US buyer guides / 03
What does an AI that touches patient records have to prove?
The HIPAA Security Rule asks for safeguards around electronic protected health information. An AI that reads, drafts or sends anything containing that information is inside the rule, whatever the vendor calls it.
The moment.
A clinic trials an AI that drafts replies to patient messages. It is helpful. Then someone asks where the message text went to be drafted, who could see it, and whether the vendor's agreement covers that. Nobody had asked, because the demo looked like email.
For every place patient information goes when this AI works, what safeguard applies and what record shows it was applied?
What you would see.
The rule in force dates from 2013. The US Department of Health and Human Services published a proposed rule on 6 January 2025 to strengthen it; no final rule had followed at the time of writing, so test against the current text and watch for the change. Source: hhs.gov/hipaa/for-professionals/security.
A good answer traces one patient message end to end: where it went, which systems held it, who had access, and the audit record. A bad answer is "we are HIPAA compliant" with no trace.
The record you would open
| system | PHI touched (yes/no) | access reason | user | timestamp | retention |
|---|---|---|---|---|---|
| [system] | [yes / no] | [authorised purpose] | [named account] | [YYYY-MM-DD hh:mm] | [period] |
Primary sources.
One thing to do.
Pick one real message type. Ask the vendor to show you its full path in your own system, then show you the record of that path.
The words.
- Protected health information:
- anything that identifies a patient and relates to their care.
- Safeguard:
- a control the rule expects, administrative, physical or technical.
- Business associate:
- a vendor that handles this information for you, under a written agreement.
Free, no email gate.
Download The Agentic AI Procurement Handbook, second edition, version 4.0. The 87-page PDF is free with no email gate.
Download version 4.0See your own exposure scored.
The SecVantages AI security assessment takes ten to twenty minutes, needs no card and no call, and leaves you a scored report.
Start the free assessment