Reviewed by: Mansoor Ali, Technical Editor, PenPonder | Last Updated: July 2026
HIPAA is one of those regulations most healthcare organisations claim to follow but few fully understand. The basics are simple. The details, especially with AI tools now entering clinical workflows, are where most organisations get it wrong.
This guide covers what HIPAA actually requires, who it applies to, what the penalties look like, and what changed in 2026 with the rise of AI in healthcare.
What Is HIPAA and Who Does It Apply To?
HIPAA — the Health Insurance Portability and Accountability Act, is a US federal law that sets standards for protecting patient health information. It was enacted in 1996 and has been updated several times, most significantly by the HITECH Act in 2009 which strengthened enforcement and extended HIPAA obligations to business associates.
HIPAA applies to two categories of organisations:
Covered Entities: Healthcare providers (hospitals, clinics, doctors, dentists, pharmacies), health plans (insurance companies, HMOs, Medicare, Medicaid), and healthcare clearinghouses (organisations that process health information).
Business Associates: Any organisation or individual that creates, receives, maintains, or transmits Protected Health Information (PHI) on behalf of a covered entity. This includes billing companies, IT vendors, cloud providers, law firms handling patient records, and critically in 2026, AI tools and platforms that process patient data.
If you provide services to a healthcare organisation and your work involves accessing patient data in any form, HIPAA applies to you even if you are not a healthcare company yourself.
What Is Protected Health Information (PHI)?
PHI is any information that can be used to identify an individual and relates to their health condition, healthcare treatment, or payment for healthcare. It includes:
- Names, addresses, birth dates, Social Security numbers
- Medical record numbers, account numbers, certificate numbers
- Phone numbers, email addresses, IP addresses
- Photographs and biometric identifiers
- Dates directly related to an individual (admission date, discharge date, date of birth, date of death)
- Geographic data smaller than a state
- Any other unique identifying number or code
Electronic PHI (ePHI) is PHI stored or transmitted in electronic form. The HIPAA Security Rule specifically governs ePHI and sets the technical, physical, and administrative requirements for protecting it.
De-identified data, data from which all 18 identifying elements have been removed, is not subject to HIPAA restrictions. This matters significantly for AI training and research applications.
The Three HIPAA Rules
1. The Privacy Rule
The Privacy Rule establishes standards for how PHI can be used and disclosed. The core principle is the Minimum Necessary Standard, covered entities may only use or disclose the minimum amount of PHI necessary to accomplish the intended purpose.
The Privacy Rule permits certain uses and disclosures without patient authorisation, treatment, payment, and healthcare operations (TPO). Everything outside TPO generally requires explicit patient authorisation.
Patients have rights under the Privacy Rule: the right to access their own records, the right to request corrections, the right to know who has accessed their information, and the right to restrict certain disclosures.
2. The Security Rule
The Security Rule sets specific requirements for protecting ePHI. It requires three categories of safeguards:
Administrative safeguards — the policies and procedures that govern how your organisation handles ePHI security. This includes conducting regular risk analyses, designating a security officer, training workforce members, and having documented incident response procedures.
Physical safeguards — controls over physical access to systems that contain ePHI. This includes facility access controls, workstation policies, and device and media controls.
Technical safeguards — the technology and policies that protect ePHI and control access to it. This includes access controls, audit controls, integrity controls, and transmission security (encryption).
The Security Rule does not mandate specific technologies. It requires organisations to implement reasonable and appropriate safeguards based on their size, complexity, and risk profile. A 5-person dental practice and a 5,000-person hospital system have the same HIPAA obligations but very different implementations.
3. The Breach Notification Rule
When a breach of unsecured PHI occurs, covered entities must notify affected individuals within 60 days of discovery. If the breach affects 500 or more individuals in a state, media outlets in that state must also be notified. All breaches, regardless of size, must be reported to HHS.
Breaches affecting 500 or more individuals are posted on the HHS “Wall of Shame”, a public list that significantly affects organisational reputation.
