Doctors have embraced AI faster than almost anyone expected. An American Medical Association survey found that 81% of physicians now use AI tools professionally, more than double the rate in 2023. They use it for visit notes, chart summaries, patient portal replies and discharge instructions.
Every one of those tasks involves protected health information. That's where AI HIPAA compliance gets tricky. HIPAA doesn't care how convenient a tool is. It cares where patient data goes, who can see it and whether the right agreements are in place.
The same AMA research found that 86% of physicians say data privacy is critical for wider AI adoption. So the concern about AI HIPAA compliance is there. What's often missing is a clear picture of which tools are safe, which aren't and what a practice needs to do before anyone types a patient's name into a chatbot.
How HIPAA Applies to AI Tools
HIPAA has no special section for artificial intelligence. It doesn't need one. The rules that already govern electronic health records, email and cloud storage apply to AI tools in exactly the same way.
The HIPAA Security Rule requires practices to protect electronic protected health information (ePHI) with administrative, physical and technical safeguards. If an AI tool creates, receives, stores or transmits ePHI, it falls under those requirements. A note-taking app that hears a patient describe symptoms counts. So does a chatbot that drafts a reply to a patient message.
For AI HIPAA compliance, the practice stays responsible no matter which tool an employee picks. "The front desk used it on their own" won't hold up well in an audit. Honestly, that's probably the single most important thing for a practice manager to understand about AI HIPAA compliance.
Is ChatGPT HIPAA Compliant?
This is the AI HIPAA compliance question practices ask most. The short answer: the free consumer version of ChatGPT is not a safe place for patient information. The same goes for free versions of Gemini, Claude and most other public chatbots.
The reason is simple. Consumer AI tools generally don't sign business associate agreements with individual users, and their terms may allow the provider to store or review what users type. Without a signed agreement, a practice has no HIPAA basis for sharing ePHI with that company.
Some AI vendors do offer business or enterprise plans that come with a business associate agreement. Those versions may be usable for certain tasks once the practice signs the agreement and sets the tool up correctly. So asking is ChatGPT HIPAA compliant is a bit like asking whether email is HIPAA compliant. It depends on the version, the contract and the configuration, not the brand name.
The Role of a Business Associate Agreement for AI
A business associate agreement (BAA) is a contract between a practice and a vendor that handles patient data on its behalf. The vendor agrees to protect that data and follow HIPAA rules. Without one, sharing ePHI with the vendor is generally a violation. The BAA is the foundation of AI HIPAA compliance.
HHS made this point clearly in its guidance on cloud computing. A cloud provider that stores or processes ePHI is a business associate, even if the data is encrypted and the provider can't read it. Most AI tools run in the cloud, so the same logic applies.
Before signing a business associate agreement for AI, a practice should ask the vendor a few direct questions:
- Does the vendor use customer data to train its AI models?
- Where is the data stored, and for how long?
- Who at the vendor can access patient information?
- How quickly will the vendor report a breach?
- Does the agreement cover every AI feature the practice plans to use?
That last question catches people off guard. Some vendors cover their core product under a BAA but exclude newer AI add-ons. It's worth reading the fine print, perhaps twice.
Common AI HIPAA Compliance Risks in Medical Practices
Most AI HIPAA compliance problems don't come from bad intentions. They come from staff trying to save time. A few patterns show up again and again.
Staff Using Personal AI Accounts
A medical assistant pastes a patient's history into a personal chatbot to draft a referral letter. It takes 30 seconds and seems harmless. It's also a disclosure of ePHI to a company with no BAA. This kind of shadow AI is probably the most common risk in small practices.
AI Scribes and Notetakers Without Proper Vetting
Ambient AI scribes that listen to exam room conversations can save providers hours of documentation. They also capture everything a patient says. Practices need to confirm a BAA is in place, understand how recordings are stored and decide how patients are told about the tool.
AI Features Added to Existing Software
Practice management systems, EHRs and email platforms keep adding AI features. A practice may already have a BAA with the vendor, but that doesn't automatically mean the new AI feature is covered. Check before switching anything on.
Choosing HIPAA Compliant AI Tools
No tool is HIPAA compliant on its own. Compliance depends on how the practice uses it. Still, some tools make compliance far easier. HIPAA compliant AI tools generally share a few traits:
- The vendor will sign a BAA that covers the AI features
- Customer data is not used to train the vendor's models
- Data is encrypted in transit and at rest
- Access controls and audit logs let the practice see who used the tool and when
- The practice can delete data when it's no longer needed
Once a tool is approved, put it in writing. Staff can't follow AI HIPAA compliance rules they've never seen. An AI acceptable use policy should name approved tools, ban patient data from everything else and explain who reviews AI-generated notes before they go into the chart. AI tools still make mistakes, and a wrong medication in a visit summary isn't a small problem.
Preparing for Stricter HIPAA Security Requirements
HIPAA itself is changing. In January 2025, HHS proposed the first major update to the Security Rule in more than a decade. The proposal includes specific requirements for encryption, multifactor authentication, network segmentation and annual penetration testing. According to Fierce Healthcare, the final rule is now expected in July 2027.
The details may still change before then. But the direction seems clear. Regulators expect practices to know what systems handle patient data and to protect each one. AI tools belong on that list. A practice that works on AI HIPAA compliance now will probably have a much easier time when the new rule arrives.
Getting Help With AI HIPAA Compliance
Most medical practices don't have a full-time IT security staff to vet AI vendors, review BAAs and configure tools correctly. That's normal for a small or mid-size office, and it's one reason AI HIPAA compliance falls through the cracks.
AGJ Systems helps medical practices across the Gulf Coast review how AI tools fit into their IT compliance program. A free 15-minute discovery consultation is a simple way to find out where the practice stands.
Frequently Asked Questions
Does HIPAA apply to AI tools?
Yes. HIPAA applies to any tool that creates, receives, stores or transmits electronic protected health information. If an AI tool handles patient data, the practice must protect that data under the HIPAA Security Rule and have a business associate agreement with the vendor.
Is ChatGPT HIPAA compliant?
The free consumer version of ChatGPT is not suitable for patient information because it does not come with a business associate agreement. Some AI vendors offer business or enterprise plans with a BAA, which may be usable for certain tasks once properly configured.
What is a business associate agreement for AI?
A business associate agreement for AI is a contract in which an AI vendor agrees to protect patient data and follow HIPAA rules. Practices need one before sharing any electronic protected health information with an AI tool.
Are AI scribes HIPAA compliant?
AI scribes can be used in a HIPAA compliant way if the vendor signs a business associate agreement, protects recordings and transcripts, and does not use patient data to train its models. Practices should also decide how they will inform patients about the tool.
What makes an AI tool HIPAA compliant?
No tool is compliant on its own. HIPAA compliant AI tools typically offer a business associate agreement, encryption, access controls, audit logs and a commitment not to train on customer data. The practice must still configure and use the tool correctly.
