Healthcare companies using AI on patient or member data need HIPAA compliant AI. Here's what you need: BAAs, minimum necessary access, audit trails, and how to build HIPAA AI software that fits the rules.

When HIPAA Applies to AI

If your system creates, receives, maintains, or transmits protected health information (PHI), HIPAA applies. That includes AI: chatbots that handle patient questions, RAG over clinical or administrative documents, agents that schedule or triage, and any model or pipeline that processes identifiable health information. So HIPAA AI software isn't optional for healthcare—it's the baseline. The good news is that HIPAA is about safeguards (administrative, physical, technical), not about banning AI. You can build and buy HIPAA compliant AI if you design for it.

BAA and Vendors

When you use a vendor that touches PHI—cloud, LLM API, embedding API, database—you need a Business Associate Agreement (BAA). Not all vendors offer BAAs; many LLM and embedding providers do not. So your first filter for HIPAA AI software is: does every component that sees PHI have a BAA in place? If you send PHI to an LLM that won't sign a BAA, you're exposed. Options: use a BAA-covered LLM (e.g. certain enterprise or on-prem offerings), or architect so PHI never leaves your controlled environment (e.g. on-prem models, or strict de-identification before any external call).

"HIPAA compliant AI starts with the vendor list: every party that touches PHI must have a BAA and appropriate safeguards."

Minimum Necessary and Access Control

HIPAA's minimum necessary rule says use and disclosure of PHI should be limited to what's needed for the purpose. For HIPAA AI software that means: scope the data the AI can access (e.g. only the patient in context, only the fields needed for the task), and enforce access control so only authorized users and systems can run the AI on that data. Role-based access and clear boundaries (e.g. this agent can only read this patient's record for this session) keep you within minimum necessary and reduce the blast radius of a misconfiguration.

Audit Logging

You must be able to show who (or what) accessed PHI, when, and for what purpose. So every access to PHI by your AI—every query, every retrieval, every prompt that contained PHI—should be logged in an audit trail. Logs should be tamper-resistant and retained according to your policy. That way you can support investigations, breach analysis, and compliance reviews. Logging is also how you detect misuse or over-permissive agent behavior before it becomes an incident.

Designing HIPAA AI Software

Design with PHI in mind from the start. Encrypt PHI in transit and at rest. Don't send PHI to services that don't have a BAA. In RAG, ensure retrieval is scoped (e.g. by patient or encounter) and that you're not leaking PHI into prompts sent to non-BAA endpoints. For agents, scope permissions: the agent shouldn't have broad read/write across all records. Prefer human-in-the-loop for high-impact or sensitive actions. Document your data flows, where PHI lives, and how you satisfy the Security Rule (access control, audit, integrity, transmission security).

Common Gaps and How to Avoid Them

• No BAA with the LLM or embedding provider—resolve this before going live; use a BAA-covered vendor or keep PHI out of their scope.
• Incomplete audit logging—log every PHI access and use; don't assume "the cloud provider logs" is enough.
• Over-permissive agents—agents that can query any patient or any field violate minimum necessary; scope by user and task.
• Retrofitting compliance later—adding BAAs and logging after launch is harder and riskier; build HIPAA in from day one.

What to Do Next

HIPAA compliant AI is achievable: BAAs, minimum necessary access, encryption, and audit trails are the pillars. If you're building or evaluating HIPAA AI software for triage, support, or internal tools, we can help map your use case to concrete controls and architecture. Our healthcare solutions and AI Agent Development practice include governance and compliance from the start. Schedule a call to discuss your HIPAA and AI requirements.