HIPAA predates modern AI by decades. But its requirements are intentionally technology-neutral, and they apply fully to any AI system that processes protected health information.<\/p>\n\n\n\n
Three rules govern this space.<\/p>\n\n\n\n
The Privacy Rule controls when PHI can be used or disclosed. The Security Rule requires safeguards, including access controls, encryption, and audit logs for electronic PHI. The Breach Notification Rule requires organizations to report unauthorized disclosures, including accidental ones, through consumer AI tools.<\/p>\n\n\n\n
The proposed HIPAA Security Rule updates would strengthen cybersecurity requirements, including multi-factor authentication, encryption, and more rigorous risk analyses. AI systems that process PHI must be included in these assessments.<\/p>\n\n\n\n
As AI adoption grows across healthcare, the free AI in Healthcare course by Great Learning Academy<\/a> offers a practical introduction to key concepts and applications in healthcare AI. <\/p>\n\n\n\n Everything becomes mandatory, including encryption, multi-factor authentication, and comprehensive asset inventories that must now explicitly cover AI systems. AI tools that process PHI must be included in your organization's formal risk analysis.<\/p>\n\n\n\n The enforcement trend reinforces this. The HHS Office for Civil Rights resolved 21 HIPAA enforcement cases in 2025<\/a>, with 76% of those cases including penalties for risk analysis failures. The shift is from identifying compliance risks to proving you acted on them with documented remediation.<\/p>\n\n\n\n This is where most healthcare professionals make mistakes.<\/p>\n\n\n\n Consumer versions of ChatGPT (Free, Plus, Pro, and Team plans) cannot be used with PHI under any circumstances. No internal policy changes that. No BAA exists for consumer tiers. A single patient detail entered into these tools can trigger breach notification obligations.<\/p>\n\n\n\n The same applies to standard consumer versions of Claude, Gemini, and similar tools. The AI detecting patterns in your prompt is one thing. <\/p>\n\n\n\n The data logging, model training pipelines, and third-party integrations behind the interface are another. You cannot verify what happens to PHI once it enters a consumer product.<\/p>\n\n\n\n Vector embeddings created from patient data also count as PHI. They require the same encryption and access controls as source records. This catches many technical teams off guard.<\/p>\n\n\n\n Enterprise configurations with signed Business Associate Agreements change the equation.<\/p>\n\n\n\n Microsoft Azure OpenAI Service can be configured for HIPAA-eligible workloads, but the specific services covered by the BAA must be verified. Not every Azure feature is covered by default. <\/p>\n\n\n\n In early 2026, OpenAI launched ChatGPT for Healthcare<\/a> as a dedicated enterprise product with BAA support, data residency controls, and audit logging. This requires enterprise procurement, not an individual subscription.<\/p>\n\n\n\n A BAA alone is not enough. You still need to confirm how the vendor uses or trains on data, whether PHI leaves the protected environment through logs or third-party integrations, and whether your specific use case falls within the scope of the agreement.<\/p>\n\n\n\n Beyond selecting compliant tools, healthcare organizations also need a clear adoption strategy. Understanding the fundamentals of implementing AI in healthcare<\/a> can help teams move from experimentation to responsible deployment.<\/p>\n\n\n\n The most practical compliance approach for clinicians is de-identification before prompting. HIPAA's Safe Harbor method requires removing 18 specific identifiers<\/a> before data can be used freely. <\/p>\n\n\n\n These include names, geographic data below the state level, dates (except year), phone numbers, email addresses, Social Security numbers, medical record numbers, and device identifiers.<\/p>\n\n\n\n Once those identifiers are removed, the data is no longer PHI under HIPAA and can be used with any AI tool for drafting, summarizing, or analysis.<\/p>\n\n\n\n Here is what this looks like in practice.<\/p>\n\n\n\n Non-compliant prompt:<\/strong> \"Summarize the clinical notes for John Martinez, DOB 04\/12\/1968, MRN 7734821, admitted to St. Mary's on May 3rd with chest pain.\"<\/p>\n\n\n\n Compliant prompt:<\/strong> \"Summarize the following clinical notes for a 57-year-old male admitted with chest pain. [paste de-identified notes]\".<\/p>\n\n\n\n The second prompt produces the same output. Nothing in it constitutes PHI. No BAA required.<\/p>\n\n\n\n Even compliant AI usage depends on how instructions are structured. A prompt engineering guide<\/a> can help healthcare professionals learn the basics of crafting effective prompts, enabling them to generate more accurate, relevant, and useful outputs.