No AI tool is HIPAA compliant on its own.
HHS does not certify software as HIPAA compliant. Compliance comes from a signed Business Associate Agreement, the safeguards the HIPAA Security Rule requires, and your own policies.
What counts as PHI in intake
A client's name combined with any of:
- an appointment date or time
- a reason for seeking services
- insurance or payment information
- a diagnosis code
Almost every intake conversation is PHI from the first message.
Six commitments in every implementation.
BAA first
Signed before discovery begins, and before any client information reaches our systems.
Minimum necessary
Each workflow collects only what the task needs.
Encryption and residency
Encrypted in transit and at rest, configured per practice and per state.
Role-based access
Limited to named roles, and removed when people change roles.
Human in the loop
Every clinical decision goes to a person on your team.
Regulation review
Reviewed against the HIPAA Security Rule and your state rules.
The rules general AI vendors miss.
BHSAI was founded by a licensed professional counselor, so these are part of discovery, not an afterthought.
Psychotherapy notes
Extra protection under HIPAA. Our intake AI has no access to them.
42 CFR Part 2
We identify whether Part 2 applies during discovery. For substance use programs →
State confidentiality laws
Each implementation is reviewed against the states where you practice.
Tracking on intake pages
Intake flows should not carry advertising pixels.
Three questions to ask any AI vendor.
- Will you sign a Business Associate Agreement before we share any client data?
- Who in your organization can see the content of our intake conversations?
- Is our data used to train AI models or improve your product?
Ask us these too. We answer in writing.
Red flags
“We don't handle PHI directly,” from a product that clearly touches client names and appointments.
A claimed “HIPAA certification.”
No named security contact for covered entities.
“Our legal team will sort the BAA out later.”
HIPAA and AI, answered.
Will BHSAI sign a Business Associate Agreement? +
Is client information used to train AI models? +
Is BHSAI SOC 2 certified? +
Our EHR vendor has a BAA. Does that cover an AI tool connected to it? +
This page is general information about HIPAA and AI, not legal advice. Talk to your compliance officer or healthcare attorney about your practice's specific obligations.
Keep exploring.
Start with the BAA. Then we talk about AI.
Request our BAA, or book a 30-minute call.