of the work in AI deployments. The minimum necessary standard says a workforce member should access only the PHI needed for their role, which means an AI assistant must return different answers to a billing clerk than to an attending physician. The audit control provision requires mechanisms that record and examine activity in systems containing ePHI, which means you need a durable record of what the AI retrieved on whose behalf, not just a chat transcript. NIST Special Publication 800-66 remains the practical reference for implementing both.
Why Most AI Tools Fail the HIPAA Test
The failure is rarely the model. It is everything around the model. Four patterns account for most of it.
First, access control stops at the application door. The tool authenticates the user, then retrieves from a single flat index that ignores who is asking. Second, the knowledge base is uncontrolled: a shared drive of policies, some current, some three revisions out of date, with nothing marking the difference. Third, there is no provenance. The assistant produces fluent prose with no traceable link back to the document that authorized each statement, which makes review impractical and turns an audit response into guesswork. Fourth, shadow usage: clinicians paste PHI into consumer chatbots because the sanctioned tool is slower or less useful. That last one is a governance failure disguised as a security incident.
The pattern is familiar beyond healthcare. Gartner predicts that through 2026, organizations will abandon 60% of AI projects unsupported by AI-ready data. In regulated settings the abandonment usually happens at the compliance review, not in the lab.
How to Build HIPAA Compliant AI on Governed Knowledge
Keep PHI Inside Your Boundary
Sovereignty is the precondition for everything else. Run the knowledge layer inside your own environment, whether that is on premise, in a private cloud tenancy, or in an air-gapped enclave. A model-agnostic architecture matters here for a practical reason: model vendors change terms, and a design that lets you swap the reasoning engine without moving the data means a contract change never forces a migration of PHI. See how Sovrinty handles deployment and data boundaries for regulated environments.
Enforce Access at the AI Layer
Minimum necessary has to be enforced at retrieval, not at the interface. Attribute-based access control at the AI layer means the assistant evaluates role, department, clearance, and purpose before a document is eligible to inform an answer. A user who cannot open a record should not be able to obtain its contents through a summary. This is the difference between an AI product with a permissions screen and one where permissions are part of the retrieval path.
Make Every Answer Traceable and Current
Answers should be assembled only from approved sources, with citations carried through to the reader, and sentences that cannot be traced to an approved source removed before the answer is served. Freshness needs the same treatment: knowledge that has passed its review date is pulled from circulation automatically rather than quietly answering next year's questions with last year's protocol, content hashes surface when a source has drifted from what was approved, stewards record supersession when a policy is replaced, and citations carry stale flags so a reviewer sees the risk on the face of the answer. That combination is what turns a plausible response into an answer you can prove.
A HIPAA Compliant AI Checklist for Healthcare Teams
Before an AI assistant touches PHI, a compliance officer should be able to answer yes to each of the following.
- A signed BAA is in place with every vendor and subprocessor in the path, and it prohibits training on your data.
- PHI remains inside a boundary you control, with documented data residency and no undisclosed egress.
- Retrieval enforces minimum necessary per user, and the enforcement is testable with a negative-case review.
- Every answer cites the approved sources behind it, and unsourced content is not served.
- Content has owners and review dates, and expired content leaves circulation without manual intervention.
- Audit records survive independently of the chat interface and can be produced on request in an OCR investigation.
- A sanctioned tool exists that is good enough that staff do not route around it.
Healthcare organizations that get this right stop treating AI as a pilot to be contained and start treating it as infrastructure to be governed. If you are building toward that, see how Sovrinty approaches governed AI for healthcare, or book a demo and bring your hardest compliance question.
FAQ
Common questions
Is ChatGPT HIPAA compliant?
Not by default. Consumer tiers do not come with a business associate agreement, so entering PHI into them is a disclosure. Some enterprise tiers will sign a BAA, but the agreement alone does not deliver minimum necessary enforcement, provenance, or audit records, which HIPAA also requires.
Can an AI product be HIPAA certified?
No. HHS does not certify products against HIPAA. Vendors may hold third-party attestations such as SOC 2 or HITRUST, which are useful evidence, but compliance is a property of your deployment, contracts, and controls rather than a certificate the software carries.
What makes an LLM HIPAA compliant?
The deployment around it, not the model weights. A HIPAA compliant LLM deployment keeps PHI inside a boundary you control, runs under a BAA that forbids training on your data, enforces access per user at retrieval time, and produces durable audit records of what was retrieved and why.
Does HIPAA require audit logs for AI systems?
Yes. The Security Rule's audit control provision requires mechanisms that record and examine activity in systems containing ePHI. For an AI assistant that means logging the retrieval events and sources behind each answer, not only the text of the conversation.
How do we stop clinicians pasting PHI into consumer AI tools?
Policy and blocking help, but shadow AI persists mainly when the sanctioned tool is worse. The durable fix is a governed internal assistant staff actually prefer, because it draws on approved, current, access-aware knowledge and cites the sources behind every answer.
Can we use a cloud LLM and still meet HIPAA?
It is possible with a signed BAA, documented data residency, and contractual limits on retention and training. Many organizations reduce their exposure further by keeping the knowledge layer and PHI inside their own environment and treating the model as a swappable component.
