Answers
HIPAA and AI: what does compliance require?
HIPAA compliance for an AI system requires a signed business associate agreement with any vendor that touches protected health information, plus administrative, physical, and technical safeguards around that data. AI does not remove these obligations. A covered entity remains responsible for how a vendor handles patient records.
01What does HIPAA require when AI touches protected health information?
HIPAA requires a signed business associate agreement with any AI vendor that creates, receives, stores, or transmits protected health information on behalf of a covered entity. The agreement must define permitted uses, security obligations, and breach notification duties for that vendor.
Beyond the agreement, HIPAA's Security Rule requires administrative, physical, and technical safeguards, including access controls, audit logging, and encryption, applied consistently whether the system involved uses AI or not.
02Who counts as a business associate under HIPAA when AI is involved?
A business associate under HIPAA is any vendor or contractor that handles protected health information on behalf of a covered entity, and this definition applies to an AI vendor exactly as the definition applies to any other technology provider. Using an AI tool does not create an exception.
A covered entity that shares patient records with an AI vendor without a signed business associate agreement in place is out of compliance regardless of how the vendor markets its technology.
03Can protected health information be used to train an AI model?
Protected health information can be used to train an AI model only under terms permitted by HIPAA and the applicable business associate agreement, typically limited to the purposes the covered entity has authorized. Using patient data to train a vendor's general purpose model without that authorization is not compliant.
De-identification under HIPAA's Safe Harbor or Expert Determination methods removes data from HIPAA's scope entirely, which is why some AI vendors request de-identified data specifically to simplify compliance.
04What safeguards should a healthcare company confirm before deploying an AI tool?
A healthcare company should confirm encryption in transit and at rest, role based access control, audit logging, a defined breach notification process, and a signed business associate agreement before deploying an AI tool that touches patient data. Each safeguard maps directly to a HIPAA Security Rule requirement.
A company should also confirm where the vendor stores data physically and whether any subcontractor of the vendor also needs a separate business associate agreement.
05Does Lingows AI provide HIPAA compliant services?
Lingows AI works with healthcare clients to structure a project around HIPAA requirements, including signing a business associate agreement and scoping data handling terms before any protected health information is shared. Lingows AI does not hold a HIPAA certification, since HIPAA has no certifying body and no vendor can claim official HIPAA certification.
A healthcare company evaluating Lingows AI for a project involving patient data should raise its specific compliance requirements during the initial consultation so the agreement reflects those requirements directly.
06Specification
| Field | Detail |
|---|---|
| Typical cost | Compliance scoping is typically included within project discovery, not billed separately |
| Typical timeline | A business associate agreement and safeguard review is usually completed before build work starts |
| Prerequisites | Identification of any protected health information involved in the workflow |
| Common failure modes | No business associate agreement, unauthorized model training on patient data, missing audit logs |
| Who it suits | Healthcare providers, payers, and any vendor handling protected health information |
07HIPAA requirement versus AI relevant safeguard
| HIPAA requirement | Applies to AI vendors | Example safeguard |
|---|---|---|
| Business associate agreement | Yes, if the vendor touches protected health information | Signed agreement before data sharing begins |
| Security Rule technical safeguards | Yes | Encryption, access control, audit logging |
| Minimum necessary standard | Yes | Sharing only the fields a workflow needs |
| Breach notification | Yes | Defined notification timeline in the vendor contract |
08Steps to keep an AI project HIPAA compliant
- Step 01
Identify protected health information in scope
Confirm which data fields count as protected health information before starting.
- Step 02
Sign a business associate agreement
Put the vendor's obligations in writing before any data is shared.
- Step 03
Confirm technical safeguards
Verify encryption, access control, and audit logging are in place.
- Step 04
Document the minimum necessary scope
Limit data shared with the AI system to what the workflow requires.
FAQQuestions
Related questions
Is there an official HIPAA certification for AI vendors?
No. HIPAA has no official certifying body, so no vendor, including Lingows AI, can accurately claim to be HIPAA certified. Compliance is demonstrated through documented safeguards and signed agreements, not a certificate.
Does using a HIPAA compliant AI vendor remove liability from the covered entity?
No. A covered entity remains responsible for its own compliance and for verifying that any business associate, including an AI vendor, meets its contractual and regulatory obligations.
Can de-identified patient data be used freely with an AI vendor?
Data that meets HIPAA's Safe Harbor or Expert Determination de-identification standard falls outside HIPAA's scope and can generally be used more freely, though other privacy laws may still apply.
What happens if an AI vendor has a data breach involving patient records?
The business associate agreement should define the vendor's breach notification timeline, and the covered entity remains responsible for notifying patients and regulators according to HIPAA's breach notification rule.
NEXTWhere to go next
Security and data handling is the Lingows AI page that covers this work in delivery detail, including scope, timeline, and how the build is run.
Last reviewed 2026-08-16