What HIPAA's Cloud Guidance Means for AI Tools

In October 2016, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) published guidance on how the Health Insurance Portability and Accountability Act (HIPAA) applies to cloud computing. It was written before generative artificial intelligence (AI) tools were in common use, and it does not mention AI. However, AI tools run as cloud services, so the guidance applies. OCR also notes that the HIPAA Rules do not require or endorse any particular technology. When an AI vendor is a business associate

Under the cloud guidance, a cloud service provider that creates, receives, maintains, or transmits electronic PHI (ePHI) on behalf of a covered entity is a business associate. That is true even if the provider stores only encrypted data and has no key to decrypt it. The covered entity and the provider must sign a business associate agreement (BAA), and the provider is directly liable for meeting the HIPAA requirements that apply to it.

HIPAA has a narrow exception for conduits, such as the postal service. It covers only services that transmit information and hold it temporarily along the way. An AI service that keeps chat history or stores uploaded files would not qualify as a conduit.

What happens without a BAA

The guidance says an organization that uses a cloud provider to maintain ePHI without a BAA is in violation of the HIPAA Rules. It cites OCR's settlement with Oregon Health & Science University, which stored the ePHI of more than 3,000 people on a cloud-based server without a BAA.

A cloud provider that did not know it was holding ePHI has an affirmative defense if it corrects the problem within 30 days of when it knew or should have known. When a staff member pastes client information into an AI tool the organization has no agreement with, the vendor usually has no way of knowing it received PHI, and the organization remains in violation.

What a BAA does not settle

HIPAA does not require a cloud provider to share documentation of its security practices or to let customers audit them. Customers can require them in the contract, based on what their own risk analysis shows.

The guidance says a service level agreement can set limits on use, retention, and disclosure. For AI tools, the retention and use terms should say whether the vendor keeps prompts and uploaded files, for how long, and whether it can use them for anything other than providing the service. A business associate may use and disclose PHI only as its BAA and the Privacy Rule permit, so any use of your data to train the vendor's models should be addressed in the contract.

The provider and the customer should also confirm in writing which of them handles each Security Rule requirement. If a customer agreed to manage a security feature and did not, OCR will consider that in an investigation of either party. Before staff use an AI tool, the organization should know which settings, such as user access and data retention, are its responsibility and have them configured. OCR does not certify cloud products, so a vendor calling its product HIPAA compliant is making its own claim.

De-identified data

A cloud provider that receives and maintains only de-identified information is not a business associate, because de-identified information is not PHI. De-identification has to meet the Privacy Rule's standard, and there are two ways to do it. A qualified expert can determine that the risk of identifying anyone is very small, or the organization can use the Safe Harbor method, which requires removing 18 types of identifiers, including names, most location details smaller than a state, and dates other than the year. They must be removed wherever they appear, including free-text notes, and initials do not count as removing a name. HHS also notes that narrative notes can identify a person through context. Deleting a client's name from a case note is usually not enough.

Questions to ask before approving an AI tool

• Will the tool create, receive, store, or transmit PHI, and if so, is a BAA signed before anyone uses it?

• Does the contract say how long prompts and files are kept and whether they can be used to train models?

• Which security settings are ours to configure, and have we configured them?

• Where will the data be stored, and has our risk analysis accounted for that location?

• How, and how quickly, will the vendor report security incidents to us?

Organizations that are not HIPAA covered entities or business associates are not bound by this guidance. The same questions still work as a review for any AI tool that will receive client information.

DMS works with nonprofits, small businesses, and government agencies on cybersecurity and AI governance. Our live webinar on October 27, "Your Staff is Already Using AI: Where it Belongs and Where it Does Not," covers vendor risk and sensitive data in more detail.

Sources HHS.gov (Guidance on HIPAA & Cloud Computing, Business Associates, Methods for De-identification of PHI) | 45 CFR Parts 160 and 164 (HIPAA Privacy, Security, and Breach Notification Rules) | HHS OCR resolution agreement with Oregon Health & Science University (2016)