Planisphere Download for Mac

Medicine · HIPAA Security Rule

HIPAA Security Rule for clinical AI workflows

HIPAA Security Rule in clinical AI workflows: what compliance requires, who asks for evidence, and the records to keep.

Legal forceBinding law; the 2025 update is a proposed rule, not in force
Applies from20 Apr 2005
SectorMedicine
Checked21 Oct 2026

01 / The rule

What HIPAA Security Rule requires

Covered entities and business associates that create, receive, maintain or transmit electronic protected health information (ePHI), including AI vendors acting as business associates.

  1. 01Conduct and update an accurate risk analysis covering ePHI in AI systems, including training data.
  2. 02Implement risk management measures, access controls, audit controls, integrity and transmission security safeguards.
  3. 03Obtain business associate contracts requiring AI vendors to safeguard ePHI and report incidents.
  4. 04Repeat risk analysis when adopting or changing technology such as new AI tools.
  5. 05Proposed (not in force): keep a written technology asset inventory and network map that lists AI software handling ePHI.
  6. 06Proposed (not in force): require encryption, multi-factor authentication and annual compliance audits, removing 'addressable' flexibility.

02 / In this sector

In a clinical AI workflow

HHS's proposed rule states that ePHI in AI training data, prediction models and algorithm data is protected, and that regulated entities must weigh AI-specific risks in their risk analysis. Under the current rule, AI tools are covered as any system holding ePHI.

Usually asked by

Clinical committees and health system AI governance.

Named alongside

HHS §1557 · HIPAA · FDA PCCP.

Sector pagePlanisphere for medicine

03 / Records

Records to keep

  1. 01Current risk analysis that names AI systems and their ePHI
  2. 02Risk management plan with dated remediation actions
  3. 03Technology asset inventory including AI software
  4. 04Business associate contracts and vendor security reviews

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES

Go back to the source

PRIMARY
Unified Agenda entry RIN 0945-AA22

Office of Information and Regulatory Affairs (reginfo.gov)

RELATED

Related: HIPAA Security Rule: the full guide · HIPAA Security Rule for defense · HIPAA Security Rule for law · HIPAA Security Rule for education