HIPAA compliant AI is an AI tool a healthcare organization can use with protected health information (PHI) because the vendor signs a Business Associate Agreement and the tool meets HIPAA’s privacy and security safeguards. No AI is HIPAA compliant by default. It depends on the vendor’s contract, its controls and how your practice uses it.
Key takeaways
- HIPAA does not prohibit AI. It sets rules for how protected health information is used, disclosed and secured, whatever tool handles it.
- An AI vendor that creates, receives, stores or transmits PHI for you is a business associate and needs a signed Business Associate Agreement (BAA).
- A BAA alone is not enough. The tool also needs technical safeguards, limits on how your data is used, and admin controls you can manage.
- Consumer versions of general-purpose AI chatbots are usually not covered by a BAA, so they should not be used with patient data.
- HHS has proposed stricter Security Rule requirements, including encryption and multi-factor authentication. As of October 2026, the proposal is not final.
Disclosure: Simbie AI is a healthcare technology company that provides AI voice agents for medical practices. This guide does not name or rank other vendors.
What is HIPAA compliant AI?
HIPAA compliant AI is not a certification or a product category. It describes artificial intelligence that a covered entity, such as a medical practice, can use with patient data while meeting the Health Insurance Portability and Accountability Act (HIPAA). That depends on three things:
- The contract. The AI vendor signs a Business Associate Agreement that commits it to protecting PHI.
- The controls. The AI system has the administrative, physical and technical safeguards the HIPAA Security Rule expects.
- The use. Your practice configures and uses the tool in a way that follows HIPAA’s rules, including only sharing the minimum necessary information.
There is no official “HIPAA certification” for AI tools. When a vendor calls its product HIPAA compliant, it means the vendor follows HIPAA’s rules. You still need to verify it.
Is AI prohibited by HIPAA?
No. HIPAA does not ban AI or any specific technology. It regulates how protected health information is handled. AI tools are increasingly used in healthcare for patient communication, scheduling, documentation and analysis. The real question is not whether AI is allowed, but whether a specific AI tool, under a specific contract, handles PHI the way HIPAA requires.
Which HIPAA rules apply to AI tools?
Four parts of HIPAA matter most when healthcare providers use AI.
The Privacy Rule defines protected health information and limits how it can be used and disclosed. PHI is any health information that can identify a patient, including:
- Names, addresses and dates of birth
- Medical record numbers and other identifiers
- Photographs and voice recordings
- Details about a patient’s health, care or payment for care
When an AI tool answers patient calls, books appointments or reads clinical notes, it handles PHI.
The Security Rule sets the administrative, physical and technical safeguards for electronic PHI (ePHI). It is technology-neutral: it does not require a specific product, but it does require you to protect ePHI wherever it lives, including inside AI systems.
The Breach Notification Rule requires covered entities to notify affected individuals and the Department of Health and Human Services when unsecured PHI is breached. PHI that is properly encrypted is generally not considered “unsecured,” which is one reason encryption matters so much.
The Enforcement Rule sets out how HHS’s Office for Civil Rights investigates complaints and applies civil penalties for violations.
What makes an AI tool HIPAA compliant?
Four requirements separate HIPAA compliant AI tools from AI tools that are simply secure.
1. A signed Business Associate Agreement
Any vendor that creates, receives, maintains or transmits PHI on your behalf is a business associate. According to HHS guidance on business associates, covered entities generally need a written contract with them, the BAA. It sets out how the vendor may use PHI, requires appropriate safeguards and commits the vendor to report breaches. If an AI vendor will not sign a BAA, do not use the tool with patient data.
2. Technical safeguards that meet the Security Rule
The AI system should protect ePHI everywhere it exists: in transit, at rest and inside the AI’s processing. The table below maps the main Security Rule standards to what they mean for AI tools.
| Security Rule standard | What it means for an AI tool | Example |
|---|---|---|
| Access control (§ 164.312(a)(1)) | Role-based access, so users see only what they need | Front desk staff see scheduling data, not full clinical notes |
| Encryption (§ 164.312(a)(2)(iv)) | Encrypt ePHI at rest. Currently an addressable specification, in practice expected | Stored call details encrypted with a strong standard such as AES-256 |
| Audit controls (§ 164.312(b)) | Record who accessed ePHI and what they did | A log entry each time a user opens a patient’s call record |
| Integrity (§ 164.312(c)(1)) | Protect ePHI from improper changes, to ensure data integrity | Controls that prevent records from being altered without a trace |
| Authentication (§ 164.312(d)) | Verify the identity of each user | Multi-factor authentication to log in to the AI platform |
| Transmission security (§ 164.312(e)(1)) | Protect ePHI sent over networks | TLS 1.2 or higher between the phone system and the AI service |
3. Limits on how your data is used
A compliant vendor should use your PHI only to provide the service to you, as the BAA allows. Ask directly whether patient data is used to train AI models, shared with other customers or kept after the contract ends. You want clear written answers.
4. Healthcare controls you can manage
Look for admin controls built for healthcare: user roles, retention settings, audit logging you can review, and a clear process for exporting or deleting data.
Is it a HIPAA violation to use AI in healthcare?
Using AI is not a violation in itself. Violations happen when PHI is used or disclosed in a way HIPAA does not allow. Common examples:
- Entering PHI into a tool without a BAA. This is an impermissible disclosure, even if the AI company never leaks or misuses the data.
- Sharing more than the minimum necessary. Pasting a full chart into a tool when only one detail was needed.
- Skipping the risk analysis. Adding a new AI system that handles ePHI without assessing the risks it creates.
- Weak access controls. Shared logins or no audit trails, so no one can tell who saw what.
