Question · HIPAA Security Rule
Is an ambient AI scribe a HIPAA business associate, and what does the 2025 Security Rule NPRM change?
The Security Rule requires administrative, physical and technical safeguards for ePHI, built on a documented risk analysis.
01 / The answer
The short answer
Usually yes: a scribe vendor that creates, receives, maintains or transmits PHI for a covered entity is a business associate and needs a business associate agreement before handling patient data. The January 6, 2025 proposed Security Rule would require a written technology asset inventory and network map, make encryption and multi-factor authentication mandatory with limited exceptions, remove the 'addressable' category and add compliance audits; HHS also said ePHI in AI training data and models is protected. It is only a proposal: HHS's regulatory agenda lists it as a long-term action with final action estimated for July 2027.
02 / The rule
What HIPAA Security Rule requires
The Security Rule requires administrative, physical and technical safeguards for ePHI, built on a documented risk analysis. A January 2025 proposed overhaul would make most safeguards mandatory and expects AI software that touches ePHI to appear in a required technology asset inventory, but HHS now lists it as a long-term action with final action estimated for July 2027.
- 01Conduct and update an accurate risk analysis covering ePHI in AI systems, including training data.
- 02Implement risk management measures, access controls, audit controls, integrity and transmission security safeguards.
- 03Obtain business associate contracts requiring AI vendors to safeguard ePHI and report incidents.
- 04Repeat risk analysis when adopting or changing technology such as new AI tools.
03 / Records
Records to keep
- 01Current risk analysis that names AI systems and their ePHI
- 02Risk management plan with dated remediation actions
- 03Technology asset inventory including AI software
- 04Business associate contracts and vendor security reviews
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
Office of Information and Regulatory Affairs (reginfo.gov)
RELATED
Related: HIPAA Security Rule: the full guide · Does the proposed HIPAA Security Rule require encryption and MFA for AI systems?