AI Engineering · 7 MIN
HIPAA and AI projects: what your vendor must sign and prove
A plain guide to HIPAA for AI projects: the BAA, subcontractor chains, breach timing, de-identification, and what to ask vendors.
If an AI project touches protected health information for a HIPAA covered entity, the vendor is a business associate and must sign a business associate agreement (BAA) before it sees any data. The BAA must also flow down to every subcontractor that handles that data, including the model provider. This guide lists what to ask, sign, and prove.
- A vendor that creates, receives, maintains, or transmits protected health information for you is a business associate and needs a BAA.
- Business associates are directly liable under HIPAA, including for failing to sign BAAs with their own subcontractors.
- Under the Breach Notification Rule, a business associate must notify you without unreasonable delay and no later than 60 days after discovery, and your BAA can set a shorter window.
- HHS says the HIPAA Rules have no requirement specific to storing data outside the United States, but you must weigh that in your risk analysis.
- Removing the 18 Safe Harbor identifiers or using Expert Determination can take data out of PHI, which changes what you must sign.
- Nactore is an AI-native technology and growth company in Mumbai that builds with evals and clear data handling, and signs the contract terms your counsel requires.
This post explains how the rules work in plain language. It is not legal advice, so confirm the specifics with your privacy counsel.
When does an AI vendor become a business associate?
Whenever the vendor handles protected health information (PHI) on your behalf. HHS explains in its cloud computing guidance that a cloud service provider that creates, receives, maintains, or transmits electronic PHI on behalf of a covered entity is a business associate. The two must enter into a HIPAA-compliant BAA, and the provider is both contractually liable for the BAA and directly liable under the applicable HIPAA Rules. HHS defines a business associate in general the same way: an entity that performs functions or services for a covered entity involving creating, receiving, maintaining, or transmitting PHI.
This applies to a software team that builds a chatbot over patient messages, a model provider that processes those messages, and a hosting company that stores them. It does not depend on whether the work is called AI.
What must a business associate agreement contain?
HHS publishes sample BAA provisions. Use them as a checklist next to your counsel's template.
| BAA topic | What to look for |
|---|---|
| Permitted uses | A narrow description of what the vendor may do with PHI, and nothing beyond it |
| Safeguards | Commitment to the Security Rule protections for electronic PHI |
| Reporting | Notice of any use or disclosure not allowed by the contract, including breaches |
| Subcontractors | Written agreement that each subcontractor accepts the same restrictions |
| Individual rights | Support for access and amendment requests |
| Termination | Return or destruction of PHI at the end, where feasible |
HHS's sample language also has the vendor report any security incident it becomes aware of, not only breaches.
Who in the AI chain needs to sign?
Every party that touches PHI, in a chain. A typical AI build has four links.
- You, the covered entity.
- The software team that builds and operates the system.
- The model provider that processes prompts and outputs containing PHI.
- Hosting, logging, and vector database services that store text or embeddings derived from PHI.
HHS's fact sheet on direct liability states that a business associate is directly liable for failing to enter BAAs with subcontractors that create or receive PHI on its behalf. So ask your vendor to name each link and show the signed agreement. If a model provider will not sign a BAA for the product tier in question, PHI cannot go there.
What does HIPAA say about breaches?
The Breach Notification Rule requires a business associate to notify the covered entity without unreasonable delay and no later than 60 days after discovering a breach of unsecured PHI. HHS's sample BAA provisions note that the parties may add specificity, such as a stricter timeframe for the vendor to report a potential breach and whether the vendor will handle notifications to individuals.
Treat 60 days as the legal outer limit, not the target. You can write a shorter reporting window into the BAA. Ask your counsel what window fits you.
For AI systems, define the term "incident" widely in the contract. It should include a prompt log containing PHI sent to the wrong provider, not only a classic intrusion.
Can PHI be processed by a team outside the US?
HHS addresses a close cousin of this question for cloud providers. Its FAQ on servers outside the United States says this is allowed with a BAA in place, and that the HIPAA Rules contain no requirements specific to ePHI processed or stored outside the US. It adds that overseas storage may increase risk, that the risk analysis should account for it, and that if data sits in a country with documented increased hacking attempts, entities must implement reasonable and appropriate technical safeguards.
So the practical position is that location is a risk-analysis input, not a legal bar. Many covered entities still choose US-only storage and keep engineers off real PHI. A common pattern is for the development team to build and test on de-identified or synthetic data, while production runs in a US region under a BAA.
When is data no longer PHI?
HHS recognizes two de-identification methods in its guidance. Safe Harbor removes 18 listed identifiers, such as names, dates, phone numbers, account numbers, and IP addresses, with no actual knowledge that the person could be re-identified. Expert Determination uses a qualified expert to conclude the risk of re-identification is very small.
For AI projects, free text is the hard part. Clinical notes carry names and dates in unpredictable places, so any de-identification step needs its own evals. Measure how often identifiers slip through on a labeled sample before you trust it. Our guide to LLM guardrails in production covers how to build and test such filters.
Ask for a data flow diagram that marks, for every hop, whether PHI is present. If the vendor cannot draw it in an afternoon, the controls are not ready for a BAA.
What should you ask an AI vendor before signing?
- Which parties will touch PHI, and do all of them sign BAAs?
- Where is data stored and processed, and what are the retention settings?
- Is PHI used to train any model? The answer should be no, in writing.
- How is access controlled, and who on the vendor team can see real data?
- How are outputs evaluated, especially for errors that could affect care or billing?
- What is the incident reporting window, and what counts as an incident?
- What happens at exit, including deletion of logs, embeddings, and backups?
For related contract points, read IP and data terms for AI projects.
Frequently asked questions
Does HIPAA apply to every AI project in healthcare?
No. It applies when a covered entity or business associate handles PHI. A project using only properly de-identified data or purely non-health data may sit outside it, but you should confirm that with counsel.
Can we send patient data to a public chatbot?
Not unless a BAA covers that service and the use. Consumer chatbot products generally do not come with one, so ask your counsel before any PHI goes in.
Is a BAA enough to be compliant?
No. A BAA is a contract. You also need a risk analysis, access controls, training, and logging, and the vendor must meet the Security Rule on its side.
Who is liable if the vendor has a breach?
Both parties can face exposure. HHS holds business associates directly liable for certain requirements, and the covered entity keeps its own obligations. Counsel can advise on indemnity and insurance terms.
Sign the chain, measure the system
HIPAA does not prohibit AI. It asks that every party in the chain signs, that you understand where the data goes, and that incidents are reported fast. Get those right, then test output quality like any other AI system.
Want this built for your team? Book a free 30-minute call.
Want to apply this to your business?
Book a free 30-minute call. We will tell you what we would do first.