Compliance
HIPAA and AI tools: PHI, BAAs with AI vendors and Safe Harbor de-identification
Short answer
Under HIPAA, an AI vendor that receives protected health information on your behalf is a business associate, so you need a BAA before PHI goes in. The minimum necessary rule still applies. Masking the 18 Safe Harbor identifiers before a prompt leaves reduces what the vendor sees, but it's a safeguard, not a substitute for a BAA.
A nurse coordinator at 6:15 in the morning wants a discharge summary rewritten in plain language. It has the patient's name, date of birth, medical record number MRN-4567889, a phone number and a portal link. Pasting it into a chatbot takes two seconds. Under HIPAA, it's a disclosure of protected health information, and whether that's allowed depends on paperwork that was either signed months ago or wasn't.
This page covers what the HIPAA Privacy and Security Rules expect when covered entities and business associates use AI tools, how Safe Harbor de-identification works, and what a masking layer like Maskflare can and can't do. It reflects HHS guidance as of October 2026.
When is an AI vendor a business associate?
When it creates, receives, maintains or transmits PHI on behalf of a covered entity or another business associate. An LLM API that receives a prompt containing a patient's name and diagnosis does exactly that. HIPAA then requires a business associate agreement (45 CFR 164.502(e) and 164.504(e)) before PHI goes in. HHS's cloud computing guidance makes the point that a provider is a business associate even if it can't view the data, for example because it's encrypted.
Several large AI providers offer BAAs for some API or enterprise offerings, usually with conditions such as zero data retention or specific endpoints. Consumer chat accounts generally don't come with one. Terms change, so check each provider's current offer and exactly which products it covers before relying on it.
One consequence people miss: a masking layer sees PHI before it masks it. Under the same logic, Maskflare is a business associate too when you route PHI through it. Settle that contractually with us first, or use the on-premises deployment so the unmasked text never leaves your own infrastructure.
What does the minimum necessary rule mean for prompts?
The minimum necessary standard (45 CFR 164.502(b) and 164.514(d)) says uses and disclosures of PHI should be limited to what's reasonably necessary for the purpose. Rewriting a discharge summary in plain language doesn't need the MRN, the phone number or the portal URL. Even with a BAA in place, sending them is hard to justify. Treatment disclosures between providers are exempt, but an AI vendor drafting text isn't a treating provider.
What are the 18 Safe Harbor identifiers?
HIPAA allows two routes to de-identification under 45 CFR 164.514(b): Expert Determination, where a qualified expert certifies the re-identification risk is very small, and Safe Harbor, where you remove 18 types of identifiers of the individual and of relatives, employers and household members, and have no actual knowledge that what remains could identify someone. Data de-identified that way is no longer PHI. The 18 are: names; geographic subdivisions smaller than a state (with a limited ZIP code exception); all elements of dates except the year, and ages over 89; phone numbers; fax numbers; email addresses; Social Security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate and license numbers; vehicle identifiers including license plates; device identifiers and serial numbers; URLs; IP addresses; biometric identifiers; full-face photographs; and any other unique identifying number or code.
How does the Maskflare HIPAA Safe Harbor profile work?
The HIPAA Safe Harbor profile turns on the healthcare, US, global, person-name and credentials packs in one change, routed through your approval flow. The coverage report then reads your live policy against the 18 identifiers (A to R) and shows each one as covered, partial, not covered or out of scope, exportable as CSV or PDF for your risk analysis. We'd rather you see the gaps on this page than discover them in an audit:
| Identifier | What Maskflare detects | Honest limit |
|---|---|---|
| A. Names | Person names from word lists and context, plus a local named-entity layer | Test unusual names and spellings on your own data |
| B. Geography | ZIP codes after a state, street addresses, PO boxes, US cities and counties; ZIP generalized to three digits | Unusual place names: test on your own notes |
| C. Dates | Birth, admission, discharge, procedure and other clinical dates, generalized to the year; ages over 89 shown as 90+ | Dates with no clinical context nearby can pass |
| D, F, G, J, O | Phone numbers, email addresses, SSNs, account and card numbers, IP addresses | None noted |
| E. Fax | Fax numbers | Needs a fax keyword just before the number |
| H. Medical record numbers | The value right after a record-number keyword | An MRN with no label nearby can pass |
| I. Health plan numbers | Member IDs after a keyword, Medicare MBIs | Unlabeled member IDs can pass |
| K. Certificate and license numbers | License numbers after a keyword, DEA numbers, US driver's licenses by state | Unlabeled license numbers can pass |
| L. Vehicle identifiers | VINs and license plates | Plates are matched next to plate or vehicle context |
| M. Device identifiers | IMEIs, MAC addresses, UDIs and device serial numbers | Serial numbers need device context nearby |
| N. URLs | URLs with record IDs, emails, names or social profiles in them | The opt-in strict pack masks every URL, including portal links with opaque IDs |
| P. Biometrics, Q. Photos | Not text | Out of scope for text masking. The file gate can block or scan images |
| R. Other unique numbers | NPIs, passports, ITINs, encounter, accession, claim and account numbers | Your own patient or case IDs need custom rules or Exact Data Match |
Read that table as your test plan, not a guarantee. Safe Harbor needs all 18 identifiers removed and no actual knowledge that the rest could identify the patient, and context such as a rare diagnosis in a small town can still point to one person. If you want the provider's copy to be de-identified data rather than PHI, you need Safe Harbor's full list or an expert determination, and you need to test it on your real documents. Most teams use masking to reduce what the vendor sees and keep the BAA anyway.
