HIPAA Compliant AI Solutions: A Healthcare Buyer's Guide

Key Takeaways

• HHS does not certify or endorse any technology, so "HIPAA compliant" on a sales page is a claim you have to verify yourself.
• A vendor that stores or processes ePHI for you is a business associate even if it only holds encrypted data and has no key.
• Settle data scope, training rights, subcontractors, incident timelines and data return before price, because those terms are hard to change later.
• Recent OCR settlements show what goes wrong with vendors: no real risk analysis, unreviewed logs and late breach notice.
• From December 28, 2026, certified health IT no longer has to provide model card details for decision support tools, so ask vendors for them directly.
• Removing identifiers before data reaches a model narrows what the vendor ever sees and shrinks your exposure if something fails.

Healthcare teams are buying AI faster than procurement processes were designed for. Ambient documentation, prior authorization helpers, patient messaging and coding assistants all arrive with confident compliance language and a demo that looks safe. Few buyers have time for a full AI due diligence process on each one.

Our guide to generative AI and HIPAA explains the rules themselves. This one is for the people signing the purchase order. It follows the order in which buying decisions actually happen and flags the terms that matter most at each step.

What "HIPAA Compliant" Means When You Are the Buyer

HIPAA applies to covered entities and their business associates, not to products. A tool becomes part of a compliant setup only when the contract, the configuration and your own safeguards line up. HHS says plainly in its cloud computing guidance that OCR does not endorse, certify or recommend specific technology or products. Any badge a vendor shows you comes from a private assessor, which can be useful evidence but is not a regulator's approval.

The same guidance closes a loophole that some AI vendors still lean on. A provider that stores or processes electronic PHI for you is a business associate even if it only handles encrypted data and holds no decryption key. Using such a service without a BAA puts you in violation of the HIPAA Rules. So the first filter is simple: if a vendor will touch PHI and will not sign a BAA, it is out.

Compliance is also shared after signing. Your organization still owns its risk analysis, access decisions and workforce training under the HIPAA Security Rule. A vendor can make that easier or harder, which is what the rest of this guide helps you judge.

Stage One: Scope the Use Case and the Data

Before you see a single demo, write down what the tool will do, who will use it and which data it needs. A scheduling assistant and a clinical summarization tool carry very different risk even if they come from the same vendor. List the systems the tool will read from, whether it writes back into the record, and whether staff will paste content into it by hand.

HHS states that a cloud provider receiving only data de-identified under the Privacy Rule is not a business associate, because that information is no longer PHI. Many analytics, quality and training use cases work well on de-identified data, and our comparison of anonymization and de-identification explains where each fits.

Where identifiers are needed, apply data minimization so the tool sees the smallest set that still does the job. That one decision often matters more than any feature on the vendor's slide, as the clinical AI assistants case study shows.

Stage Two: Shortlist and Security Review

Questions that separate real controls from marketing

Ask every shortlisted vendor the same questions in writing so answers can be compared, and record each one as third-party AI risk rather than a one-off IT ticket. Will you sign our BAA or only yours? Which model providers, hosting companies and support contractors will see our data, and in which countries? Is any of our data, including prompts, outputs and feedback, used to train or improve models, and can that be switched off by contract rather than by a setting? How long are prompts, outputs and logs kept, and how is deletion proven?

Follow with security questions that map to what OCR actually checks. When did you last complete a Security Rule risk analysis, and what changed because of it? Can we export audit logs showing who accessed our data? How fast will you tell us about a security incident, and who is our named contact? The answers belong in your vendor risk file, and our broader guide to evaluating AI vendors covers non-healthcare criteria such as model quality and lock-in.

Why these questions matter now

OCR's recent settlements read like a list of buyer warnings. In March 2026, OCR settled with MMG Fusion, a Maryland software company acting as a business associate, after an intrusion exposed PHI of about 15 million people. OCR found no accurate risk analysis and a failure to notify affected covered entities. Its director stressed that business associates must notify covered entities without unreasonable delay and within 60 calendar days of discovery.

In October 2026, Lehigh Valley Health Network agreed to pay $800,000 after a ransomware investigation found, among other failures, no procedures for regularly reviewing audit logs. A vendor that cannot show its own log review process is likely to leave you in the same position. seven questions to ask about AI security is a useful companion here.

The walk-away signs matter as much as the evidence. A vendor that hesitates on any of them during a sales cycle rarely becomes more flexible once it holds your data, so it pays to understand how AI vendor risk differs from third-party AI risk before you negotiate.

