Search this question and you get a product list. Almost every page that ranks for it either sells a HIPAA-wrapped chat tool or sells the platform that audits one, and all give the same answer: sign a Business Associate Agreement, buy the right tier, you are covered.
That answer is correct and it is not the boundary. A BAA constrains your vendor’s conduct. The disclosure that becomes a breach is made by a billing coordinator with a claim open in one window and an assistant open in the other, in four seconds, with no lawyer in the building. Microsoft states the gap on its own compliance page: asked whether its BAA ensures a customer’s compliance, the answer is “No.” Every major vendor says a version of the same thing, which means the interesting part of this problem was never the contract.
What makes an assistant a HIPAA problem
HIPAA attaches to the data and the relationship, never to the technology. There is no AI exemption and no AI-specific rule. An assistant that creates, receives, maintains or transmits protected health information on your behalf makes its vendor a business associate, and that is the whole test.
What people get wrong is the surface area. The prompt is the obvious one. The rest are not: uploaded attachments, the context a connector pulls in, the model’s output, conversation history, retrieval indexes built from your documents, and the logs underneath. A team trained to be careful in the prompt box that uploads the spreadsheet anyway has solved one sixth of the problem.
PHI also survives partial removal. Under the Privacy Rule’s Safe Harbor method at 45 CFR 164.514(b)(2), information is de-identified when eighteen categories of identifier are gone for the individual and for relatives, employers and household members, and the organization has no actual knowledge that what remains could still identify the person. Free-text narrative fails that second condition constantly. Strip the name from a paragraph describing the retired fire chief of a small town and you have removed an identifier without de-identifying anybody.
Who is inside the perimeter and does not know it
Every competing article on this subject addresses a clinician. For a company of fifty to five hundred people, that is the wrong reader.
The seats where this fails are non-clinical: front desk, scheduling, billing and collections, prior authorization, patient marketing, and the account team at a vendor whose customers happen to be providers. None trained as clinicians, all touch PHI daily, and all have an assistant open because the work is repetitive and the tool is good at it.
Then there is the employer that does not consider itself a healthcare company. A self-funded group health plan is a covered entity in its own right, and the HHS Office for Civil Rights has now enforced on that basis: the Star Group L.P. Health Benefits Plan settled for $245,000 on 23 April 2026, the first such action against a self-funded employer-sponsored plan, and a second plan settlement followed on 18 June 2026, bringing the pair to $695,000. Both turned on a failed risk analysis.
Read that against your own org chart. When an HR generalist at a manufacturer pastes a claims appeal into an assistant to draft a response, the manufacturer’s health plan is the covered entity and the generalist is its workforce, and nobody in that chain has been told so. The same logic reaches billing companies, transcription vendors and the agency holding a provider’s testimonials.
The coverage map, verified
Vendor documentation changes quarterly. Treat this as a snapshot taken in October 2026 and check your own account before relying on it.
| Vendor | Covered | Not covered |
|---|---|---|
| Anthropic | The first-party Claude API; Claude Enterprise on a HIPAA-ready plan after the Primary Owner activates HIPAA compliance and accepts the BAA | Free, Pro and Max plans, the Console, cloud-run sessions, and the Batch, Files and Web Fetch APIs |
| OpenAI | Per its HIPAA-eligibility article: ChatGPT for Healthcare, ChatGPT for Enterprise with a Regulated Workspace, clinician and FedRAMP variants, and API endpoints set to modified or zero retention | Per HIPAA Journal’s October 2026 update, no BAA for Free, Plus, Team or plain Enterprise, nor the consumer ChatGPT Health app |
| Microsoft | Microsoft Copilot and Microsoft Copilot Chat, listed in-scope on Microsoft’s HIPAA and HITECH page | The consumer Copilot, and anything outside the enumerated list |
| Gemini features inside Workspace, under its HIPAA Included Functionality, once an administrator accepts the BAA | Third-party applications and add-ons, and Additional Google Services |
Two things fall out of that table.
The apparent contradiction in the OpenAI row is the lesson, not an error. Plain Enterprise is not covered; Enterprise with a Regulated Workspace is. Anthropic says the same thing differently, since a HIPAA-ready organization is covered only once somebody clicks the switch, which its documentation describes as a one-way decision. What is covered is a configuration, not a product. A purchase order proves you bought the tier; it does not prove anyone turned it on. That argument in full sits in the admin settings worth fixing before the first training session.
And the consumer and business versions share a brand name, a login screen, and nothing else that matters here. Your staff have both, which is the case for treating a paid account as a control and not a perk.
The carve-outs tell you where it breaks
Read all four exclusion lists side by side and the same categories recur: in-browser assistants and extensions, third-party connectors, marketplace add-ons, web-fetch and web-search features, and companion consumer products under the same brand.
