HIPAA Compliance for AI Systems#

Common Mistakes#

1. Deploying clinical AI without confirming BAA coverage. Organizations deploy clinical AI features that include PHI in LLM prompts without confirming that the LLM provider has signed a BAA. This is a HIPAA violation at deployment.

2. Not applying the minimum necessary standard to AI context. The AI system retrieves the full patient record for context when only the active medications and allergies are needed for the specific clinical use case. The excess PHI expands the breach surface unnecessarily.

3. Logging AI request/response bodies for PHI-handling systems. AI platform teams enable full request logging for debugging. If the request body contains PHI (as it does for clinical AI), the logging system becomes an uncontrolled PHI store.

Key Takeaways#

• Confirm BAA coverage with every AI vendor before sending PHI through their API
• Apply the minimum necessary standard to AI context retrieval: include only the PHI fields required for the specific clinical use case
• HIPAA audit logging must record patientid and userid for every AI access to PHI — but must never log PHI content in log bodies
• Self-hosted inference eliminates the BAA question but requires the organization to implement all HIPAA Security Rule controls on the inference infrastructure
• Prompt injection in a PHI-handling AI system is a potential HIPAA breach — incorporate AI-specific breach scenarios into the incident response plan