Using AI With Patient Data: BAA and Safeguards Playbook

Introduction

Healthcare organizations are deploying AI faster than compliance frameworks can adapt. Clinical decision support, patient communication bots, automated coding, and document summarization—all processing data that may contain Protected Health Information (PHI).

Existing HIPAA rules already apply to AI vendors that handle PHI, whether or not dedicated guidance on AI is published, and enforcement does not wait.

If your AI vendor does not have a Business Associate Agreement (BAA) and your system sends PHI to their models, you have a compliance gap today—not when any new guidance drops.

Section 1: When AI Processing Creates a BAA Obligation

A BAA is required when a vendor creates, receives, maintains, or transmits PHI on your behalf. For AI systems:

Scenario	BAA required?	Why
Sending patient notes to an LLM for summarization	Yes	PHI transmitted to vendor
Using an AI API with PHI in prompts	Yes	Vendor processes PHI
Storing embeddings of PHI-containing documents	Yes	Vendor maintains PHI-derived data
Using AI on de-identified data only	No	No PHI involved
Running open-source models on-premise	No*	No third-party BA (*you are the covered entity)
AI vendor accesses PHI for model training	Yes	PHI used beyond your authorized purpose

The most common gap: teams use general-purpose AI APIs (without BAAs) for tasks that inadvertently include PHI in prompts.

Section 2: The BAA Checklist for AI Vendors

Before sending PHI to any AI vendor, verify:

Signed BAA covering AI/ML services specifically (not just general cloud services),
Data processing terms: PHI used only for your authorized purpose, not model training,
Subprocessor disclosure: who else touches your PHI (cloud providers, model hosts),
Data retention limits: how long PHI is stored, deletion procedures,
Breach notification: timelines and procedures if PHI is compromised,
Audit rights: ability to verify compliance with BAA terms,
Data residency: where PHI is processed and stored (US requirements for most covered entities).

Vendors with healthcare BAAs

Several major providers offer BAAs for some of their AI services. Coverage depends on the specific product and configuration, so confirm in writing that the exact service you plan to use is covered. Providers that have offered BAAs include:

AWS Bedrock (via AWS BAA),
Google Cloud Vertex AI (via Google Cloud BAA),
Azure OpenAI Service (via Microsoft BAA),
Anthropic (enterprise/API with BAA),
OpenAI (enterprise/API with BAA for eligible use cases).

Always verify current BAA terms directly—this list changes.

Section 3: Engineering Controls for AI + PHI

A BAA is necessary but not sufficient. Engineering must enforce PHI boundaries:

PHI detection and routing

Scan prompts for PHI before sending to external models (NER, regex, or classification),
Route PHI-containing requests to BAA-covered endpoints only,
Block PHI from reaching non-BAA APIs entirely.

Minimum necessary

Send only the PHI required for the specific AI task—not full patient records,
De-identify where possible before AI processing (remove names, dates, identifiers),
Use retrieval with access controls so the AI only sees PHI the requesting user is authorized to access.

Logging without PHI exposure

Metadata-first logging: request IDs, token counts, latency, model version—not prompt/response content,
Hash or tokenize identifiers in logs,
Separate audit trail for PHI access events (who accessed what, when).

Human-in-the-loop

Require human review before AI-generated content enters the clinical record,
Flag AI outputs as machine-generated in the medical record,
Escalation paths when AI confidence is low or PHI sensitivity is high.

Section 4: Preparing for OCR Guidance

While waiting for any formal guidance, align with the direction of travel:

Inventory all AI systems that may process PHI,
Secure BAAs for every vendor in the inventory,
Implement PHI routing controls (technical, not just policy),
Document your AI risk assessment (which systems, what PHI, what controls),
Establish an AI governance committee (clinical + engineering + compliance),
Create an AI incident response runbook (model hallucination affecting patient care, PHI leak via prompt, unauthorized AI access).

When new guidance does publish, teams with this foundation should adapt faster.

Section 5: The Cost of Non-Compliance

HIPAA civil penalties are tiered by culpability, adjusted for inflation each year, and can reach tens of thousands of dollars per violation with annual caps in the low millions. Check HHS's current penalty table for exact figures.

Areas where AI systems could draw regulator attention include:

AI systems processing PHI without BAAs,
Insufficient audit trails for AI-assisted clinical decisions,
PHI in AI training data without authorization.

The engineering cost of compliance (PHI routing, BAA-covered endpoints, metadata logging) is a fraction of the penalty exposure.

Conclusion

Do not wait for new guidance to act. If your HealthTech platform uses AI with PHI, you need BAAs today, PHI routing controls this month, and an AI governance framework this quarter.