The 60-day clock starts from the date the breach is discovered, not when it occurred. Many organisations discover breaches months or years after they happened, the notification obligation runs from discovery.
HIPAA Penalties in 2026
| Violation Category | Minimum Fine | Maximum Fine | Annual Cap |
|---|---|---|---|
| Did not know | $100 per violation | $50,000 per violation | $25,000 |
| Reasonable cause | $1,000 per violation | $50,000 per violation | $100,000 |
| Willful neglect — corrected | $10,000 per violation | $50,000 per violation | $250,000 |
| Willful neglect — not corrected | $50,000 per violation | $50,000 per violation | $1,900,000 |
These fines apply per violation category per year. A single data breach involving thousands of patient records can result in tens of millions in penalties when each record counts as a separate violation.
Criminal penalties also apply for intentional HIPAA violations, up to 10 years imprisonment for violations committed with intent to sell or use PHI for commercial advantage or personal gain.
HHS Office for Civil Rights (OCR) is the primary enforcement body. State attorneys general can also bring HIPAA actions, several have done so actively in recent years.
Business Associate Agreements (BAAs)
A Business Associate Agreement is a legally required contract between a covered entity and any business associate that handles PHI on its behalf. The BAA establishes what the business associate can do with PHI, how they must protect it, and their obligations in the event of a breach.
You cannot use a vendor that handles PHI without a signed BAA. It is not optional. Missing BAAs are one of the most consistently cited HIPAA compliance failures in OCR enforcement actions.
The BAA must cover:
- Permitted uses and disclosures of PHI
- Requirement to implement appropriate safeguards
- Obligation to report breaches
- Subcontractor obligations — if the business associate uses subcontractors that access PHI, those subcontractors must also sign BAAs
- Data return or destruction at contract termination
Major cloud providers, AWS, Azure, GCP, offer HIPAA BAAs, but you must request them. They are not automatic. Using AWS without a BAA for ePHI storage is a HIPAA violation regardless of AWS’s own security posture.
HIPAA and AI in 2026 — The New Compliance Challenge
AI tools are entering healthcare faster than compliance frameworks can keep pace. Clinical documentation tools, diagnostic support systems, patient communication platforms, revenue cycle automation, and scheduling AI all potentially touch PHI, and all trigger HIPAA obligations.
The Core Problem: Assuming AI Tools Are Automatically Compliant
Many healthcare organisations assume that because a vendor markets their product as “HIPAA-ready” or “healthcare-grade,” they have HIPAA coverage. They do not. Marketing language is not a control.
A vendor claiming to be HIPAA-compliant means nothing without:
- A signed BAA between your organisation and the vendor
- Verification of the vendor’s actual technical safeguards
- Clarity on what the vendor does with PHI, including whether it is used to train AI models
- Understanding of the vendor’s subcontractor relationships and whether those subcontractors also have BAAs
Consumer AI Tools and PHI — A Direct Violation
This is the most common HIPAA violation happening in healthcare organisations right now. A clinician or administrator pastes patient information into a consumer AI tool, ChatGPT, Claude, Gemini, to summarise records, draft notes, or answer questions.
Consumer versions of these tools typically do not offer BAAs and often use input data to train their models. Entering PHI into a consumer AI tool without a BAA is a HIPAA violation. Full stop.
Enterprise versions of major AI tools do offer BAAs. OpenAI’s ChatGPT Enterprise, Google Workspace with Gemini for healthcare, and Anthropic’s enterprise offerings all include BAA options. The consumer free and paid tiers generally do not.
The fix: establish a clear policy on which AI tools are approved for use with PHI, require enterprise accounts with BAAs for all approved tools, and train staff on the difference between consumer and enterprise AI tools.
AI Training Data and De-identification
Healthcare organisations increasingly want to use patient data to train or fine-tune AI models. HIPAA permits this under research exceptions or when data is properly de-identified.
