HIPAA

No AI tool is HIPAA compliant on its own. Compliance depends on how the organization uses it: a business associate agreement covering the specific product and account type, access controls, prompts limited to the minimum necessary, and the tool's place in the Security Rule risk analysis. A vendor's consumer version may not be covered even when its business version is.

No. The HIPAA risk analysis required by 45 CFR 164.308(a)(1)(ii)(A) is an ongoing, firm-wide assessment of risks to electronic PHI. A breach risk assessment under 45 CFR 164.402 is specific to one incident: it is done after an impermissible use or disclosure to decide whether the firm must send breach notices. A firm needs both.

It can be used in a HIPAA compliant way, and that depends on how the firm uses it. A covered entity or business associate can put PHI into an AI tool only when the vendor has signed a business associate agreement for that specific plan and the firm applies its own safeguards, such as access controls and logging. Business associate agreement availability varies by vendor and plan, so check the current terms before anyone enters PHI.

Not on its own. Deletion is one mitigation step under the fourth risk assessment factor, but the vendor may already have retained or processed the data under its terms. Capture the chat, timestamp and account details first, then delete, request deletion from the vendor in writing and keep the confirmation. The assessment weighs all four factors together.

Cost is one of four factors listed in 45 CFR 164.306(b)(2), alongside the firm's size and capabilities, its technical infrastructure, and the probability and criticality of risks to ePHI. A decision record that cites only cost, with no link to the risk analysis, is hard to defend. The firm must also consider an equivalent alternative measure.

No. Under 45 CFR 164.306(d)(3), a covered entity or business associate must assess whether each addressable specification is reasonable and appropriate. If it is, the firm implements it. If not, the firm must document why and implement an equivalent alternative measure if that is reasonable and appropriate. The decision itself is required.

Yes, if the AI vendor will create, receive, maintain or transmit PHI for the business associate. HIPAA treats that vendor as a subcontractor, and 45 CFR 164.502(e) and 164.308(b)(2) require written satisfactory assurances before PHI is shared. HHS lists failing to sign agreements with subcontractors among the requirements business associates are directly liable for. Check that the agreement covers the specific product and plan staff use.

It can. A firm that creates, receives, stores or transmits protected health information on behalf of a covered entity, such as a law or accounting firm handling medical records for a client, is a business associate and must follow the HIPAA Security Rule.

No later than 60 calendar days after discovering a breach of unsecured PHI, and without unreasonable delay, under 45 CFR 164.410. The notice goes to the covered entity and should identify each affected individual where possible. Many business associate agreements set a shorter deadline, and the contract deadline binds the firm even though HIPAA allows longer.

Yes. The Security Rule's risk analysis requirement at 45 CFR 164.308(a)(1)(ii)(A) applies to business associates directly, so a law firm, accounting firm or IT provider holding ePHI for a client must assess the risks to that ePHI on its own systems. OCR has settled Risk Analysis Initiative cases with business associates, including an accounting firm in August 2025.

Yes. Business associate status comes from the definition in 45 CFR 160.103: providing a service such as legal or accounting work that involves receiving PHI from a covered entity. HHS treats business associates as directly liable for Security Rule compliance and breach notice whether or not an agreement exists. A missing agreement is a compliance gap for both the firm and its client.

Yes. HHS guidance says a cloud provider that stores ePHI is a business associate even if the data is encrypted and the provider does not hold the decryption key. The conduit exception covers only transmission-only services with transient access, so storage, backup and hosting vendors need a business associate agreement.

Encryption is an addressable specification today. That means a covered entity or business associate must assess whether it is reasonable and appropriate, then implement it or document why not and use an equivalent alternative if reasonable. The 2025 proposed rule would make encryption of ePHI at rest and in transit required, with limited exceptions.