Data breaches involving AI tools are a major concern for healthcare organizations, but most risks come from how the tool is chosen and used, not from the technology itself.
Are popular AI tools HIPAA compliant?
It depends on the product and the plan, not the brand.
- Consumer AI products, such as free or personal versions of general-purpose chatbots, are usually not covered by a BAA. Healthcare professionals should not enter patient information into them.
- Business, enterprise or API plans from some AI providers can be covered by a BAA. Check that the specific product and plan you use is covered, and what the BAA excludes.
- Healthcare-specific AI tools, such as clinical notes AI, AI scribes and AI voice agents, are often built for HIPAA and offer a BAA. Verify it the same way.
Are general-purpose AI chatbots HIPAA compliant?
Some large language model providers offer healthcare or enterprise plans that can include a BAA, and several healthcare companies build tools on top of large language models under their own BAA. The answer comes down to the specific plan and contract, so ask the vendor for the BAA and confirm which features it covers.
Can you use AI with de-identified data?
Yes. Health information that has been properly de-identified is no longer PHI, so HIPAA’s rules do not apply to it. HIPAA allows two methods of de-identification:
- The Safe Harbor method: Removing 18 specific types of identifiers, such as names, dates and contact details, with no actual knowledge that the remaining data could identify the patient.
- Expert determination: A qualified expert determines that the risk of re-identification is very small.
De-identification alone is not a complete answer. Free-text clinical notes and call transcripts often contain identifiers that are hard to remove reliably, and combining data sets can make re-identification possible. For most practice workflows, a BAA and proper safeguards are the more practical route.
What is the new HIPAA rule in 2026?
In January 2025, HHS published a proposed update to the HIPAA Security Rule to strengthen cybersecurity for electronic protected health information. Among other changes, it would make encryption of ePHI and multi-factor authentication explicit requirements, with limited exceptions.
As of October 2026, the proposal has not been finalized, and HHS has said the current Security Rule remains in effect while the rulemaking continues. Even so, the proposal shows where expectations are heading. When you evaluate an AI vendor today, encryption and multi-factor authentication should already be in place.
How to use AI without violating HIPAA
Questions to ask any AI vendor
- Will you sign a BAA before any patient data is shared?
- How is ePHI encrypted in transit and at rest?
- Can we set role-based access and require multi-factor authentication?
- What audit logging is available, and can we review it?
- Is our data used to train AI models or shared with anyone else?
- Where is the data stored, and how is it kept separate from other customers’ data?
- How quickly will you notify us of a security incident?
- Do you hold independent security certifications, such as a SOC 2 Type II report?
Red flags
- The vendor will not sign a BAA, or says one is not needed.
- The vendor claims a “HIPAA certification.”
- Answers about data use and model training are vague.
- There is no way to control user access or review audit logs.
For a broader security review, see our HIPAA compliance checklist and our guide to SOC 2 vs HIPAA for AI vendors.
How to implement HIPAA compliant AI in your practice
- Run a risk analysis. Map where PHI will flow when the AI tool is added, and what could go wrong.
- Sign the BAA and review it with your compliance lead.
- Configure access. Set user roles, require multi-factor authentication and confirm audit logging is on.
- Start with a pilot. Use one workflow, such as appointment scheduling, before expanding.
- Train staff. Explain what counts as PHI inside the tool and how to report a problem.
- Monitor and review. Check audit logs and spot-check the AI’s work regularly, and repeat the risk analysis when you add new AI practices or workflows.
Good AI governance treats compliance as ongoing risk management, not a one-time checkbox. That approach also protects patient trust.
Where AI voice agents fit
AI voice agents handle a large share of patient communication, so they handle PHI on almost every call. For voice-specific requirements, such as call recordings and transcripts, see our guide to HIPAA compliance for AI voice agents.
Simbie’s AI voice agents answer and place patient calls for medical practices. They schedule and reschedule appointments, take refill requests, handle patient registration and collect pre-visit intake, then write the results into the EHR. Simbie is HIPAA-compliant, signs a BAA with each customer and is SOC 2 Type II certified, and integrates with Epic, eClinicalWorks, ModMed EMA, gGastro, EZDerm and Nextech.
Frequently asked questions
Is AI HIPAA compliant?
AI is not compliant or non-compliant by itself. An AI tool can be used in a HIPAA compliant way when the vendor signs a BAA, the tool has the required safeguards, and your practice uses it according to HIPAA’s rules.
Which AI is HIPAA compliant?
Look for AI tools whose vendor signs a BAA for the specific product and plan you use, encrypts PHI, offers access controls and audit logs, and limits how your data is used. Healthcare-specific AI tools are more likely to meet these requirements than consumer AI products.
Does a BAA alone make an AI tool HIPAA compliant?
No. A BAA is required, but the tool also needs proper technical safeguards, and your practice must configure and use it correctly.
Is clinical notes AI HIPAA compliant?
It can be. AI that drafts or summarizes clinical notes handles PHI, so it needs a BAA, encryption, access controls and clear limits on data use, like any other AI tool.
Can I use a cloud-based AI without violating HIPAA?
Yes, if the vendor signs a BAA and the service has the required safeguards. Cloud-based AI tools are widely used in healthcare under these conditions.
What are the four key rules of HIPAA?
The Privacy Rule, the Security Rule, the Breach Notification Rule and the Enforcement Rule. Together they govern how PHI is used, protected and reported, and how violations are enforced.
How can AI make patient data more secure?
Well-designed AI tools can reduce some human error, such as information written on paper or entered by hand, and they can enforce access controls and keep detailed audit logs automatically. Those benefits depend on the vendor’s safeguards and your configuration.
Ready to see how Simbie AI cuts costs by 60% for your practice? See how it works.