Business Associate Agreements (BAAs) Explained
HIPAA requires BAAs for vendors accessing Protected Health Information (PHI). Many popular AI tools (ChatGPT, Claude, Google Workspace) now offer HIPAA BAAs on Enterprise plans. Standard terms are insufficient.
HIPAA BAA Requirements
- Written contract between healthcare organization and vendor
- Defines permitted use and disclosure of PHI
- Requires encryption for data in transit and at rest
- Mandates audit logging and access controls
- Includes breach notification obligations
- Allows healthcare organization to audit vendor compliance
- Requires vendor to delete PHI after contract ends
HIPAA-Compliant AI Tools (2026)
ChatGPT Enterprise (OpenAI)
- Offers BAA on Enterprise tier only
- Data not used for training (customer opt-out available)
- Encryption for data in transit and at rest
- Audit logging and SOC 2 Type II compliance
- Cost: $30+/user/month, enterprise contracts
Microsoft Copilot Enterprise (Microsoft)
- BAA available for Copilot Pro/Enterprise tiers
- Integrates with Azure and Microsoft 365
- Encryption, audit logging, access controls included
- Part of existing Microsoft enterprise agreements
AWS HealthLake & AWS AI Services
- Native HIPAA support with BAAs available
- Encryption, compliance certifications, audit trails built-in
- Cost: Pay-per-use, typically higher than consumer AI
- Best for healthcare organizations with existing AWS infrastructure
How to Verify HIPAA Compliance
Vendor Assessment Checklist
- Request BAA template from vendor (available = good sign)
- Verify BAA availability on pricing page or contact sales
- Check for encryption in transit (TLS) and at rest (AES-256)
- Confirm audit logging and access controls documented
- Verify breach notification timeline (typically 30-60 days)
- Confirm PHI deletion guarantees after contract ends
- Review SOC 2 Type II report (confirms security controls)
Implementation Roadmap for Healthcare
HIPAA AI Implementation Steps
- Identify all AI use cases in healthcare organization
- Classify by PHI exposure (high/medium/low)
- For high PHI exposure, require vendor BAA
- Execute BAA before AI system deployment
- Encrypt all PHI before sending to AI vendor
- Implement audit logging for all PHI access
- Document HIPAA compliance in security audit trail
- Train staff on PHI handling requirements
- Annual compliance review and BAA renewal
Common Mistakes to Avoid
- Using standard ChatGPT/Claude without Enterprise BAA for PHI (non-compliant)
- Assuming vendor has BAA without explicit request (always verify)
- Not encrypting PHI before sending to AI tools (legal violation)
- Sharing unminimized PHI with vendors (best practice: share only necessary data)
- Forgetting to renew BAAs annually
Bottom Line
HIPAA compliance for AI is achievable but requires vendor with BAA. No enterprise healthcare AI without BAA. Request BAA explicitly—availability varies by vendor plan. When in doubt, contact vendor legal team.
Back to Compliance Pillar