HIPAA & LLM Usage
Navigate healthcare compliance when using AI and large language models
Healthcare Data Requires Special Protection
If you're in healthcare and want to use LLMs with patient data, Protected Health Information (PHI), or any data covered by HIPAA, you must understand the compliance requirements. Non-compliance can result in fines up to $1.5 million per violation category, per year.
What Is HIPAA?
HIPAA Overview
The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that protects sensitive patient health information from being disclosed without patient consent or knowledge.
Key Components:
What Is Protected Health Information (PHI)?
PHI is any health information that can be linked to a specific individual. This includes obvious identifiers and seemingly innocent data when combined.
18 HIPAA Identifiers (Examples):
Business Associate Agreements (BAA)
What Is a BAA and Why Do You Need One?
A Business Associate Agreement is a legally binding contract between a HIPAA-covered entity (or another business associate) and a vendor who will handle PHI on their behalf.
⚠️ CRITICAL REQUIREMENT
If you send PHI to an LLM provider without a signed BAA, you are in violation of HIPAA. This applies even if you're just testing or using it internally. The BAA must be in place BEFORE any PHI is transmitted.
A BAA Must Include:
- • How PHI can be used and disclosed
- • Safeguards to protect PHI
- • Breach notification requirements
- • Data return or destruction upon termination
- • Subcontractor requirements (if applicable)
Which LLM Vendors Offer BAAs?
Not all LLM providers are willing or able to sign BAAs. Here's the current landscape:
✓ Vendors That Offer BAAs:
Google Cloud (Vertex AI)
Offers BAA for Vertex AI services including PaLM 2, Gemini, and other models. Must be on a paid plan.
AWS (Amazon Bedrock)
Provides BAA for Bedrock services with models from Anthropic, Meta, Cohere, and others.
Microsoft Azure (Azure OpenAI Service)
Offers BAA for Azure OpenAI Service with GPT-4, GPT-3.5, and other OpenAI models hosted on Azure.
Anthropic (Claude for Enterprise)
Offers BAA for enterprise customers. Contact their sales team for details.
❌ Generally Do NOT Offer BAAs (or limited availability):
OpenAI API (Direct)
Standard ChatGPT and OpenAI API do not offer BAAs for most users. Enterprise customers should inquire directly. Use Azure OpenAI Service instead for HIPAA compliance.
Most Free/Consumer LLM Services
ChatGPT Free, Claude.ai, Gemini web interface, etc. are NOT HIPAA-compliant and do not offer BAAs.
Note: This information is accurate as of early 2025, but vendor offerings change. Always verify current BAA availability directly with the vendor before transmitting PHI.
Technical Safeguards for HIPAA Compliance
Encryption in Transit and at Rest
All PHI must be encrypted both when being transmitted and when stored.
Requirements:
Access Controls and Audit Logs
You must be able to control who accesses PHI and maintain audit trails.
Implementation:
- • Implement role-based access control (RBAC) for who can send data to LLMs
- • Log all API calls that involve PHI (timestamp, user, data accessed)
- • Implement unique user identification and authentication
- • Automatic logoff after period of inactivity
- • Regular access reviews and revocation of unnecessary permissions
Data Retention and Destruction
Understand how long the LLM vendor retains your data and ensure proper deletion.
Key Questions to Ask Vendors:
- • Is there a zero-retention option? (Data not stored after processing)
- • How long are API request/response logs retained?
- • Is my data used for model training? (It should NOT be if handling PHI)
- • What happens to data upon contract termination?
- • Can I request deletion of specific data?
De-identification as an Alternative
When De-identified Data Is NOT PHI
If you properly de-identify health information according to HIPAA standards, it's no longer considered PHI and doesn't require a BAA. However, de-identification must be done correctly.
Two Methods for De-identification:
1. Safe Harbor Method
Remove all 18 HIPAA identifiers and have no actual knowledge that remaining information could identify the individual.
2. Expert Determination
Have a qualified statistician or expert certify that the risk of re-identification is very small.
⚠️ Warning About Partial De-identification
Simply removing names or obvious identifiers is NOT sufficient. Data that seems anonymous can often be re-identified through combination with other data. When in doubt, treat data as PHI and get a BAA.
HIPAA Compliance Best Practices
DO: Get BAA BEFORE Testing
Even pilot projects with real PHI require a signed BAA. No exceptions.
DO: Use Enterprise/Cloud Provider Services
Google Cloud, AWS, and Azure all offer HIPAA-compliant LLM services with BAAs
DO: Document Everything
Maintain records of BAAs, security assessments, and compliance procedures
DO: Train Your Staff
Ensure everyone who works with PHI understands HIPAA requirements and approved tools
DO: Conduct Risk Assessments
Regularly assess risks of using LLMs with PHI and implement appropriate safeguards
DO: Enable Zero-Retention Options
When available, configure services to not retain data after processing
DON'T: Use ChatGPT or Consumer LLMs
Free ChatGPT, Claude.ai, and similar consumer services are NOT HIPAA-compliant
DON'T: Assume "Anonymous" Is Enough
Informal de-identification rarely meets HIPAA standards. Get expert guidance.
DON'T: Allow Training on Your Data
Ensure vendor agreements explicitly prohibit using your PHI for model training
DON'T: Skip Legal Review
Have your legal team review BAAs before signing. Templates vary by vendor.
HIPAA-Compliant LLM Use Cases
Clinical Documentation
Generate draft clinical notes, summaries, or documentation from physician dictation or EHR data.
Requires: BAA, access controls, audit logging
Medical Coding Assistance
Extract ICD-10, CPT codes from clinical notes to assist billing departments.
Requires: BAA, verification process for code accuracy
Patient Communication
Draft personalized patient education materials or appointment reminders based on patient history.
Requires: BAA, review before sending to patients
Research & Analytics
Analyze de-identified patient data for population health insights or clinical research.
Requires: Proper de-identification OR BAA if using PHI
Build HIPAA-Compliant AI Solutions
We can help you navigate HIPAA requirements, select compliant vendors, and implement secure AI workflows for healthcare