Resources AI, privacy and compliance
What HIPAA requires before a US clinic lets an AI scribe or any AI tool touch protected health information: the BAA, the Security Rule, training and breaches.
Mahmoud ElHewaheyFounder, PulseAI Solutions28 October 2026 · 4 min read
The short version
The Health Insurance Portability and Accountability Act (often misspelled HIPPA) sets the US rules for protected health information. The Privacy Rule governs how it may be used and disclosed, the Security Rule sets safeguards for electronic health information, and the Breach Notification Rule sets what happens when it is exposed. A clinic is a covered entity. Any vendor that handles protected health information on its behalf is a business associate.
An AI scribe records and processes a clinical conversation. An intake assistant collects health history. A document tool reads faxed referrals. A phone assistant hears symptoms. Each of them creates, receives, maintains or transmits protected health information for the clinic, which makes the vendor a business associate. HHS has applied the same logic to cloud services: a provider storing protected health information is a business associate even when the data is encrypted and it holds no key.
The first rule
No protected health information reaches an AI vendor until a business associate agreement is signed. That includes free trials and pilots.
HIPAA sets the required contents of a BAA. For an AI vendor, read these clauses closely.
BAA clauses that matter most for AI tools
| Clause | What to look for |
|---|---|
| Permitted uses | Use of the information only to provide services to the clinic, and as the law requires. |
| Training and secondary use | An explicit statement on model training and product improvement. The safest answer is that the information is never used for either. |
| Safeguards | Compliance with the Security Rule for electronic protected health information. |
| Subcontractors | Every subprocessor bound by the same terms, through its own agreement. |
| Breach reporting | Notice to the clinic without unreasonable delay, and no later than 60 days after discovery, with the details the clinic needs. |
| Access and amendment | Support for patients' rights to access and amend their information. |
| Return or destruction | Return or destruction of all protected health information when the contract ends. |
The Security Rule asks for a risk analysis and for safeguards in three groups.
In January 2025, HHS proposed updating the Security Rule to make encryption and multi-factor authentication explicit requirements. Whatever the final rule says, a clinic should already expect both from any AI vendor: information encrypted in transit and at rest, and two-step verification for everyone who signs in.
The Privacy Rule's minimum necessary standard applies to most uses and disclosures: an AI tool should receive only what its task requires. De-identified information falls outside HIPAA, but only when it meets HHS's Safe Harbor or Expert Determination standard. Voice recordings and rich clinical narratives are hard to de-identify reliably, so treat any vendor claim of de-identified training data with care.
HHS does not certify products or vendors. "HIPAA certified" usually means a vendor commissioned its own assessment. What a clinic can verify is the signed BAA, the vendor's security documentation, independent audits of its infrastructure such as SOC 2 Type II, and the answers to the questions below.
A clinic group operating on both sides of the border has two regimes to satisfy. The cleanest design keeps each country's information in its own environment, under its own agreement. Our guide to AI scribes and Canadian privacy law covers the Canadian side.
No. HHS does not certify products. Look for a signed business associate agreement, documented safeguards that meet the Security Rule, and independent audits such as SOC 2 Type II for the vendor's infrastructure.
Yes. A vendor that creates, receives, maintains or transmits protected health information on a covered entity's behalf is a business associate, and HIPAA requires a business associate agreement before information is shared.
Only within what the BAA permits and the Privacy Rule allows. Many clinics refuse any training use in the agreement, which is the simplest and safest position.
Yes. HIPPA is a common misspelling of HIPAA, the Health Insurance Portability and Accountability Act.
Without unreasonable delay and no later than 60 calendar days after discovering it, under the Breach Notification Rule. Many agreements set a shorter period.
This guide is general information about the law as published, written for clinic owners and their teams. It is not legal advice. Your privacy officer or counsel should confirm how it applies to your clinic.
Sources
See it running
Clinic Conductor signs a BAA with every US clinic before any data is shared, and runs US clinics in a fully separate US setup.
AI, privacy and compliance
What Canadian privacy law and the 2026 regulator guidance require of a clinic using an AI scribe: consent, assessments, vendor terms, recordings and training.
Read the guideAI, privacy and compliance
An AI scribe drafts the visit note. Most of a clinic's administration happens before and after the visit. Here is where each tool fits, and how they work together.
Read the guideInside Clinic Conductor
How an AI phone system answers routine clinic calls in a natural voice, routes anything clinical to the team, and the privacy questions to ask first.
Read the guide
