Catalog

HIPAA Privacy Rule (45 CFR 160, 164 Subpart E)

U.S. Department of Health and Human Services · pack 0.2.2 · verified against the official source as of 2026-09-28.

Binding law — in force

Protected health information may go to an AI vendor only under a business associate contract (HIPAA)

Under 45 CFR 164.502(e) a covered entity may let a business associate create, receive, maintain, or transmit protected health information on its behalf only after obtaining satisfactory assurance, documented in a written contract that meets 164.504(e), that the business associate will safeguard it; a business associate needs the same from its subcontractors. 164.504(e)(2) lists what the contract must say, including permitted uses, no further disclosure, safeguards, breach reporting, flow-down to subcontractors, and return or destruction at termination. An AI model, transcription, or embedding vendor that processes PHI for a covered entity or business associate fits the pattern the definition of business associate describes (160.103). Detect PHI flowing to a model API with no sign of a business associate agreement, a covered endpoint, or de-identification.

us-hipaa-privacy.ai-vendor-business-associate-contract · 45 CFR 164.502(e)(1) · official source · jurisdictions: US

Binding law — in force

Send an AI model only the protected health information the task needs (HIPAA minimum necessary)

45 CFR 164.502(b) requires covered entities and business associates to make reasonable efforts to limit PHI to the minimum necessary for the purpose of a use, disclosure, or request, and 164.514(d) implements it: standard protocols for routine disclosures, case-by-case criteria for others, and no use or disclosure of an entire medical record unless that is specifically justified. The standard does not apply to disclosures to a health care provider for treatment, to the individual, under an authorization, or where required by law (164.502(b)(2)). Detect AI prompts, context, or training sets built by serializing a whole patient record, chart, or FHIR bundle instead of a task-specific field selection.

us-hipaa-privacy.minimum-necessary-phi-to-ai · 45 CFR 164.502(b)(1) · official source · jurisdictions: US