United States (federal) · regulation
HIPAA Security Rule: what it requires, and the records to keep
The Security Rule requires administrative, physical and technical safeguards for ePHI, built on a documented risk analysis. A January 2025 proposed overhaul would make most safeguards mandatory and expects AI software that touches ePHI to appear in a required technology asset inventory, but HHS now lists it as a long-term action with final action estimated for July 2027.
01 / What it requires
What HIPAA Security Rule requires
Covered entities and business associates that create, receive, maintain or transmit electronic protected health information (ePHI), including AI vendors acting as business associates.
- 01Conduct and update an accurate risk analysis covering ePHI in AI systems, including training data.
- 02Implement risk management measures, access controls, audit controls, integrity and transmission security safeguards.
- 03Obtain business associate contracts requiring AI vendors to safeguard ePHI and report incidents.
- 04Repeat risk analysis when adopting or changing technology such as new AI tools.
- 05Proposed (not in force): keep a written technology asset inventory and network map that lists AI software handling ePHI.
- 06Proposed (not in force): require encryption, multi-factor authentication and annual compliance audits, removing 'addressable' flexibility.
02 / AI work
Where it touches AI work
HHS's proposed rule states that ePHI in AI training data, prediction models and algorithm data is protected, and that regulated entities must weigh AI-specific risks in their risk analysis. Under the current rule, AI tools are covered as any system holding ePHI.
03 / Dates
The dates that matter
Security Rule final rule published
Compliance date for most covered entities
Proposed Security Rule overhaul published (90 FR 898)
Comment period on proposed rule closed
Estimated final action per Unified Agenda (long-term action)
04 / Enforcement
Who enforces it
HHS Office for Civil Rights. Civil penalties adjusted for inflation range from $145 to $2,190,294 per violation, with an annual cap of $2,190,294 per identical provision; state attorneys general may also sue.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01Current risk analysis that names AI systems and their ePHI
- 02Risk management plan with dated remediation actions
- 03Technology asset inventory including AI software
- 04Business associate contracts and vendor security reviews
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
Is an ambient AI scribe a HIPAA business associate, and what does the 2025 Security Rule NPRM change?+
Usually yes: a scribe vendor that creates, receives, maintains or transmits PHI for a covered entity is a business associate and needs a business associate agreement before handling patient data. The January 6, 2025 proposed Security Rule would require a written technology asset inventory and network map, make encryption and multi-factor authentication mandatory with limited exceptions, remove the 'addressable' category and add compliance audits; HHS also said ePHI in AI training data and models is protected. It is only a proposal: HHS's regulatory agenda lists it as a long-term action with final action estimated for July 2027. Read the full answer
Does the proposed HIPAA Security Rule require encryption and MFA for AI systems?+
It would, but it is not in force. The January 6, 2025 proposed rule would require encryption of all ePHI at rest and in transit, with limited exceptions, and multi-factor authentication, and would end the distinction between required and addressable safeguards, so these controls would reach any AI system that holds or transmits ePHI. It would also add network segmentation and a technology asset inventory. No final rule had been published as of October 2026, and HHS estimates final action in July 2027. Under the current rule, encryption is still an addressable specification. Read the full answer
SOURCES
Go back to the source
Office of Information and Regulatory Affairs (reginfo.gov)
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: HIPAA Security Rule for medicine AI workflows · NIST AI RMF · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4