HIPAA requirements, what Maskflare does, and what stays your job
| Requirement | What Maskflare does | What stays your job |
|---|---|---|
| BAA with each vendor that handles PHI | Reduces the PHI each vendor receives | Sign BAAs with the AI provider and with Maskflare, or deploy on-premises |
| Minimum necessary (164.502(b)) | Masks identifiers by default, restores them in the answer | Define what each workflow genuinely needs |
| De-identification (164.514(b)) | Coverage report against the 18 identifiers | Close the gaps, test on real documents, or use Expert Determination |
| Security Rule risk analysis (164.308) | Coverage export, audit export up to 366 days, no prompt logging | Run and document the risk analysis |
| Access controls and audit (164.312) | Roles (owner, admin, security, developer, auditor), signed webhooks, single sign-on | Assign and review access |
| Uploads and images | Text files masked, documents scanned in a sandbox, image metadata stripped | Decide which file types clinicians may upload at all |
| Breach notification | Fail-closed desktop agent reduces unprotected paths | Run your breach process if PHI reaches an AI tool without a BAA |
A practical checklist for healthcare teams
- List every AI tool in use, including clinicians' browser use. Assume shadow AI exists until you've measured it.
- Confirm a BAA for every AI product that may receive PHI, and check exactly which endpoints it covers.
- Route AI traffic through a masking layer and apply the HIPAA Safe Harbor profile.
- Add custom rules for your MRN, encounter and portal URL formats, and load patient identifiers into Exact Data Match.
- Read the coverage report and decide, item by item, how you'll handle the partial ones, dates first.
- Keep audio out of scope or out of the workflow: in voice sessions, text events are masked but audio isn't.
- Document all of it in your Security Rule risk analysis.
What's still changing
HHS proposed a major update to the HIPAA Security Rule in January 2025. As of October 2026 it hasn't been finalized, and the current rule remains in force. State laws on health data and AI are also moving. There's no such thing as HIPAA certification, and Maskflare's SOC 2 Type II and ISO 27001 audits are in progress. Treat it as one technical safeguard in your program, not the program.
Frequently asked questions
Can we use ChatGPT with patient data?
Only with a BAA covering the specific product you use, and even then within the minimum necessary rule. Consumer accounts generally don't come with a BAA. Masking identifiers first reduces what the vendor receives either way.
If we mask PHI, do we still need a BAA with the AI vendor?
Usually, yes. Masking makes data de-identified under Safe Harbor only if all 18 identifiers are removed and you have no actual knowledge it could identify someone. Text masking doesn't catch every date or free-text detail, so most teams keep the BAA and use masking to reduce exposure.
Is Maskflare a business associate?
If you route PHI through it, it handles PHI before masking, so treat it as one and settle the contract with us first. The on-premises deployment keeps unmasked text on your own infrastructure.
Does Maskflare detect all 18 Safe Harbor identifiers?
No. It covers most of them fully or partly, and the coverage report shows which. Gaps as of October 2026 include dates other than birth dates, ages over 89, license plates, driver licenses and some device serials. Biometrics and photos aren't text and are out of scope.
Is the new HIPAA Security Rule in effect?
No. The January 2025 proposal had not been finalized as of October 2026. The existing Security Rule still applies.
About the author
Articles on GDPR, the EU AI Act and sector rules, written by the people at Maskflare who answer customers' data protection questions. They're general information, not legal advice; we cite the regulator or the provider's own terms wherever we can.