<\/p>\n\n\n\n Age over 89 counts as an identifier. Specific dates beyond the year count. Geographic data more specific than state counts. Build a de-identification checklist and use it before any AI interaction involving patient data.<\/p>\n\n\n\n Instead of describing a specific patient, describe a clinical scenario. \"A 62-year-old diabetic patient with stage 3 CKD presenting with...\" gives the AI everything it needs to generate useful clinical content without identifying anyone.<\/p>\n\n\n\n As organizations explore more advanced AI capabilities, the rise of AI agents in healthcare<\/a> further highlights the need for strong governance and human oversight. <\/p>\n\n\n\n EHR exports almost always contain identifiers, even when you intend to share only clinical data. Copy specific clinical observations manually rather than pasting full records.<\/p>\n\n\n\n If your organization has an enterprise agreement with a HIPAA-eligible AI platform, check which specific features are covered. A signed BAA does not automatically cover every product feature the vendor offers.<\/p>\n\n\n\n The proposed 2025 HIPAA Security Rule update explicitly requires AI tools to be included in organizational risk assessments. Every AI tool that processes PHI in your environment needs to be included in your risk analysis, with documented controls.<\/p>\n\n\n\n This is both a compliance and patient safety requirement. \"The AI said so\" is no longer a defensible answer for clinicians, patients, or regulators. Document the human review step in your workflow.<\/p>\n\n\n\n HIPAA sets the federal minimum. Several states now impose additional requirements, and organizations operating across state lines must comply with the most stringent applicable standard. <\/p>\n\n\n\n Multi-state healthcare organizations should conduct a jurisdiction-by-jurisdiction review of state AI and privacy laws, as this regulatory landscape is evolving rapidly. <\/p>\n\n\n\n The compliance burden here sits with organizations, not just individual clinicians. A nurse using a consumer chatbot to draft a patient letter is not acting outside the bounds of normal professional behavior. They are doing what people everywhere do with AI tools. <\/p>\n\n\n\n The failure is organizational \u2014 no clear policy, no compliant alternative provided, no training on where the line is.<\/p>\n\n\n\n Healthcare leaders and compliance teams need to address three things:<\/p>\n\n\n\n The JHU AI in Healthcare Certificate Program addresses this directly. Week 4 covers LLM fundamentals and clinical considerations, including the limitations of AI in healthcare workflows and the regulatory framework around responsible deployment. Week 9 covers health data ethics, HIPAA, GDPR, India's DPDP Act, and EHR data governance. <\/p>\n\n\n\n Masterclass 3 takes this further with a live n8n workflow session on AI-powered pre-visit clinical risk assessment: building compliant, automated intake pipelines that handle patient data correctly from the start.<\/p>\n\n\n\n For healthcare professionals who want to move beyond compliance awareness to lead compliant AI implementation, the AI in healthcare course by Johns Hopkins University<\/a> provides the practical and regulatory foundation to do so responsibly.<\/p>\n\n\n\n Which AI Tools Are Not HIPAA-Compliant<\/strong><\/h2>\n\n\n\n
Which AI Tools Can Be HIPAA-Compliant<\/strong><\/h2>\n\n\n\n
How to Prompt Without Using PHI<\/strong><\/h2>\n\n\n\n
Practical Prompting Rules for Clinical Settings<\/strong><\/h2>\n\n\n
![\"\"](\"https:\/\/www.mygreatlearning.com\/blog\/wp-content\/uploads\/2026\/06\/image-12-1024x1024.png\")
<\/figure>\n\n\n\n1. Remove All 18 HIPAA Identifiers Before Prompting<\/strong><\/h3>\n\n\n\n
2. Use Role-Based Framing Instead of Patient-Specific Context<\/strong><\/h3>\n\n\n\n
3. Never Paste Raw EHR Output<\/strong><\/h3>\n\n\n\n
4. Verify Your Tool's BAA Coverage Before Use<\/strong><\/h3>\n\n\n\n
5. Document Your AI Use in Risk Analyses<\/strong><\/h3>\n\n\n\n
6. Do Not Use AI for Final Clinical Decisions Without Human Review<\/strong><\/h3>\n\n\n\n
State Laws Now Layer on Top of HIPAA<\/strong><\/h2>\n\n\n\n
State<\/strong><\/td> Law<\/strong><\/td> Key AI Requirement<\/strong><\/td><\/tr> Texas<\/td> TRAIGA<\/td> Healthcare providers must disclose AI use to patients no later than the date of treatment; failure may constitute a deceptive trade practice<\/td><\/tr> Colorado<\/td> AI Act<\/td> Imposes additional healthcare-specific governance requirements for high-risk AI systems; effective 2026<\/td><\/tr> California<\/td> AB 489<\/td> Additional healthcare AI governance requirements; effective 2026<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n What This Means for Healthcare Leaders<\/strong><\/h2>\n\n\n\n
\n