.png)
HIPAA Requirements for AI
HIPAA's Privacy Rule, Security Rule, and Breach Notification Rule all apply to AI interactions containing PHI. Key requirements: access controls, audit trails, encryption, minimum necessary standard, and Business Associate Agreements.
Protecting PHI in AI Prompts
Clinicians naturally include patient information in AI queries. Solutions: automatic PHI detection and redaction before prompts reach AI models, de-identification templates for common clinical queries, and training on PHI-safe prompt writing.
Technical Safeguards
Implement: end-to-end encryption for all AI communications, zero-history architecture to prevent PHI persistence, role-based access by clinical function, automatic session timeouts, and comprehensive audit logging.
BAA Considerations
Ensure your AI platform vendor offers a BAA. Zero-history architecture simplifies BAA requirements because there's no PHI to protect at rest. Review BAA terms for: breach notification timelines, subcontractor obligations, and termination provisions.