HIPAA compliant AI means AI used in a way that follows the HIPAA rules, not a label a product can carry. HIPAA doesn't ban AI. If your business is covered by HIPAA, any vendor that creates, receives, keeps or sends patient health information for you needs a business associate agreement (BAA) first. Where it stops: a BAA covers only the services the vendor lists, so the add-ons and connections between your programs are where the gaps open.
What HIPAA compliant AI means
HIPAA's rules apply to covered entities and their business associates. HHS says a business associate is a person or company that does work for a covered entity that involves creating, receiving, keeping or sending protected health information, or PHI. Billing, data analysis and practice management are among its examples. An AI service that reads patient emails or visit notes for you fits that description.
So the question for any AI product is not whether it calls itself HIPAA compliant. Microsoft says on its own HIPAA page that no certification approved by HHS exists to prove a business associate complies with HIPAA. The questions are whether the vendor will sign a BAA, which of its services the BAA covers, and whether you use only those services for patient information.
Does HIPAA apply to your business?
Not all health and wellness businesses are covered. HHS lists covered health care providers such as doctors, clinics, psychologists, dentists, chiropractors, nursing homes and pharmacies, but only if they send health information electronically as part of a transaction HHS has set a standard for, such as billing a health plan. Health plans and health care clearinghouses are covered too.
HHS also says that a business that is neither a covered entity nor a business associate does not have to follow the HIPAA Rules. A studio, spa or supplement shop that never bills a health plan may fall outside them. If you aren't sure, HHS has a question and answer tool to check, and this is a question for your lawyer, not for a software vendor.
Ways to use AI with patient information
AI inside software you already have, under its BAA
- How it works
- Some vendors you may already pay offer a BAA. Google says customers subject to HIPAA must accept its BAA, from the Admin console, before putting PHI in Google Workspace, and lists which services it covers, including some Gemini features in Gmail. Microsoft makes its BAA available by default through its data protection terms and lists services in scope, including Microsoft Copilot and Teams. HubSpot's Sensitive Data Terms include a BAA that applies only to the features HubSpot lists as covered.
- Good for
- Practices already on Google Workspace, Microsoft 365 or HubSpot that want AI features inside those programs.
- Where it breaks
- Each BAA covers only that vendor's listed services. Google says third-party add-ons are not covered, and HubSpot says data in connected third-party products follows those products' own policies.
Take the identifiers out first
- How it works
- HHS allows two ways to de-identify health information: an expert's determination, or the Safe Harbor method, which removes 18 kinds of identifiers. Information de-identified this way is no longer protected by the Privacy Rule.
- Good for
- Reports and analysis that don't need to know who the patient is.
- Where it breaks
- The list is long. It includes all parts of dates except the year, email addresses, phone numbers, account numbers and full-face photos. Miss one and the data is PHI again.
Keep AI on work without patient information
- How it works
- Many back-office jobs never touch PHI: staff schedules and payroll, supplier orders and stock, marketing, and the week's sales numbers.
- Good for
- Getting hours back now, while the patient-facing questions get sorted out.
- Where it breaks
- Jobs drift. A payroll report that starts listing client names, or an inbox agent that reads patient emails, needs a fresh look.
Arkeo agents for the operations work
- How it works
- We go through your jobs with you and set up agents in your own accounts for the operations around care: payroll from visit data, stock and reorders, the weekly numbers. Each agent does one job from start to finish and checks its own work.
- Good for
- Health and wellness owners whose team spends hours each week on admin between programs.
- Where it breaks
- Agents stay on the operations side of the business: payroll, scheduling, stock and the weekly numbers. They don't handle patient records or clinical notes, and anything your rules keep for a person goes to your team in one message.
HIPAA compliant AI options side by side
| Vendor's AI under its BAA | De-identify first | Keep PHI out | |
|---|---|---|---|
| Patient information | Yes, in covered services only | Only after identifiers are removed | No |
| What you have to check | Which services the BAA lists | All 18 kinds of identifiers | That the job stays free of PHI |
| Works across programs | Only within that vendor | Yes, once data is de-identified | Yes |
| Good first use | Drafting and notes inside one program | Reports and trends | Payroll, stock, the week's numbers |
Where a BAA stops: what is still done by hand
A BAA covers one vendor's listed services, and a small practice runs on many programs. HHS says a business associate must also have a BAA with any subcontractor before passing PHI on, and that cloud vendors are business associates even when they store only encrypted data they can't read. So each connection between programs that carries patient information is one more agreement to check. Google's BAA leaves out third-party add-ons. HubSpot's applies only to its listed covered features.
A BAA also doesn't finish the job. Microsoft says having its BAA does not on its own make an organization HIPAA compliant; you still need your own compliance program and internal processes. HHS's cloud guidance says you should understand each vendor's setup well enough to do your own risk analysis.
Here is where the hours go in a 20-person practice. The booking system, the email, the billing program and the CRM each hold part of the patient's story, and the safe connections between them are few. So staff copy details from one screen to the next by hand, or paste them into whatever AI tool is open, BAA or not. That gap between programs is the work in the middle, and it is where most of the risk sits too.
How to use AI with patient information, step by step
Do these in order. The first answer decides how much of the rest applies to you.
- 1
Check whether HIPAA applies to you
Use HHS's covered entity pages and decision tool, and confirm with your lawyer.
- 2
List where patient information lives
Write down each program that holds PHI: booking, email, billing, notes, forms, the CRM, and any spreadsheet.
- 3
Accept the BAA in the programs you already use
In Google Workspace, an administrator reviews and accepts the BAA in the Admin console before any PHI goes in.
- 4
Check which services each BAA covers
Read each vendor's list of covered services, and keep PHI out of anything not on it, including add-ons.
- 5
Check each connector between programs
Any app that moves PHI between two programs is a business associate too, and needs its own BAA.
- 6
De-identify what goes anywhere else
For reports and AI work outside a BAA, remove all 18 kinds of identifiers first.
Agents for the operations work around care
These handle payroll, stock and the week's numbers for health and wellness businesses.
A day of counting hours becomes minutes of checking.
- Pulls each visit for the period and brancheach pay period
- Applies overtime, weekend and stat pay ruleseach employee
- Writes the payroll sheet ready to checkin minutes
Your counts match before they cost you a sale.
- Compares Cin7, your store and the warehouseevery day
- Finds why counts don't matchper mismatch
- Tells your ops lead with the fixright away
The Monday meeting starts from the same page.
- Pulls your numbers from five toolsMondays at 7 a.m.
- Calls out anything that moved past your set percentageeach week
- Posts a one-page summary to Slackevery Monday
Questions
Is my customers' information safe?
Yes. Agents work in your own accounts and see only what each job needs. Customer details never go into public AI. Agents connect to AI through business-grade connections audited under SOC 2.
Does HIPAA allow AI?
Yes. HIPAA doesn't ban AI. If you are covered, any vendor that handles patient health information for you needs a BAA, and you use only the services that BAA covers.
What is a business associate agreement?
It is a contract between a covered entity and a vendor that handles PHI for it. HHS says it must set out how the vendor may use and share the PHI and require the vendor to protect it.
Is a vendor with a BAA HIPAA compliant?
Not by itself. Microsoft, for one, says its BAA supports your compliance but doesn't achieve it. Your own policies and how you use the service still count.
What does it cost?
You get the price on the call, along with the hours it saves your team.