That pattern predicts specific Tuesday-afternoon failures. A notetaker bot that auto-joins calendar events joins a telehealth consult: the assistant drafting the visit summary sits under a BAA, the notetaker is a third-party integration that does not, and it now holds a recording. A browser-resident assistant gets enabled company-wide and reads a chart open in a tab, the carve-out most likely to stay invisible because nobody experiences a sidebar as a separate vendor. An ops lead wires up a connector to a shared drive, and the index it builds is a fresh copy of PHI outside the covered service.
None of these requires anybody to break a rule. They require a default to be left on. The detection layer that catches them, and its limits, is the subject of what data-loss prevention can and cannot see in an assistant.
Four decisions, not eighteen identifiers
Nobody applies an eighteen-item checklist under deadline. What a trained person can do is sort what is in front of them into four buckets.
| What you are holding | What is permissible | The failure to name |
|---|---|---|
| No PHI. A template, a payer policy, a general clinical question | Any sanctioned assistant on a company account | Generic-looking material carrying a case detail you stopped noticing |
| PHI, covered tool available. A claim, chart note, appeal, patient email | The covered configuration, company account, minimum necessary | Right product, personal login. Or right product, uncovered surface |
| PHI, no covered tool for this job | De-identify properly, or work without an assistant | “I removed the name,” which is not de-identification |
| Never. Re-identification, PHI in a consumer account, PHI fed to training | Nothing. No approval route exists | Treating this row as a judgment call |
Two notes make it usable. Minimum necessary applies inside the covered tool as well as outside it, so pasting a full chart to ask about one medication is a problem even on a compliant configuration. And the third row is worth rehearsing, because properly de-identified information is no longer PHI and needs no BAA, which makes it the escape hatch most teams either never learn or badly misuse.
The statute HIPAA does not preempt
The live legal risk on AI documentation right now is not a HIPAA claim.
On 8 April 2026, patients filed a proposed class action in federal court against two large provider organizations, alleging that an ambient documentation tool recorded and processed their consultations without informed consent. The claims are pleaded under state all-party-consent recording law, which HIPAA does not preempt. The vendor signs BAAs. The BAA was never the exposure.
This deserves a slide in any session you run, because it inverts the model your staff arrive with. HIPAA governs how the resulting information is protected. State recording law governs whether you could capture the conversation at all. Some states let a participant supply the required consent; others require every party to agree first. Announcing what the tool does and noting the answer in the record costs nothing.
What your risk analysis has to say
The Security Rule obligation OCR enforces most often is the risk analysis requirement at 45 CFR 164.308(a)(1)(ii)(A). It is cited in settlement after settlement, and in 2026 OCR’s initiative on risk analysis was extended to cover risk management too.
Concretely: every assistant with access to PHI has to appear in your risk analysis as a named system. An inventory that lists “ChatGPT” is not an inventory. One that lists the product, the tier, the configuration activated, who activated it, which connectors are on and what the logs capture is the artifact an investigator wants. The logging side is covered in the practical choices for logging and auditing company AI use.
One clarification, because the trade press has muddied it. The proposed overhaul of the Security Rule, published in the Federal Register on 6 January 2025, would make asset inventories, encryption and multi-factor authentication mandatory rather than addressable, and its preamble speaks to AI directly. It remains a proposal: no final rule had issued as of October 2026, the regulatory agenda now points at 2027, and industry groups have asked for withdrawal. Plan for the direction of travel; do not tell your board a compliance date exists.
The constraint is judgment
The best evidence that this is a capability problem rather than a procurement problem is the largest study of AI documentation tools published so far.
In JAMA on 1 April 2026, researchers reported on 8,581 ambulatory clinicians across five academic health systems. Adopters of AI-powered scribes recorded 16.0 fewer minutes of documentation time per eight scheduled patient hours, a 10.0% relative reduction, plus roughly half an additional visit per week.
The number that should decide your budget is a different one. Only about 32% of adopters used the tool in at least half their visits, and the heaviest users captured the largest gains. The contract was signed, the license was paid, the tool demonstrably worked, and two thirds of the people holding it used it sporadically. That is the argument behind why buying licenses is not the same as building capability.
The same gap explains the compliance exposure. A policy plus an attestation checkbox produces a clean record and no change in behavior, which we take apart in the distance between what a policy says and what a team does. What works is practice on your own material: eight people, real documents from their own desks, ten of them deliberately borderline, sorting each into the four buckets out loud. Ambiguous cases surface while your rules are still editable, and the decision becomes one they have made before.
