United States (federal) · regulation
HIPAA: what it requires, and the records to keep
The Privacy Rule limits how covered entities and business associates may use and disclose protected health information (PHI) and gives patients rights over it. It has no AI-specific provisions, but it governs any AI tool that ingests, is trained on, or outputs PHI on behalf of a covered entity.
01 / What it requires
What HIPAA requires
Covered entities (health plans, health care clearinghouses and providers that bill electronically) and their business associates, including AI vendors that handle protected health information for them.
- 01Use or disclose PHI in AI tools only for a permitted purpose, such as treatment, payment or operations, or with patient authorization.
- 02Sign a business associate agreement before an AI vendor creates, receives, maintains or transmits PHI for you.
- 03Limit PHI sent to AI tools to the minimum necessary, except for treatment disclosures.
- 04De-identify data by Safe Harbor or Expert Determination before treating it as outside HIPAA, for example for model training.
- 05Get authorization or an IRB or privacy board waiver before using PHI for research, including AI research.
- 06Assess and notify under the Breach Notification Rule if an AI tool exposes unsecured PHI.
02 / AI work
Where it touches AI work
HHS has stated that PHI in AI training data, prediction models and algorithm data held by a regulated entity for covered functions is protected by the HIPAA Rules. Generative AI tools that memorize or reveal training data can cause impermissible disclosures.
03 / Dates
The dates that matter
Privacy Rule final rule published
Compliance date for most covered entities
Omnibus Rule makes business associates directly liable
HHS states PHI in AI training data is protected (Security NPRM preamble)
Latest civil penalty inflation adjustment codified
04 / Enforcement
Who enforces it
HHS Office for Civil Rights and state attorneys general. Civil penalties adjusted for inflation range from $145 to $2,190,294 per violation, with an annual cap of $2,190,294 per identical provision; knowing violations can bring DOJ criminal charges.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01Business associate agreements with each AI vendor handling PHI
- 02Data-flow map showing what PHI each AI tool receives
- 03De-identification method records or expert determination reports
- 04Authorizations or IRB waivers for AI research uses
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: HIPAA vs HHS §1557 · HIPAA vs FERPA · HIPAA vs FDA PCCP / SaMD · HIPAA for medicine AI workflows · NIST AI RMF · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4