The short answer
Picture a practice manager signing up for an AI note-taker through a click-through form, and patient audio flowing to the vendor the same afternoon. Under HIPAA, that vendor is usually a business associate, and sharing patient information with it before a written agreement is in place is a problem. Get the BAA signed first, and check who the vendor passes the data to.
Usually yes. Under HIPAA, a business associate is a person or company that, on behalf of a covered entity and not as part of its workforce, creates, receives, maintains or transmits protected health information (PHI) for a regulated function such as claims processing, data analysis, billing or practice management, or provides services like consulting or data management involving PHI. Subcontractors that handle PHI for a business associate are business associates too.1 A covered entity may share PHI with one only after getting satisfactory assurance, documented in a written contract, that it will safeguard the information.4 For most AI scribes, coding tools, chat assistants and agents that touch PHI, that contract is a business associate agreement (BAA). This isn’t legal advice; confirm with counsel.
Deedglass
A sealed record you can check offline
Record 1043
- What ran
- Medication order, Bed 12
- Approved by
- Dr. N. Shah
- Check
- Matches
- Time
- 09:12
- The request
- Not keptA fingerprint only: 77d2…c41a
Each record is linked to the one before
- Record 1041
- Record 1042
- Record 1043
Who is a business associate
The definition turns on what the vendor does with PHI, not on whether it calls itself an AI company.1
| AI tool | Handles PHI for the covered entity? | Likely a business associate? |
|---|---|---|
| Ambient scribe drafting notes from visit audio | Yes: receives and creates PHI | Yes |
| Coding assistant reading charts | Yes: receives PHI | Yes |
| Prior auth agent submitting requests | Yes: transmits PHI | Yes |
| Chatbot answering general questions, no PHI entered | No | Probably not, if PHI truly never enters |
| Model trained only on de-identified data | Not PHI, if properly de-identified | Not for that data |
The definition excludes a health care provider receiving disclosures for the individual’s treatment.1 It doesn’t exclude a vendor because its software is “just a tool”.
The “no PHI” row is the one that fails in practice. A general chatbot becomes a PHI processor the moment a clinician pastes in a patient note.
The AI supply chain
AI tools often stack vendors: the app vendor, a cloud host, and a model provider whose API processes the prompts. HIPAA follows the PHI down the chain. A business associate may disclose PHI to a subcontractor only with satisfactory assurance, documented in writing, that the subcontractor will safeguard it4, and the business associate contract must require the business associate to make its subcontractors agree to the same restrictions.2
Code What the screen or file shows, copied as is.
Hospital (covered entity)
└─ BAA ─ AI app vendor (business associate)
├─ BAA ─ cloud host (subcontractor)
└─ BAA ─ model API provider (subcontractor)
So the question to ask the vendor isn’t only “will you sign a BAA?” but “who else sees our PHI, and do they have BAAs with you?”.
What a BAA must say
Under 45 CFR 164.504(e)(2), the contract must:2
- Set the permitted uses and disclosures of PHI.
- Say the business associate won’t use or disclose PHI beyond the contract or the law.
- Require appropriate safeguards, and that the vendor follow the Security Rule for electronic PHI.
- Require reporting of uses or disclosures not allowed by the contract, including breaches of unsecured PHI.
- Make subcontractors agree to the same restrictions.
- Support individuals’ rights of access, amendment and accounting of disclosures.
- Make records available to the HHS Secretary.
- Return or destroy PHI at termination, if feasible.
- Let the covered entity terminate for a material violation.
On timing, a business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery.3 Many covered entities negotiate shorter windows.
AI clauses worth adding
The required terms were written before generative AI. These additions address how AI tools actually handle data:
| Clause | Why |
|---|---|
| No training on our PHI, by the vendor or any subcontractor, unless agreed in writing | Training is a use; make it explicit |
| Named list of model providers and regions, with notice before changes | Subcontractors must be bound2 |
| Prompt and output retention limits, including at the model provider | PHI in logs is still PHI |
| Minimum necessary by design: the tool sends only the fields it needs | Uses and disclosures should be limited to the minimum necessary for the purpose4 |
| Records of the tool’s actions available to us, exportable | Supports audit controls5 |
| Breach notice in a set number of days, below the 60-day maximum | Faster response3 |
| Return or destruction of PHI, including derived data and embeddings | Termination terms2 |
The minimum necessary row deserves attention. HIPAA requires reasonable efforts to limit PHI to the minimum necessary for the purpose of a use, disclosure or request, with exceptions such as disclosures for treatment.4 An AI tool that sends the whole chart to a model to answer a billing question is hard to square with that, whatever the BAA says.
A decision table
| Question | If yes | If no |
|---|---|---|
| Will PHI enter the tool, even occasionally? | Treat the vendor as a business associate | Put controls in place to keep it out |
| Does the vendor use other companies to process data? | Require subcontractor BAAs2 | Confirm in writing |
| Could data be used to train models? | Prohibit or define it in the BAA | Still write “no training” |
| Does the tool act in our systems (write, submit)? | Require exportable action records | Records still help for reads |
Questions people ask
Do I need a BAA with the model provider behind an AI tool?
If their service will receive PHI on your behalf, the provider is acting as a business associate or subcontractor, and a written agreement is needed.14 Whether a given product is offered with a BAA is a question for the provider.
Is de-identified data covered?
Properly de-identified data isn’t PHI. See our safe harbor post for what that takes.
What if the vendor refuses to sign a BAA?
Then don’t let PHI reach the tool.
For the security side of vendor review, see our AI vendor questionnaire. Hospitals can see how agent actions are recorded on our healthcare page, with formats in the provenance spec. To try approvals and read-backs on a real database in your browser, open the playground; to grade what an agent can reach on your own machine, run npx deedglass scan (the grade, explained).
Written with AI assistance and checked against our claims register.