HIPAA-Compliant AI Tools for Healthcare Businesses: What Qualifies

Healthcare businesses face a specific challenge with AI adoption: most popular AI tools are not HIPAA-compliant out of the box, and using them with patient data without a Business Associate Agreement (BAA) in place is a HIPAA violation. Understanding which AI tools qualify for healthcare use, what compliance actually requires, and how to build an AI-assisted workflow that does not expose your practice to regulatory risk is essential before adopting any AI tool that touches patient information.

What HIPAA Compliance Means for AI Tools

HIPAA compliance for an AI tool vendor requires three things: the vendor must sign a Business Associate Agreement (BAA) with your practice, the vendor’s infrastructure must meet HIPAA’s technical safeguards (encryption at rest and in transit, access controls, audit logs), and the vendor must agree to handle Protected Health Information (PHI) only for the purposes specified in the BAA.

A BAA is a legal contract — the vendor is agreeing to be legally responsible for protecting the PHI they handle. If a vendor does not offer BAAs, you cannot legally use their tool with PHI. Full stop. Many popular AI tools — including the free and consumer tiers of ChatGPT and Claude — do not offer BAAs, which means they cannot be used with patient names, dates of service, medical record numbers, diagnosis codes, or any other PHI.

AI Tools That Offer HIPAA BAAs

Microsoft Azure OpenAI Service. Microsoft’s enterprise version of OpenAI’s models, accessible via Azure, includes HIPAA BAA coverage as part of Microsoft’s broader healthcare compliance program. For healthcare organisations already in the Microsoft ecosystem, this is often the most practical path to compliant AI.

AWS (Amazon Web Services). AWS’s AI services — including Amazon Bedrock, which provides access to multiple AI models including Claude — are covered under AWS’s HIPAA BAA. Healthcare organisations building on AWS infrastructure can use Bedrock for PHI-involving workflows with appropriate BAA in place.

Google Cloud Healthcare AI. Google Cloud’s healthcare-specific AI services, including Medical AI tools built on Gemini, are covered under Google Cloud’s BAA for healthcare customers.

Microsoft 365 Copilot for Healthcare. Microsoft’s enterprise Copilot, when deployed in a HIPAA-covered Microsoft 365 environment, can handle PHI with the appropriate BAA.

Healthcare-Specific AI Tools With Built-In Compliance

Several AI tools are built specifically for healthcare with HIPAA compliance as a core feature. Nabla, Nuance DAX, and Suki are AI medical scribe tools that transcribe and structure clinical notes — all with BAAs available and healthcare-grade security infrastructure. Consensus and Elicit provide AI-powered medical literature search with appropriate data handling. These purpose-built tools are often simpler to deploy in a compliant way than configuring a general-purpose AI tool for healthcare use.

Safe AI Use Without PHI

Many valuable AI use cases in healthcare do not involve PHI at all and can be handled with any AI tool. Writing patient education materials (no specific patient data), drafting administrative communications, summarising medical literature, creating training materials, optimising appointment scheduling policies, and researching billing and coding questions — none of these require PHI, and all can be handled with standard AI tools without HIPAA risk. Separating your AI use cases into PHI-involving and non-PHI is the first step in a compliant AI adoption strategy.

Building a HIPAA-Compliant AI Workflow

The practical workflow for a HIPAA-covered entity using AI is: use de-identified data for most AI tasks, use a BAA-covered tool for the minority of tasks that genuinely require PHI, and maintain clear documentation of which workflows fall into which category. The de-identification step is more work upfront but dramatically simplifies the compliance picture — a de-identified patient record that the AI assists with is not subject to HIPAA’s AI-specific requirements regardless of which tool handles it.

Document your de-identification methodology. HIPAA Safe Harbor de-identification has 18 specific identifier categories that must be removed; Expert Determination allows statistical methods to achieve sufficient de-identification without the full Safe Harbor process. Whichever approach your organisation uses, document it, apply it consistently, and train the staff who perform it. The documentation is what demonstrates compliance in the event of an audit or investigation — the absence of a documented process is itself a finding even when the practice is adequate.

Vendor Assessment for Healthcare AI

Before deploying any AI tool for healthcare workflows, conduct a vendor assessment that covers: the existence and availability of a BAA; where data is stored and processed (US-based versus overseas); whether the vendor uses customer data for model training (and whether the BAA or DPA addresses this); what security certifications the vendor holds (SOC 2 Type II is the baseline); and what their breach notification process is. Most major AI providers publish this information in their trust documentation; for tools that do not, treat the absence of published security documentation as a disqualifying factor for PHI processing.

Smaller healthcare AI tools — clinical documentation assistants, patient communication platforms, diagnostic support tools — may have strong HIPAA compliance programmes or very weak ones, and the marketing is not a reliable guide. Request and review the BAA before committing to any tool that will process PHI. A vendor that is reluctant to provide a BAA or that provides one with unusual carve-outs for data use is a vendor to avoid for PHI workflows regardless of how compelling their clinical features are.

HIPAA compliance for AI is not fundamentally different from HIPAA compliance for any other software system — it requires understanding what data flows where, ensuring appropriate agreements govern sensitive data processing, training staff on requirements, and maintaining documentation that demonstrates your compliance practices. The AI-specific elements are the need to evaluate whether free-tier tools meet BAA requirements (they typically do not) and the importance of understanding whether model training on your data is permissible under your patient consent forms and BAA terms.

Business Associate Agreements for AI Vendors

A Business Associate Agreement (BAA) is a HIPAA-required contract between a covered entity and any vendor that handles Protected Health Information (PHI) on its behalf. Before using any AI tool with PHI, confirm that the vendor offers a BAA for healthcare customers and sign it. Most major enterprise AI vendors (Microsoft Azure OpenAI, AWS healthcare services, Google Healthcare API) offer BAAs for their healthcare tiers. Consumer-facing AI tools — standard ChatGPT, Claude.ai, standard Gemini — typically do not offer BAAs and are therefore not appropriate for workflows involving PHI regardless of encryption or anonymisation claims. The BAA is not a formality — it establishes the vendor’s obligations under HIPAA and your legal basis for sharing PHI with them.

Auditing Existing Workflows for HIPAA Compliance

The discipline required to implement this well — clear requirements, empirical testing, and consistent operational maintenance — is the same discipline that produces reliable AI deployments generally. Teams that apply it to this specific capability build the habits and institutional knowledge that make every subsequent AI deployment faster, more reliable, and more confidently managed. The investment is in the practice as much as the specific capability.

Training Documentation for HIPAA AI Compliance

HIPAA requires covered entities and business associates to train workforce members on privacy and security policies. For organisations using AI tools with PHI, training documentation should specifically cover: which AI tools are approved for PHI processing and which are not; the data minimisation principle as applied to AI inputs (share only the minimum PHI necessary for the specific clinical or administrative task); how to report a suspected AI-related HIPAA incident; and the consequences of using unapproved AI tools with PHI. Training records are themselves a HIPAA requirement — document who received AI-specific HIPAA training, when, and what the training covered. In an audit or breach investigation, documented training evidence demonstrates that the organisation took its compliance obligations seriously and that any violation was not the result of inadequate staff preparation.

Auditing Existing Healthcare AI Deployments

HIPAA compliance for AI tools is an area where the cost of getting it wrong is high and the effort of getting it right is modest. A BAA, an appropriate API tier, access controls, and staff training cover the core requirements. The investment is a few hours of setup and an annual review — far less than the cost of a HIPAA breach investigation, let alone a penalty. For healthcare organisations that have been avoiding AI because of compliance concerns, these clear, manageable requirements should make AI adoption more accessible rather than less.