Reference · Healthcare

The HIPAA Security Rule and AI Workloads, Explained

45 CFR Part 164, Subpart C, with the minimum necessary standard and the Breach Notification Rule

Last reviewed October 11, 2026

At a glance

AI-specific rule: None. The safeguards cover all electronic PHI, whatever system handles it.
Rule: 45 CFR Part 164, Subpart C, Security Standards for the Protection of Electronic Protected Health Information
Applies to: Covered entities and business associates, including subcontractors
Compliance date: 20 April 2005; 20 April 2006 for small health plans
Documentation: Kept 6 years from creation or the date last in effect, whichever is later
Proposed update: Published 6 January 2025; listed for final action in July 2027 as a long-term action. The current rule remains in effect.
Official text: 45 CFR Part 164, Subpart C (eCFR)

The HIPAA Security Rule has no AI provision. It requires covered entities and business associates to ensure the confidentiality, integrity and availability of all electronic protected health information they create, receive, maintain or transmit.45 CFR 164.306 · (a)(1) An assistant that reads a chart, drafts a patient message or summarizes a prior authorization packet handles that information, so the same safeguards apply to it.

HHS has said so directly. Its January 2025 proposal to update the rule states that ePHI in AI training data, prediction models and algorithm data maintained for covered functions is protected by the HIPAA Rules, and that it expects a regulated entity using AI to include those tools in its risk analysis.Security Rule NPRM · 90 FR 990

Where the same AI informs patient care in a health program that receives HHS financial assistance, HHS's nondiscrimination rule adds Section 1557 decision support tool duties: identifying the tools that use protected-class inputs and mitigating the risk of discrimination from each.

An AI vendor that handles PHI is a business associate

HHS lists a third-party AI chatbot on a provider's patient portal, providing services that involve patients' PHI, as an example of a business associate.HHS guidance A covered entity may disclose PHI to a business associate only after obtaining satisfactory assurance, in a business associate agreement, that it will safeguard the information.45 CFR 164.502 · (e)(1)45 CFR 164.308 · (b)(1)

The agreement has to make the business associate ensure that any subcontractor handling ePHI agrees to the same requirements, and report security incidents it becomes aware of, including breaches of unsecured PHI.45 CFR 164.314 · (a)(2)(i) A model provider that receives the PHI from the AI vendor stands in that subcontractor position. Since the 2013 Omnibus Rule, business associates are directly liable for Security Rule violations, with compliance required from 23 September 2013.Omnibus Rule

The same test reaches an AI-enabled medical device whose features send patient data to the manufacturer's cloud. That case is covered in patient data an AI device sends off-site.

Risk analysis comes first, and AI tools belong in it

The risk analysis is a required implementation specification: an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI, followed by security measures that reduce them to a reasonable and appropriate level.45 CFR 164.308 · (a)(1)(ii)(A), (B)

For AI, HHS has named what the analysis must consider, among other things: the type and amount of ePHI the AI tool accesses, to whom the data is disclosed, and to whom the output is provided.Security Rule NPRM · 90 FR 990 to 991 The proposal would also list AI software that touches ePHI, including software trained on it, in a written technology asset inventory.Security Rule NPRM · 90 FR 990

OCR runs a Risk Analysis Initiative around this specification. Its June 2026 settlement with a health plan was the initiative's 14th enforcement action.HHS OCR

The safeguards apply to the AI request path

The rule names information systems, and an AI workflow is one. The specifications that do most of the work:

Access control: access only for persons or software programs granted access rights. Encryption and decryption is addressable.45 CFR 164.312 · (a)(1), (a)(2)(iv)
Audit controls: hardware, software or procedural mechanisms that record and examine activity in information systems that contain or use ePHI.45 CFR 164.312 · (b)
Integrity: protection of ePHI from improper alteration or destruction.45 CFR 164.312 · (c)(1)
Person or entity authentication: verify that a person or entity seeking access is the one claimed.45 CFR 164.312 · (d)
Transmission security: guard against unauthorized access to ePHI transmitted over an electronic communications network.45 CFR 164.312 · (e)(1)
Information system activity review, security awareness and training for the whole workforce, and security incident procedures.45 CFR 164.308 · (a)(1)(ii)(D), (a)(5), (a)(6)
Policies, procedures and required documentation kept for six years from creation or the date last in effect, whichever is later.45 CFR 164.316 · (b)(2)(i)

Minimum necessary limits what goes into a prompt, with listed exceptions

When a covered entity or business associate uses or discloses PHI, or requests it, it must make reasonable efforts to limit it to the minimum necessary for the purpose.45 CFR 164.502 · (b)(1) The standard does not apply to six listed cases, the first being disclosures to or requests by a health care provider for treatment.45 CFR 164.502 · (b)(2)

Uses inside the organization stay under role-based access policies that identify who needs which categories of PHI.45 CFR 164.514 · (d)(2) An AI vendor receiving PHI as a business associate is not on the exception list, so routine disclosures to it need a protocol that limits them to what the task requires.45 CFR 164.514 · (d)(3)

PHI sent to an unapproved AI service is presumed a breach

A use or disclosure the Privacy Rule does not permit is presumed to be a breach unless the covered entity or business associate shows a low probability that the PHI has been compromised.45 CFR 164.402 · Breach (2) The showing rests on a risk assessment of at least four factors: the nature and extent of the PHI, including the identifiers and the likelihood of re-identification; who used or received it; whether it was actually acquired or viewed; and how far the risk has been mitigated. The presumption and the four factors date from the 2013 Omnibus Rule.Omnibus Rule

Notice to individuals goes out without unreasonable delay and no later than 60 calendar days after discovery.45 CFR 164.404 · (b) A business associate notifies the covered entity on the same timeline.45 CFR 164.410 · (b) PHI pasted into an AI service that has no business associate agreement is the AI case the procedure has to be ready for.

