HIPAA

HIPAA sets national standards in the US for protecting individually identifiable health information, known as PHI. It applies to covered entities such as providers, health plans and clearinghouses, and to business associates, which includes any technology vendor that handles PHI on their behalf. Its Privacy Rule governs permitted uses and disclosures; its Security Rule requires administrative, physical and technical safeguards for electronic PHI.

For AI systems the consequence is that any model, vector store, log or vendor that touches PHI must sit within a HIPAA-aligned boundary. A hosted model provider must sign a Business Associate Agreement and offer a compliant configuration, or the data must be de-identified before it leaves, or the model must be self-hosted. Audit logging of who accessed what, access controls and encryption are expected, not optional.

HIPAA is US-specific. It does not apply to Indian hospitals, which are governed by DPDP and ABDM guidance, but it applies to any vendor building for US healthcare clients. It is also frequently over-claimed: there is no official HIPAA certification, only alignment with its requirements demonstrated through controls and agreements.

• Compliance officer: determines whether the organisation is a business associate and which agreements and safeguards must be in place before any AI processing.
• CISO: the Security Rule's access control, audit and encryption expectations map directly onto how the AI stack must be built and monitored.
• CTO / Head of Engineering: constrains model choice to self-hosted or BAA-backed providers and requires de-identification pipelines where data must leave.
• Founder / CEO: US healthcare clients will require BAAs and evidence of controls before engaging a vendor.

HIPAA exists because health information is uniquely sensitive and, once disclosed, cannot be recalled. It gives patients enforceable expectations and gives providers a clear standard for their vendors. For AI teams it solves the question of what "safe enough" means with clinical data: named safeguards, signed agreements and auditable access. The trade-off is reduced flexibility. Many convenient hosted services are unavailable or need specific configurations, de-identification adds a pipeline stage, and logging must be thorough without itself leaking PHI. Building to HIPAA from the outset is far cheaper than trying to bolt it onto a working prototype.

• A US clinic network deploying a self-hosted model to summarise visit notes with full access logging on every request.
• A telehealth platform de-identifying transcripts before sending them to a hosted model for coding suggestions.
• A health-plan call centre running an AI voice agent that verifies identity before disclosing any claim information.
• A medical-billing SaaS keeping its AI extraction pipeline within a BAA-covered cloud configuration with customer-managed encryption keys.
• An Indian development partner building a clinical assistant for a US provider under a business associate agreement, with the system deployed in the client's environment.

Standard / regulationA US legal standard you align to through controls and agreements. Eazyware builds HIPAA-aligned clinical AI for healthcare clients, usually self-hosted or in the client's own cloud, under Private Agentic AI with the audit and access controls the Security Rule expects.

Eazyware service that covers it: Agentic AI Solutions (self-hosted). Starting prices are on the pricing page.