Stage Three: Run a Pilot That Tests the Claims

A pilot is where you check that the product behaves the way the security questionnaire says it does. If the pilot uses real PHI, the BAA must already be signed, since a trial is still a disclosure. Where can, run the first phase on de-identified or synthetic medical data and move to identified records only after the controls pass.

Test deletion by asking the vendor to remove a test record and show you it is gone from storage, indexes and logs. Pull an audit log export and confirm you can see each user and action. Try a few prompts that include identifiers to see whether they are masked, stored or echoed back. Keep a person reviewing outputs, because a human in the loop catches clinical and privacy errors that automated checks miss.

Ask for model transparency directly

For tools that support clinical decisions, transparency is now partly your job. ONC's HTI-5 final rule, published in the Federal Register on October 28, 2026, removes the source attribute and risk management requirements for decision support interventions from health IT certification, effective December 28, 2026. Those were the model card details covering training data, intended use and performance across patient groups. ONC said it may revisit the question in future rulemaking.

Certification will no longer guarantee that information, so write it into your RFP and contract. You still need it: under Section 1557, covered entities must make reasonable efforts to identify patient care decision support tools that use race, color, national origin, sex, age or disability as inputs and to mitigate discrimination risk. Our piece on Privacy cafe AI explainability in enterprise applications covers what useful documentation looks like.

Stage Four: Negotiate the BAA and Service Terms

HHS publishes sample BAA provisions, but they are a floor. Treat them the way you would any AI risk assessment: a starting point, not the finish line. The contract should state permitted uses and disclosures, require Security Rule safeguards, require reporting of security incidents and breaches, flow obligations down to subcontractors and require return or destruction of PHI when the agreement ends. HHS's cloud guidance adds that a BAA may set faster incident reporting than the Breach Notification Rule requires, so ask for a specific window in days or hours.

Service level terms carry just as much weight. HHS lists availability, backup and recovery, how data is returned after termination, security responsibilities and limits on use and retention as topics worth covering, and warns that terms must not let a vendor block your access to your own ePHI. HIPAA does not force a vendor to accept audits, but you can require audit rights or reports in the contract.

If the vendor stores data overseas, HHS allows it with a BAA but expects your risk analysis to weigh the location, a topic we cover in AI data residency.

Stage Five: Plan for Rules That Are Still Moving

The HIPAA Security Rule update proposed on January 6, 2025 is still not final. HHS's regulatory agenda lists it as a long-term action with final action estimated for July 2027, and the current rule stays in force meanwhile. The proposal would make encryption at rest and in transit, multi-factor authentication, a technology asset inventory and annual written verification of business associates' technical safeguards mandatory, with limited exceptions.

Smart buyers write those expectations into contracts now, and confirm the vendor's data is held in encrypted storage end to end. A vendor that already encrypts everything, enforces MFA and can deliver a yearly safeguards verification will not need a renegotiation if the rule is finalized. Our AI audit checklist helps you turn that into recurring reviews.

Where Questa AI Fits

The strongest contract still depends on the vendor keeping its promises, a weakness we explore in black box AI as a board-level risk. Questa AI reduces how much you have to trust by acting as a privacy firewall between patient data and the AI tools your teams use. It detects and anonymizes identifiers in clinical notes, transcripts, claims data and structured files before anything reaches a model, so many workflows can run without the downstream vendor seeing PHI at all.

Health systems with strict residency needs can run Questa Blackbox on their own infrastructure, and our healthcare solutions page shows how hospital chains apply it across sites. If you are about to sign an AI contract this quarter, putting anonymization in front of it first is the quickest way to shrink the risk you are taking on.

Frequently Asked Questions

Conclusion

Buying a HIPAA compliant AI solution is less about finding the right label and more about running the right process. Scope the data, demand written answers, test the claims in a pilot, negotiate the BAA and service terms in detail and plan your exit before go-live. The 2026 changes add two more tasks: ask for model transparency that certification no longer requires, and contract for the stronger safeguards the proposed Security Rule points toward.

Do that and the vendor's compliance claims become commitments you can check. Pair them with anonymization before data reaches any model, and you limit what can go wrong even when a vendor falls short.

This article is for general information only and is not legal advice. HIPAA requirements, HHS guidance and federal rulemaking change over time, and regulatory status was checked against official sources in November 2026. Confirm your obligations with qualified counsel before signing any vendor agreement.