The 2025 proposal would make every safeguard required, and it is still a proposal

HHS published a proposal to strengthen the Security Rule on 6 January 2025, and comments closed on 7 March 2025.Security Rule NPRM It would make all implementation specifications required with limited exceptions, require encryption of ePHI at rest and in transit, require multi-factor authentication, and set fixed intervals for inventories, testing and business associate verification.HHS fact sheet

The 2026 Unified Agenda lists the rule as a long-term action with final action in July 2027.Unified Agenda No final rule or withdrawal has been published, and HHS states that the current Security Rule remains in effect while the rulemaking continues.HHS

Before and after

What the January 2025 proposal would change

Current ruleProposed

Encryption of ePHI: Addressable; →; Required, at rest and in transit
Implementation specifications: Required or addressable; →; All required
Multi-factor authentication: Not specified; →; Required
Technology asset inventory and network map: Not specified; →; Written, every 12 months
Vulnerability scanning: Not specified; →; Every 6 months
Penetration testing: Not specified; →; Every 12 months
Business associate safeguards: Contract assurances; →; Verified in writing every 12 months

Proposed changes from the HHS fact sheet on the Security Rule NPRM; current values from 45 CFR 164.308 and 164.312. Encryption and the asset inventory are highlighted because they reach AI tools most directly. Exceptions are omitted. None of this applies until a final rule takes effect.

Control mapping

What a reviewer expects to be able to see.

Obligation	What the system must do	Evidence a reviewer expects
Business associates (164.308(b), 164.314(a))	Sign an agreement with every AI vendor that receives PHI, flowing down to subcontractors	The vendors that actually received PHI, matched to signed agreements
Risk analysis (164.308(a)(1)(ii)(A))	Cover each AI tool: the ePHI it accesses, who receives the data, who receives the output	The current analysis naming each AI tool, and the risk management decisions
Audit controls (164.312(b))	Record and examine activity in systems that contain or use ePHI	A tamper-evident record of AI requests and decisions that a reviewer can examine
Minimum necessary (164.502(b), 164.514(d))	Limit routine disclosures to AI vendors to what the task requires	The protocol for each AI workflow and a record of what was withheld or redacted
Transmission security and encryption (164.312(a)(2)(iv), (e)(1))	Protect ePHI in transit and decide on encryption at rest	Encryption on the AI request path and the documented encryption decision
Breach notification (164.402, 164.404)	Assess and notify within 60 days when PHI reaches an unapproved AI service	The incident procedure with an AI pathway, and completed four-factor assessments

Key dates

Timeline, drawn to scale

HIPAA rules that govern AI workloads, and the pending update

In effect as of October 11, 2026The Security Rule, and the proposal to update it

Dates from 45 CFR 164.318 and 164.534, the Breach Notification interim final rule, the Omnibus Rule and the Security Rule NPRM. Status as of October 11, 2026.

14 April 2003Privacy Rule compliance date, including the minimum necessary standard.
20 April 2005Security Rule compliance date for covered entities other than small health plans (20 April 2006 for those).
23 September 2009Breach Notification interim final rule takes effect.
23 September 2013Omnibus Rule compliance date: business associates directly liable under the Security Rule; breach presumption and four-factor assessment.
6 January 2025Security Rule update proposed in the Federal Register.
7 March 2025Comment period on the proposed update closes.
July 2027Final action listed in the 2026 Unified Agenda as a long-term action; agenda dates are targets.

Sources cited

Common gaps

Where AI workflows most often fail a Security Rule review.

A model provider with no business associate agreement. A team switches on an assistant under standard API terms, and PHI reaches a vendor, or its model provider, that never signed one.
A risk analysis that predates the AI program. OCR's first request is the risk analysis. One that does not name the ambient documentation tool or the patient messaging assistant, the ePHI each one reads and who receives the output, is incomplete on its face.
Minimum necessary written as policy and never applied. The policy says limit PHI and the prompt carries the whole chart. Without a redaction or selection step on the request path, the standard is asserted and never operated.
An audit trail that cannot be examined. Vendor logs, screenshots and exports read as reconstruction. Audit controls call for a mechanism that records and examines activity.45 CFR 164.312 · (b)
Breach procedures with no AI pathway. PHI reaching an unapproved AI service is presumed a breach until the four-factor assessment says otherwise. Procedures that never contemplated it stall at the first question.

In practice

How Meilynx maps to the Security Rule →

Last reviewed October 11, 2026. This reference summarises publicly available regulatory guidance and is provided for general information. It is not legal advice. Obligations depend on an institution's charter, registration status, size, and activities. Verify against the primary sources cited above and consult counsel before relying on any summary here.