Usually not. OCR's April 2018 cybersecurity newsletter explained that a gap analysis, which compares existing controls to a list of requirements, does not include the elements of a risk analysis and may not satisfy the obligation. A compliant risk analysis identifies where ePHI lives, the threats and vulnerabilities it faces, their likelihood and impact, and an assigned risk level with corrective actions.

A hybrid entity is a single legal entity that is a covered entity, performs both covered and non-covered functions, and formally designates its health care components. Once designated, the HIPAA Rules apply to the health care components, such as a clinic, and not to the rest of the organization. The designation must be documented, and PHI cannot flow freely to non-designated programs.

Usually, yes. If the provider can maintain or access systems that hold ePHI, such as email, file servers or backups, it is a business associate under 45 CFR 160.103. When the provider works for a law or accounting firm that is itself a business associate, the provider is a subcontractor and still needs a business associate agreement with that firm.

Under the January 2025 proposal, the network map would illustrate how ePHI moves through the entity's electronic information systems, alongside a written technology asset inventory. HHS proposed updating both at least every 12 months and after relevant environmental or operational changes. The proposal is not final, but the current risk analysis already requires knowing where ePHI is stored, received, maintained or transmitted.

No. The current HIPAA Security Rule sets no fixed patching deadline. Patching falls under risk management at 45 CFR 164.308(a)(1)(ii)(B), which requires security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level. A covered entity or business associate chooses its own timeline based on the factors in 164.306(b)(2) and should document why that timeline is reasonable.

At least every six months, according to the HHS fact sheet on the proposed Security Rule update published January 6, 2025. The proposal would also require penetration testing at least once every 12 months. These are proposals, not current law. The federal regulatory agenda targets final action for July 2027, and the final text could differ.

The current Security Rule does not set a fixed schedule. It requires the analysis to stay accurate and thorough, and 45 CFR 164.316(b) requires documentation to be reviewed periodically and updated after environmental or operational changes. An annual review is a practical floor, and the 2025 proposal would require the asset inventory and network map behind it to be reviewed at least every 12 months.

Six years. Under 45 CFR 164.316(b), Security Rule policies, procedures and required records must be retained for 6 years from the date of creation or the date they were last in effect, whichever is later. They must also be reviewed periodically and updated when the environment or operations change.

No date is fixed. HHS published the proposed rule on January 6, 2025, and the federal regulatory agenda lists final action for July 2027 as a long-term item. An earlier target of May 2026 passed. Until a final rule is published, the current Security Rule applies and OCR enforces it.

No. CSF 2.0 is a voluntary set of outcomes, and compliance is measured against each rule's own text. A crosswalk shows where one control or document can serve as evidence for several rules. It does not cover requirements that exist only in a rule, such as the 30-day customer notice in Reg S-P or annual board reporting under the FTC Safeguards Rule.

Yes. NIST SP 800-66 Revision 2, published in February 2024, maps the HIPAA Security Rule's standards and implementation specifications to NIST Cybersecurity Framework Subcategories and to SP 800-53 Rev. 5 controls. NIST hosts the mappings in its Cybersecurity and Privacy Reference Tool, where they can be browsed and searched.

Only if it meets the definition. A health care provider is a covered entity when it transmits health information electronically in connection with a HIPAA standard transaction, such as billing a health plan. Nonprofit status does not matter. A program that never bills electronically may fall outside HIPAA, though state confidentiality laws, grant terms and funder contracts can still apply.

De-identified data can no longer reasonably be linked to a specific person. NIST SP 800-188 defines de-identification as removing the association between identifying data and the data subject. HIPAA's Safe Harbor method, a useful benchmark even for nonprofits outside HIPAA, removes 18 identifier types, including names, detailed locations, dates other than the year, and case or account numbers.

It is an impermissible disclosure, and HIPAA presumes an impermissible disclosure is a breach unless a documented four-factor risk assessment shows a low probability the PHI was compromised. HHS guidance treats a service provider that receives ePHI on another's behalf as a business associate, so using one without an agreement is itself a violation. The organization carries the burden of proving no breach occurred.