The Safe Harbor method requires removing all 18 specified identifiers. The Expert Determination method allows a statistical expert to certify that re-identification risk is very low, this method is often necessary for AI training because removing certain fields (like dates or zip codes) makes data less useful for medical research.
If data is not properly de-identified before being used to train an AI model, the training process itself becomes a HIPAA-regulated activity requiring all the standard safeguards.
AI Hallucinations and Data Integrity
HIPAA requires organisations to ensure the integrity of ePHI, that it is not improperly altered or destroyed. AI systems that hallucinate, confidently stating incorrect information, create a data integrity risk if their outputs are incorporated into medical records without verification.
A clinical AI tool that generates a patient summary containing fabricated details, which is then saved into a medical record, creates a HIPAA data integrity issue in addition to a patient safety issue. AI output verification processes are now a compliance requirement, not just a quality control measure.
HIPAA Compliance Checklist 2026
Administrative requirements:
- Designated HIPAA Security Officer and Privacy Officer
- Written HIPAA policies and procedures documented and accessible
- Risk analysis completed and documented, must be updated when significant changes occur
- Risk management plan addressing identified vulnerabilities
- Workforce training completed, role-specific, annually at minimum
- Sanctions policy for workforce members who violate HIPAA
- Business Associate Agreements executed with all vendors that access PHI
- Incident response procedures documented and tested
- Audit log review process in place
Technical requirements:
- Unique user IDs for all workforce members accessing ePHI
- Automatic logoff on systems containing ePHI
- Encryption of ePHI at rest and in transit
- Audit controls — logs of all access to ePHI systems
- Integrity controls — mechanisms to verify ePHI has not been altered
- Multi-factor authentication on all systems containing ePHI
- Access controls based on minimum necessary principle
- Secure transmission of ePHI — TLS 1.2 or higher
AI-specific requirements in 2026:
- Inventory of all AI tools used in the organization, identify which ones access PHI
- BAAs executed with all AI vendors that access PHI
- Policy distinguishing approved enterprise AI tools from consumer tools for PHI use
- Staff training on which AI tools are permitted for patient data
- Data de-identification process for any PHI used in AI training
- AI output verification process before results enter medical records
- Review of vendor data retention and model training policies
Physical requirements:
- Facility access controls for areas containing ePHI systems
- Workstation use policies — screen locking, clean desk
- Device and media controls — inventory, disposal, and reuse procedures
- Remote access policies for workforce accessing ePHI from outside the facility
Common HIPAA Compliance Failures
Missing or outdated Business Associate Agreements. Staff change vendors without checking BAA status. A BAA signed five years ago may not cover new services the vendor now provides, including AI features added since the original agreement.
Inadequate risk analysis. OCR consistently cites incomplete or outdated risk analyses in enforcement actions. The risk analysis must be updated whenever significant environmental or operational changes occur, including when new technology is adopted.
Insufficient access controls. Former employees retaining system access after departure. Shared login credentials. Administrative accounts used for routine tasks. All are common and all are HIPAA violations.
Unencrypted devices containing ePHI. Laptops, USB drives, and mobile phones containing unencrypted patient data are among the most frequent sources of reportable breaches. Encryption renders a breach of a lost device non-reportable in most cases.
Consumer AI tools used with patient data. As discussed above, the fastest-growing compliance failure category in 2026. Staff using personal or consumer-tier AI tools to process patient information without BAAs.
No tested incident response plan. Having an incident response policy is required. Having one that staff have actually practiced and can execute under pressure is what matters when a breach occurs.
How HIPAA Intersects With Other Regulations
HIPAA does not exist in isolation. Healthcare organisations in 2026 typically need to satisfy multiple overlapping requirements:
GDPR — if your organisation handles health data of EU residents, GDPR applies in addition to HIPAA. GDPR has its own set of requirements, 72-hour breach notification (versus HIPAA’s 60 days), explicit consent requirements, and right to erasure, that do not always align with HIPAA’s framework.
