HIPAA and AI: how can nonprofit health programs use AI without exposing PHI?

Case managers, clinic staff and grant writers at multi-service nonprofits are already using AI to save time. When a program touches health information, the executive director and board need a clear answer on HIPAA and AI before a client's details end up in a chatbot.

Does HIPAA apply to your nonprofit's health program?

HIPAA applies only if the organization, or a designated part of it, is a covered entity or a business associate. A health care provider becomes a covered entity when it transmits health information electronically in connection with a HIPAA standard transaction, such as submitting a claim to a health plan. Tax-exempt status has no bearing on the answer. HHS puts the other side plainly: an entity that is neither a covered entity nor a business associate does not have to comply with the HIPAA Rules.

Three situations come up often. A community clinic or behavioral health program that bills Medi-Cal or private insurers electronically is likely a covered provider. A nonprofit that performs work for a covered entity, such as care coordination under contract with a health plan, is likely a business associate. A program that delivers services but never bills a health plan electronically may sit outside HIPAA entirely. Outside HIPAA does not mean unregulated: California's Confidentiality of Medical Information Act, funder contracts and grant terms can still restrict how health information is handled, and counsel should confirm which rules apply to each program.

Does HIPAA say anything about AI?

Not by name. The HIPAA Rules are technology neutral, so the Privacy, Security and Breach Notification Rules apply to an AI tool the same way they apply to email, cloud storage or an electronic health record. What matters is whether the tool creates, receives, maintains or transmits PHI. There is no separate HIPAA rule for AI, so the decisions below are the same ones the organization makes for any other system that handles PHI.

What is a hybrid entity, and why does it matter for AI?

A hybrid entity is a single legal organization that is a covered entity, performs both covered and non-covered functions, and designates which parts are its health care components. Many multi-service nonprofits fit that description: a clinic operating alongside a food pantry, housing services and a development office.

The designation decides where the HIPAA Rules apply, and it shapes AI decisions. Under 45 CFR 164.105(a), a health care component may not share PHI with the rest of the organization in ways that would be prohibited if the two were separate entities. Clinic records cannot flow into the development team's AI writing tool just because both sit under one board. Map which staff and volunteers work inside the designated components, because their AI tools are the ones that must meet HIPAA's requirements.

When does an AI vendor become a business associate?

An AI vendor becomes a business associate when it creates, receives, maintains or transmits PHI on behalf of a covered entity or another business associate. A case manager pasting a client's history into a chatbot to draft a care plan summary makes the chatbot's provider exactly that.

HHS's cloud computing guidance says a cloud provider that maintains ePHI is a business associate even if it stores only encrypted data and lacks the key, and that using one without a business associate agreement violates the HIPAA Rules. The same reasoning applies to an AI service that receives prompts containing PHI. Before any PHI goes in, the organization needs a BAA that meets 45 CFR 164.504(e), for the specific product and account type staff will use. If the vendor will not sign one for that product, PHI stays out of it.

What AI work is safe without PHI?

Work that never touches PHI, or uses properly de-identified data, falls outside the HIPAA Rules. HIPAA recognizes two de-identification methods: Safe Harbor, which removes 18 types of identifiers and leaves no actual knowledge that the remaining data could identify someone, and Expert Determination, where a qualified expert documents that the risk of identification is very small. That leaves real room for AI:

• Drafting program descriptions and grant narratives from aggregate figures.
• Summarizing published research and public health guidance for staff.
• Writing policies, training materials, scripts and blank intake form templates.
• Analyzing outcome data after it has been de-identified under one of the two methods.

Free text is where de-identification usually fails. HHS guidance says identifiers must be removed from narrative fields too, and a case note with a first name, a neighborhood and a date of service is still PHI. Small programs carry extra risk, because a rare circumstance in a small community can point to one person with no name attached.

How do you set up AI for staff who handle PHI?

Approve one AI tool under a BAA, limit what goes into it, and make the rules enforceable in your systems. A practical sequence:

1. Settle HIPAA status for each program, and if the organization is a hybrid entity, document its health care components.
2. Choose an AI product covered by a BAA for the account type staff will use, and confirm its data retention and model training terms in writing.
3. Write prompt rules around the minimum necessary standard, which requires reasonable efforts to limit PHI to what the purpose needs. In practice: no full records, and no identifiers the task does not use.
4. Add the AI tool to the Security Rule risk analysis, including its data flows, access controls and retention. OCR has repeatedly cited missing or incomplete risk analyses in its recent enforcement actions.
5. Block unapproved AI tools on organization accounts and devices, and use data loss prevention rules to catch PHI headed toward them.
6. Train the staff and volunteers who touch PHI, and keep a list of who has access to the approved tool.
7. Plan the response before you need it. PHI pasted into an unapproved tool is an impermissible disclosure, and HIPAA presumes it is a breach unless a documented risk assessment shows a low probability that the information was compromised.

What should a nonprofit do this quarter?

Start with the facts about your own programs, then close the gaps that matter most:

• Record whether each health program is a covered entity, a business associate or neither, and who made that call.
• Inventory the AI tools staff and volunteers already use, starting with programs that handle health information.
• Put a BAA in place before approving any AI tool for PHI, or restrict the tool to de-identified work.
• Add AI tools to the risk analysis and the workforce training plan.
• Build to the current Security Rule and track HHS's proposed Security Rule changes, whose timing remains uncertain.

How does s90 help?

s90 helps nonprofits with health programs approve AI deliberately. We find the AI apps staff and volunteers already use, alert on new ones as they appear, and set guardrails that keep PHI inside tools covered by a BAA. The records we produce feed the risk analysis your HIPAA program needs. If you are not sure which of your programs HIPAA reaches, that is a good place to start the conversation.