Is an ambient AI scribe a HIPAA business associate, and what does the 2025 Security Rule NPRM change?
An ambient AI scribe vendor that creates, receives, maintains, or transmits ePHI on a covered entity's behalf is generally a business associate and needs a BAA. HHS's 2025 Security Rule NPRM proposes to modernize and strengthen safeguards — moving toward more…
Answer.
An ambient AI scribe vendor that creates, receives, maintains, or transmits ePHI on a covered entity's behalf is generally a business associate and needs a BAA. HHS's 2025 Security Rule NPRM proposes to modernize and strengthen safeguards — moving toward more mandatory technical controls — but it is a proposed rule, not yet final, so treat its specifics as not-yet-binding. Planisphere does not establish your BAA or HIPAA posture; it can measure AI behaviour without ingesting PHI where designed to.
The mark behind the answer.
ePHI safeguards · 2025 NPRM cyber-modernization (PROPOSED).
More on HIPAA Security Rule.
Try HIPAA Security Rule with a free test key.
Start with the free sandbox. Planisphere measures model behaviour and emits a reproducible, sha-pinned record — it does not certify, file, or give legal advice.