The moment an AI agent reads a chart, checks eligibility, or routes a patient message, it is handling protected health information — and the vendor behind it is a business associate with direct legal liability.
The short answer
An AI vendor touching PHI is a business associate, and business associates are directly liable under HIPAA — HHS notes they are "civilly and criminally liable" for Security Rule violations, a change the HITECH Act introduced.
That means three documents matter more than any marketing claim: the BAA, the subprocessor list, and the audit trail. The first creates the obligations, the second shows how far the data actually travels, and the third is what you will need if anyone ever asks what happened.
Why an AI agent is a business associate
HHS's definition is broad by design. A business associate is a person or entity outside your workforce who performs functions or activities involving access to PHI on your behalf — and the definition explicitly extends to subcontractors that create, receive, maintain, or transmit PHI on behalf of another business associate.
That last part matters more for AI than for most software. A single agent action may traverse:
- The agent vendor (us, or a competitor)
- A model provider running inference
- A cloud host storing data at rest
- Possibly a telephony or fax provider if voice or documents are involved
Each link handling PHI needs an agreement, and HHS requires the business associate to obtain the same assurances from its subcontractors that you obtained from it. Ask for the chain, not just the first link.
The BAA clauses that matter for AI
HHS specifies what a BAA must contain, and those requirements are the floor. Read them first — we listed all ten in our guide to HIPAA certification claims.
What follows are the additions that older templates, written before this technology existed, often fail to address:
| Clause | What to require | Why it is AI-specific |
|---|---|---|
| Model training | Explicit prohibition on using your PHI to train or fine-tune any model | Silence is not permission, but silence is a gap you find out about late |
| Subprocessor list | Named list, with notice before changes | The inference provider may change without any visible change to the product |
| Prompt and log retention | Retention limits covering prompt logs, traces, and vector stores | PHI ends up in debugging infrastructure a retention clause never imagined |
| Human review | Which actions require review before they take effect | Determines whether a bad output becomes a bad outcome |
| Breach clock | Notification to you in hours, not "promptly" | HIPAA requires notice; the contract sets the deadline |
| Deletion scope | Backups, logs, and derived data, not just the primary store | The forgotten copies are usually in the places nobody demoed |
"We don't train on your data" in a sales email is not a contract term. If it matters, it goes in the BAA.
PHI handling: the boundary questions
Three questions determine whether an agent deployment is defensible:
1. Where does PHI physically go? Not the marketing answer — the list of systems and regions. If inference happens at a model provider, PHI left your vendor's infrastructure. That may be perfectly fine, and it needs to be documented rather than discovered.
2. What is the minimum necessary? The Privacy Rule's minimum necessary standard applies to agents exactly as it applies to staff. An agent verifying eligibility needs coverage and demographic data; it does not need the full clinical note. Ask what the agent actually receives.
3. What is redacted, and to whom? Sensitive fields can be masked in operational views while remaining available to authorized debugging. That distinction is worth asking about, because "our support team can see everything" and "our support team sees redacted views" are very different risk profiles.
Audit trails when software did the work
This is where AI genuinely differs from traditional software, and where most vendor answers get thin.
HIPAA's Security Rule requires regulated entities to implement mechanisms to record and examine activity in systems containing ePHI, and to maintain documentation for six years from the later of creation or last effective date. That obligation does not soften because an agent rather than a person performed the action.
An audit trail for agent work needs to answer why, not just what:
- Timestamp — when
- Agent identity and version — who, and which iteration of its logic
- Input — the record, message, or document it acted on
- Action taken — what it did, specifically
- Output — what it produced or changed
- Human reviewer — who approved it, where review applies
- Source citation — what the decision was based on
The version is the part people forget. If you need to reconstruct a decision from eight months ago, knowing "the eligibility agent did it" is useless without knowing which version of the eligibility logic was running. Software changes; the log has to pin the behavior, not just the name.
A practical test for any vendor: ask them to walk you through a single action from six months ago. If they can show the input, the logic version, the output, and who reviewed it, the audit story is real. If they show you a dashboard of aggregate metrics, it is not.