What the three layers cost
Three lines, none of them substitutes. Market ranges, not quotes.
Configuration. Usually zero beyond the license you hold. Accepting the BAA and activating the covered configuration is an administrative action, costing an afternoon of your administrator’s attention plus the discipline to record what was switched on and when.
Counsel. A few hours, scoped narrowly: your status as covered entity or business associate, your recording-consent exposure, and your subcontractor chain.
Facilitated practice. Hands-on AI enablement sessions sit in a $2,000 to $15,000 market range depending on headcount and scope. Most budgets omit this line, and it is the only one that touches what people do rather than what they signed.
For an outside read on which of the three you are missing, book a free AI-readiness call. We run hands-on fluency sessions against a team’s own documents and daily work, and we will say when an afternoon in your admin console and two hours of counsel time is the right answer.
Frequently asked questions
Is ChatGPT HIPAA compliant?
Not as most people use it. OpenAI’s HIPAA-eligibility article lists ChatGPT for Healthcare, ChatGPT for Enterprise with a Regulated Workspace, clinician and FedRAMP variants, and API endpoints with modified or zero retention. HIPAA Journal’s October 2026 update reports no BAA for Free, Plus, Team or plain Enterprise. The product name tells you nothing; the configuration does.
Does signing a BAA make our AI use compliant?
No, and Microsoft answers that question on its own compliance page with that single word. A BAA sets what the vendor may do with PHI. It does not perform your risk analysis, configure your tenant, restrict what staff paste, or train anyone.
Can staff use a consumer AI account if they remove the patient’s name?
Almost never, because removing a name is not de-identification. Safe Harbor at 45 CFR 164.514(b)(2) requires all eighteen identifier categories gone, for the individual and for relatives, employers and household members, plus no actual knowledge that the remainder still identifies the person.
Which parts of an AI assistant does a BAA usually not cover?
In-browser assistants and extensions, third-party connectors, marketplace add-ons, web-fetch and web-search features, cloud-run or batch surfaces, and the consumer app sharing the brand name. Compare your vendor’s current exclusion list against what is switched on in your tenant.
Do we need patient consent to use an ambient AI scribe?
HIPAA generally treats clinical documentation as a permitted treatment activity and requires no separate authorization. State recording law is a different statute, and HIPAA does not preempt it. Some states permit a participant to consent on the conversation’s behalf; others require every party to agree first. Announce the tool, capture the answer, take the state question to counsel.
We are not a healthcare company. Does any of this apply to us?
Possibly. A self-funded employer group health plan is itself a covered entity, and OCR brought its first enforcement action against one in April 2026 and a second in June. Separately, any vendor processing PHI for a provider or plan is a business associate too.
What does an AI assistant need to look like in our risk analysis?
A named system with its tier and activated configuration, the date and owner of that activation, its retention terms, its enabled integrations, and what its logs capture. Risk analysis under 45 CFR 164.308(a)(1)(ii)(A) is the failure OCR cites most.
Does the proposed HIPAA Security Rule update change our AI obligations?
Not yet, and be careful how you brief it. The 6 January 2025 proposal would make asset inventories, encryption and multi-factor authentication mandatory rather than addressable, but no final rule had issued as of October 2026 and the agenda now points at 2027. Build the inventory because it is right today, not because a deadline exists.
Should we just ban AI assistants instead?
A ban without a sanctioned alternative produces quiet non-compliance, which is worse than governed use because you lose visibility as well as control. Approve one covered configuration per real use case, make the exception route fast and visible, and teach the four buckets. Survey work in 2026 found a substantial share of healthcare staff had already met unauthorized tools at work.
Key takeaways
- A BAA governs your vendor, not your staff. Microsoft says so in one word on its own compliance page.
- Coverage attaches to a configuration, not a product. Plain Enterprise is not covered where Enterprise with a Regulated Workspace is, and Anthropic’s HIPAA-ready organization counts only once an owner activates it.
- The recurring carve-outs are browser assistants, third-party connectors, marketplace add-ons, web-fetch features and consumer companion apps. They predict the real failures, including a notetaker bot joining a telehealth call.
- The failing seats are non-clinical: front desk, billing, prior authorization, marketing, and HR at an employer whose self-funded plan is itself a covered entity.
- Teach four buckets, not eighteen identifiers. Removing a name is not de-identification, because Safe Harbor also requires no actual knowledge that the remainder identifies the person.
- Solve for the statute you are exposed to. The April 2026 ambient-documentation class action is pleaded under state recording law, which HIPAA does not preempt.
- The binding constraint is judgment. Among 8,581 clinicians in JAMA’s study, only about 32% of adopters used the tool in half their visits.
Dirk Jan van Veen, PhD
