How to Find AI Tools Touching PHI Outside Your Business Associate Agreements

Is an AI tool HIPAA compliant without a business associate agreement?

No. Using an AI tool that receives PHI on your behalf without a business associate agreement is a HIPAA problem before anything goes wrong. HIPAA only lets a business associate pass PHI to a subcontractor after it obtains written satisfactory assurances, and the AI vendor in that position is a subcontractor.

Under 45 CFR 164.502(e), a business associate may disclose PHI to a subcontractor only if it gets satisfactory assurances that the subcontractor will safeguard it. The Security Rule says the same for electronic PHI in 45 CFR 164.308(b)(2), and paragraph (b)(3) requires those assurances to be documented in a written contract that meets 164.314(a). HHS lists the failure to enter into business associate agreements with subcontractors among the requirements for which business associates are directly liable.

This matters to a law firm handling medical records in litigation, an accounting firm that processes a health care client's billing data, or a nonprofit running a health program. If a staff member pastes a patient summary into a consumer chatbot or connects an AI notetaker to a call about a claim, the firm has a disclosure it did not authorize and a vendor it never vetted.

Is an AI vendor a business associate even if it only processes the data briefly?

Usually, yes. HHS treats a service that creates, receives, maintains or transmits ePHI for you as a business associate, and the conduit exception that covers mail carriers and internet service providers is narrow.

HHS's guidance on HIPAA and cloud computing says a cloud service provider that processes or stores ePHI is a business associate even if it holds only encrypted data and lacks the key. The same guidance says the conduit exception is limited to transmission-only services. An AI tool that reads a prompt, generates a response and keeps a chat history does more than transmit.

The guidance also states that a covered entity or business associate that uses a cloud provider for ePHI without a compliant agreement is in violation of the HIPAA Rules, and it cites an OCR resolution with an entity that stored ePHI on a cloud server without one.

What counts as an AI tool outside your agreements?

Four groups cover most of the shadow AI firms find: tools with no agreement at all, AI features inside vendors you already have an agreement with, apps connected to accounts that hold PHI, and browser extensions.

• Standalone AI tools staff signed up for themselves, such as chatbots, transcription apps and writing assistants, with no agreement and no review.
• AI features added to software you already license. If your agreement with a vendor names specific covered services, check whether a new AI feature falls inside that list before anyone uses it with PHI.
• Apps connected to a work account through a Microsoft or Google sign-in, including notetakers that join meetings and assistants that read a mailbox or a file share.
• Browser extensions that read page content, which can see whatever is on screen in a records system or portal.

How do you find AI tools touching PHI?

Start with the evidence you already collect: sign-in records, app consents, network or endpoint telemetry, and expense reports. Then narrow the list to the people and systems that handle PHI.

The HIPAA Security Rule already requires a business associate to regularly review records of information system activity, such as audit logs and access reports, under 164.308(a)(1)(ii)(D). An AI discovery review is a focused use of that same activity.

• Pull the list of enterprise apps and user consents in Microsoft Entra or Google Workspace. Look for AI notetakers, writing assistants and anything with mail, calendar or file permissions. Microsoft's Defender for Cloud Apps can show which OAuth apps have been granted access and at what level.
• Review cloud discovery data. Microsoft says Defender for Cloud Apps has added more than a thousand generative AI apps to its catalog, with a Generative AI category you can filter on and risk assessments for each app.
• Check endpoint and browser inventories for AI extensions and desktop apps on devices used by staff who touch PHI.
• Search card statements and expense reports for AI subscriptions. A paid personal plan bought for work is a strong signal.
• Ask. A short survey of the teams that handle PHI, with a no-penalty disclosure window, often finds tools the logs miss, such as phone apps.

Then match each tool against your inventory of agreements. For each one, record who uses it, what data it can reach, whether an agreement exists, and whether the agreement covers that specific product or plan.

What should you do when you find one?

Stop new PHI from reaching it, then decide whether PHI already reached it and whether that requires notice. Those are separate questions, and both need a written record.

First, block or restrict the tool for the users who handle PHI and tell them which approved tool to use instead. Second, work out whether PHI was actually entered. If it was, the disclosure is presumed to be a breach unless a documented risk assessment under 45 CFR 164.402 shows a low probability of compromise. Our article on running a HIPAA breach risk assessment after PHI goes into an AI tool walks through the four factors.

If you conclude a breach occurred, 45 CFR 164.410 requires a business associate to notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. Your own business associate agreement may set a shorter deadline, so check it.

Third, decide the tool's future. Either sign an agreement that covers the plan staff need, or remove it and document why. Keep the decision with your security documentation, which 45 CFR 164.316(b) requires you to retain for six years.

How does this fit into your risk analysis?

Every AI tool that can reach PHI belongs in your HIPAA risk analysis. The Security Rule requires an accurate and thorough assessment of risks to ePHI under 164.308(a)(1)(ii)(A), and a tool nobody listed is a risk nobody assessed.

Add each approved AI tool to the analysis with its data flows, its agreement status and the safeguards around it. The minimum necessary standard in 45 CFR 164.502(b) also applies: staff should share only the PHI needed for the task, even with an approved tool.

HHS proposed a major update to the Security Rule in January 2025 that would make technology asset inventories and network maps explicit requirements. It is still a proposal. The federal regulatory agenda lists final action for July 2027, and dates in that agenda have moved before. An AI tool inventory is useful under the current rule either way.

What should you do this quarter?

• Name an owner for AI tool review among the people responsible for HIPAA compliance.
• Pull app consents, cloud discovery data and expense reports for the last 90 days and build a first list of AI tools.
• Match the list against your business associate agreements, including which products and plans each agreement covers.
• Block unapproved AI tools for staff who handle PHI and publish the approved alternatives.
• Run a risk assessment on any tool where PHI was entered, and document the outcome.
• Add approved AI tools to your risk analysis and set a recurring review, such as quarterly.

How can s90 help?

s90 runs new-app alerts and AI guardrails for firms that handle PHI as business associates, so unapproved AI tools surface as they appear. We help you match what we find to your agreements, block what should not be there, and keep the records your risk analysis needs. If you want a first look at what AI tools are touching your environment, we are happy to start there.