Key takeaways
- HIPAA presumes an impermissible disclosure of PHI is a breach unless a documented HIPAA breach risk assessment shows a low probability of compromise.
- The firm, covered entity or business associate, carries the burden of proof under 45 CFR 164.414(b).
- HHS guidance treats a provider that receives ePHI on another's behalf as a business associate, even without the encryption key.
- Business associates must notify the covered entity no later than 60 calendar days after discovery, and agreements often set shorter deadlines.
- Capture the chat, timestamp and account details before anyone deletes the conversation.
- Keep the written assessment for six years.
A staff member pastes patient names, dates of service and diagnosis codes into a public AI chatbot to clean up a spreadsheet. If your firm is a covered entity or a business associate, that moment calls for a HIPAA breach risk assessment, and the notice clock starts when the firm discovers it.
Is PHI in an AI tool automatically a HIPAA breach?
No. HIPAA presumes it is a breach, and the firm can rebut that presumption only with a documented risk assessment. Under 45 CFR 164.402, an impermissible use or disclosure of protected health information is presumed to be a breach unless the covered entity or business associate demonstrates a low probability that the PHI has been compromised. 45 CFR 164.414(b) puts the burden of proof on the firm.
Here is the case this article works through. A law firm handling personal injury matters for a hospital client, or an accounting firm doing billing work for a medical group, is a business associate. A staff member pastes a spreadsheet of patient names, dates of service and diagnosis codes into a consumer AI chatbot to reformat it. The AI vendor has no business associate agreement with anyone. The question is whether that disclosure is a reportable breach.
Does the AI vendor's role change the analysis?
Yes. An AI vendor that receives PHI without a business associate agreement makes the disclosure impermissible, which triggers the breach presumption. HHS guidance on cloud computing says a service provider that creates, receives, maintains or transmits ePHI on behalf of a covered entity or business associate is itself a business associate, even if it stores only encrypted data and lacks the key. Using such a provider without a business associate agreement violates 45 CFR 164.502(e).
A firm-approved AI tool covered by a signed agreement is a different situation from a consumer chatbot. When the tool is covered, entry of PHI may be a permitted disclosure and the breach analysis may never start. When it is not, the four-factor assessment begins.
How do you work through the four factors of a HIPAA breach risk assessment?
Answer each of the four factors in writing, with evidence, in the order 45 CFR 164.402 lists them, then weigh them together.
Factor 1: What PHI was involved?
Record the exact data elements and the number of individuals. Names with diagnosis codes and dates of service are far more sensitive than a list of appointment times with no names. Note whether anything could be re-identified from what was shared, because the regulation names the likelihood of re-identification as part of this factor.
Factor 2: Who received it?
Identify the vendor, the product, and the account type: consumer free tier, paid individual plan, or business plan. Pull the terms that applied on the date of the disclosure, including data retention and whether inputs may be used to train models. A vendor that retains prompts and may train on them weighs against a low-probability finding.
Factor 3: Was the PHI actually acquired or viewed?
For an AI tool, the honest answer is usually that the vendor's systems received and processed it. The absence of human review is not proof the PHI was not acquired. Capture the chat history, the timestamp and the account details before anyone deletes the conversation, since deletion destroys the evidence the assessment depends on.
Factor 4: How far has the risk been mitigated?
Document every step: deleting the chat, requesting deletion from the vendor in writing, receiving written confirmation, disabling the account and confirming the data was not shared further. Written assurances from a vendor with no contractual duty to the firm carry less weight than assurances from a party bound by an agreement.
What happens if the risk assessment cannot show a low probability of compromise?
The breach is reportable and notice deadlines apply. A business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery under 45 CFR 164.410. The covered entity then owes notice to individuals on the same 60-day outer limit under 45 CFR 164.404.
Discovery is the first day the breach is known to the firm, or would have been known through reasonable diligence to any workforce member or agent other than the person who caused it (45 CFR 164.410(a)(2)). Give staff a simple, no-blame way to report an AI mistake the same day, so the firm finds out early and has the full window to investigate.
HIPAA breach notification to HHS depends on size. Under 45 CFR 164.408, a breach affecting 500 or more individuals is reported to HHS at the same time as individual notice. Smaller breaches are logged and reported within 60 days after the end of the calendar year. Business associate agreements often set shorter deadlines than the rule, so check the agreement before the regulation.
HHS describes the reporting process on its Breach Notification Rule page.
What should the written HIPAA breach risk assessment include?
It should give an OCR investigator enough to reach the same conclusion from the file alone. A complete assessment records:
- The date of discovery and who discovered it.
- The data elements, the number of individuals and the source system.
- The AI vendor, product, account type and terms in effect.
- The evidence captured and where it is stored.
- A finding and the reasoning for each of the four factors.
- The overall conclusion and who made it, with the date.
- Notices sent, or the reason none were required.
Keep the assessment for six years. 45 CFR 164.414(a) applies the documentation rules in 45 CFR 164.530(j) to breach records, and security incident records fall under 45 CFR 164.316(b) and 164.308(a)(6), so log the incident under the firm's security incident procedures as well. State breach laws, including California's, apply on their own terms and need a separate check.
What should a firm do this quarter to prepare?
Seven steps make the next HIPAA breach risk assessment faster to complete and easier to defend.
- Add AI tools to the firm's HIPAA risk analysis, the firm-wide assessment OCR keeps enforcing.
- Name the AI tools approved for PHI, confirm each has a signed business associate agreement, and block the rest on firm devices.
- Turn on DLP rules for medical record numbers, health plan IDs and diagnosis codes in browsers and Microsoft 365.
- Add an AI section to the incident response plan, with a one-page four-factor template.
- Pre-write the vendor deletion request so it can go out within hours.
- Read every business associate agreement the firm has signed and list the notice deadlines in one place.
- Run a 30-minute tabletop using the spreadsheet example above.
The proposed HIPAA Security Rule update would make incident response planning more prescriptive if it is finalized. Check where the HIPAA Security Rule update stands before rewriting the plan.
How can s90 help?
s90 manages IT and compliance for firms in Los Angeles and Orange County that handle PHI as business associates. We set up the AI controls and DLP rules that keep PHI out of unapproved tools, and our agreements commit to notifying clients within 72 hours of a breach and producing evidence within 24 hours of a request. If you want to test your AI incident process before you need it, we would be glad to help.