State privacy laws — California, New York, Texas, and many other states have health data privacy laws that go beyond HIPAA in some areas. State laws can impose stricter consent requirements, shorter breach notification timelines, and broader definitions of protected health information.
FDA regulations — AI tools that cross from clinical decision support into autonomous clinical decision-making may qualify as medical devices under FDA jurisdiction. This is a separate regulatory framework from HIPAA and carries its own compliance requirements.
For a broader look at AI compliance frameworks including the EU AI Act requirements affecting healthcare technology, see our 2026 AI Compliance Guide and our breakdown of EU AI Act and GDPR enforcement requirements.
Final Verdict
HIPAA compliance in 2026 is not fundamentally harder than it was five years ago. The core requirements, risk analysis, BAAs, access controls, encryption, breach notification, have not changed significantly.
What has changed is the technology landscape. AI tools are entering clinical workflows faster than compliance teams can vet them. Consumer AI tools are being used by staff without any understanding that entering patient data into them is a HIPAA violation. And AI training data practices are creating new PHI exposure risks that existing compliance frameworks were not designed to address.
The organisations that stay compliant in 2026 are not the ones doing more paperwork. They are the ones who treat compliance as an operational requirement embedded in how technology is selected, deployed, and used, not as an annual audit exercise.
Start with the checklist above. Prioritise your risk analysis, your BAA inventory, and your AI tool policy. Those three things address the majority of active enforcement risk in healthcare organisations right now.
Frequently Asked Questions
Who does HIPAA apply to?
HIPAA applies to covered entities, healthcare providers, health plans, and healthcare clearinghouses, and their business associates. A business associate is any organisation or individual that creates, receives, maintains, or transmits PHI on behalf of a covered entity. This includes IT vendors, billing companies, cloud providers, and AI tool vendors that access patient data.
What are the HIPAA penalties?
Fines range from $100 per violation for unknowing violations to $50,000 per violation for willful neglect, with annual caps up to $1.9 million per violation category. Criminal penalties of up to 10 years imprisonment apply for intentional violations committed for personal gain.
Is ChatGPT HIPAA compliant?
The consumer version of ChatGPT is not HIPAA compliant, OpenAI does not offer a BAA for consumer accounts and may use input data for model training. ChatGPT Enterprise does offer BAA options. The same distinction applies to other major AI tools, consumer tiers generally do not offer BAAs, enterprise tiers generally do. Never enter PHI into a consumer AI tool.
What is a Business Associate Agreement?
A BAA is a legally required contract between a covered entity and any vendor that handles PHI on its behalf. It establishes what the vendor can do with PHI, how they must protect it, and their breach notification obligations. Operating without a BAA where one is required is a HIPAA violation regardless of the vendor’s security posture.
What is the HIPAA Minimum Necessary Standard?
The Minimum Necessary Standard requires that covered entities use, disclose, or request only the minimum PHI necessary to accomplish the intended purpose. For AI systems this means an AI tool should not have access to all patient record fields if its function only requires a subset of that data.
How long do you have to report a HIPAA breach?
Affected individuals must be notified within 60 days of breach discovery. Breaches affecting 500 or more individuals in a state require media notification. All breaches must be reported to HHS. The 60-day clock starts from discovery, not when the breach occurred.
Does HIPAA apply to AI tools?
Yes. Any AI tool that creates, receives, maintains, or transmits PHI on behalf of a covered entity is a business associate and HIPAA applies fully. This includes clinical documentation AI, diagnostic support tools, patient communication platforms, and revenue cycle automation. A BAA is required before using any such tool with patient data.
For compliance requirements outside healthcare, including AI and data protection, see our Compliance Guide.
HIPAA requirements referenced from HHS Office for Civil Rights official guidance and 45 CFR Parts 160 and 164 as of July 2026. Penalty amounts from HHS OCR civil money penalty structure. PenPonder does not provide legal advice. Organisations should consult qualified healthcare counsel for specific compliance questions.