What a good answer looks like
You are not looking for perfection. You are looking for specificity.
| Question | A weak answer | A real answer |
|---|---|---|
| Will you sign a BAA? | "We're HIPAA compliant" | "Yes — here it is, review it with counsel" |
| Do you train on our data? | "Your data is safe with us" | "No, and clause 4.2 prohibits it" |
| Who are your subprocessors? | "We use industry-leading providers" | A named list, with change-notice terms |
| Show me an action from six months ago | A metrics dashboard | Input, version, output, reviewer, timestamp |
| When do you notify us of a breach? | "Promptly" | A number of hours, in the contract |
The pattern: a vendor describing a real system answers with artifacts and clause numbers; a vendor describing an intention answers with adjectives.
Where we stand
As of 7 August 2026: we make a BAA available for customers handling PHI, PHI stays within your tenant, and we do not use customer data to train models. Every agent action is logged with skill version, source citation, timestamp, and operator.
Our SOC 2 audit is in progress and ISO 27001 certification is underway — neither is complete, and we are not going to describe them as though they were. We found our own site overstating the SOC 2 status while researching this cluster and corrected it. Our security page carries the per-framework status your reviewer can act on.
Frequently Asked Questions
Is an AI vendor a business associate under HIPAA?
Yes, if it creates, receives, maintains, or transmits protected health information on behalf of a covered entity. HHS defines a business associate as a person or entity outside your workforce performing functions involving access to PHI, and that definition also covers subcontractors handling PHI on behalf of another business associate. An AI agent reading charts, verifying eligibility, or handling patient messages fits squarely inside it.
What does a BAA need to cover that is specific to AI?
Three things older templates often miss. First, whether PHI may be used to train or fine-tune models, which should generally be prohibited outright. Second, the subprocessor chain, because AI vendors typically route data through model providers and cloud hosts that each need their own agreements. Third, retention inside model and logging infrastructure, since prompt logs and vector stores can hold PHI in places a traditional retention clause never contemplated.
Should PHI ever be used to train an AI model?
Not without explicit contractual permission, and for most practices the answer should simply be no. A business associate may use or disclose PHI only as permitted by its agreement or as required by law, so silence in the contract is not permission — but silence is also a gap you do not want to discover after the fact. Ask for an explicit written prohibition rather than a verbal assurance.
What should an AI agent's audit trail contain?
Enough to reconstruct why the agent did what it did, not just that it did it. That means a timestamp, the identity of the agent and its version, the input it acted on, the specific action taken, the output produced, and the human who reviewed or approved it where applicable. When software rather than a person takes an action on a record, the version of the logic matters as much as the actor, because reconstructing a decision from six months ago requires knowing which version was running.
How long do HIPAA records need to be retained?
HIPAA requires documentation of policies, procedures, and required actions or assessments to be retained for six years from the later of the date it was created or the date it was last in effect. That applies to the compliance documentation itself. Retention of PHI is governed separately by state law and your own record-retention policy, which is why the BAA needs to state what happens to PHI at termination.
Who is liable if an AI agent causes a HIPAA breach?
The business associate is directly liable under HIPAA and can face civil and, in some cases, criminal penalties. The covered entity remains responsible for obtaining satisfactory assurances that its business associates safeguard PHI, so liability is shared rather than transferred. Contracting with a vendor does not move your obligation to them, which is why the diligence has to happen before deployment.
What happens to our PHI when we stop using an AI vendor?
Whatever the BAA says, which is why you should read that clause before signing. HHS's sample provisions require the business associate to return or destroy all PHI at termination where feasible, and to extend protections to anything retained for as long as it is held. Ask specifically about backups, logs, and any derived data, because those are the copies most often overlooked in a deletion request.
What to do next
Get the BAA and read the six AI-specific clauses above against it. Then ask the vendor to reconstruct one action from six months ago.
Those two exercises take an afternoon and will tell you more than a year of trust badges. Our security posture and our guide to HIPAA certification claims cover the rest.
