HIPAA-compliant AI for clinical work: what a BAA chain actually requires

How Pogosh itself handles PHI, the BAA chain, retention and subcontractors: HIPAA, BAA and security at Pogosh CDS.

Clinicians are already pasting clinical text into AI tools, because the cognitive load of documentation and decision-making is real and the tools help. The compliance question is usually asked as "is this tool HIPAA compliant?" That question has no good answer. The useful question is: who handles the protected health information, at each hop, and is each hop covered by the right agreement?

Start with the definitions

Under HIPAA, a covered entity is a health plan, a health care clearinghouse, or a health care provider who transmits health information electronically in connection with a covered transaction.^[1] A business associate is a person or organization that creates, receives, maintains or transmits protected health information on a covered entity's behalf, other than a member of its workforce. The definition expressly includes a subcontractor that creates, receives, maintains or transmits PHI on behalf of a business associate.^[1]

That last clause is what makes it a chain. An AI vendor working for a practice is a business associate. The cloud that vendor runs on, and the model provider it calls, are subcontractors, and they are business associates too.

One agreement per hop

The Privacy Rule lets a covered entity disclose PHI to a business associate if it obtains satisfactory assurance that the business associate will safeguard it. A business associate may in turn disclose PHI to a subcontractor if it obtains the same kind of assurances from the subcontractor. A covered entity is not required to obtain those assurances from its business associate's subcontractors directly.^[2] The Security Rule says the same for electronic PHI and requires the assurances to be documented in a written contract.^[3]

In plain terms: each link signs with the next link down. The practice signs with its vendor. The vendor signs with its cloud provider and its model provider. The practice does not sign with the model provider, but it should know the model provider is covered.

What the contract has to say

A business associate agreement is not a formality with a logo on it. The regulation lists what it must contain.^[4] Among the required terms, the business associate must:

• use or disclose PHI only as the contract permits or the law requires;
• use appropriate safeguards and comply with the Security Rule for electronic PHI;
• report uses or disclosures not provided for by the contract, including breaches of unsecured PHI;
• ensure its subcontractors agree to the same restrictions and conditions;
• make PHI available for the patient's rights of access, amendment and accounting of disclosures;
• make its internal practices, books and records available to the Secretary of HHS;
• return or destroy PHI at the end of the contract, if feasible.

The contract must also let the covered entity terminate it for a material violation, and the same requirements apply to the contract between a business associate and its subcontractor.^[4] A business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 calendar days after discovery.^[5]

Encryption does not remove the need for a BAA

HHS guidance on cloud computing is direct: a cloud service provider that creates, receives, maintains or transmits electronic PHI is a business associate even if it stores only encrypted data and lacks the key.^[6] On AWS, customers accept the AWS BAA through AWS Artifact and should process, store and transmit PHI only in HIPAA-eligible services.^[7]

The model provider is a hop too

Calling a large language model with PHI makes the model provider a subcontractor. OpenAI, for example, states that an organization must enter into a BAA with OpenAI before using the API with PHI, and that it does not offer a BAA for ChatGPT Business.^[8] Its API documentation says API data is not used for training by default, that abuse-monitoring logs are retained for up to 30 days by default, and that zero data retention is available, subject to approval, for eligible endpoints.^[9] OpenAI's own FAQ adds the point that applies to every vendor: accepting a BAA does not by itself make an application HIPAA compliant.^[8]

The practical consequence is that a consumer chat tool with no BAA is not a place for identifiable patient data, however good the answers are.

De-identification is the other door

Health information that has been properly de-identified is not PHI. The regulation allows two methods: an expert determination that the risk of re-identification is very small, or the safe harbor method, which removes 18 categories of identifiers and requires that the covered entity have no actual knowledge that the remaining information could identify the person.^[10] The 18 include names, geographic units smaller than a state (with a narrow exception for the first three ZIP digits of areas over 20,000 people), all elements of dates except the year, ages over 89, contact numbers and addresses, record and account numbers, device identifiers, URLs, IP addresses, biometrics, full-face photos, and any other unique identifying number or code.^[10]

Clinical notes are hard to de-identify reliably by hand, because identifiers hide in free text. If a workflow depends on de-identification, treat it as a process to design and test, not a box to tick.

There is no HIPAA certificate

HHS says there is no standard that requires a covered entity to certify Security Rule compliance, and that it does not endorse or recognize private organizations' certifications.^[11] "HIPAA compliant" describes how a deployment is run, not a property a product can carry. Be wary of any vendor whose answer to the BAA question is a badge.

How the Pogosh chain is built

Here is our own chain, so you can check it against the rules above.

1. Your organization and GigHz LLC. For PHI workflows, the practice or EHR vendor signs a BAA with GigHz LLC, which operates Pogosh CDS. No PHI flows before that agreement is signed; integrations start on synthetic or de-identified data.
2. GigHz and AWS. The PHI-capable Pogosh API runs on AWS under the AWS BAA, using AWS services listed as HIPAA-eligible.
3. GigHz and OpenAI. Model calls go to the OpenAI API under a BAA with OpenAI, configured for zero data retention.

The free page at pogosh.com/try is not part of that chain. It is for notes without patient identifiers, and it says so.

Questions to ask any AI vendor

• Will you sign a BAA with us, and who signs it?
• Which subcontractors handle PHI (cloud, model provider, logging, email), and does each have a BAA with you?
• Is any PHI retained, where, and for how long? Is it used for training?
• Which of your services is the PHI-capable one, and which are not?
• How do you report a breach, and how fast?

The answers will tell you more than any compliance badge.