<h2 id="44d6fd1a-ac6a-482b-8137-b85f9f5a6a18" data-toc-id="44d6fd1a-ac6a-482b-8137-b85f9f5a6a18" style="font-size: 24px; line-height: 1.2;">Intro</h2><p>Healthcare organizations are under pressure to move faster with AI, but speed does not remove responsibility. In healthcare, an AI tool can affect documentation, scheduling, patient communications, analytics, and workflow decisions, which means vendor selection quickly becomes a question of PHI exposure, security, and operational risk, not just product quality. HHS makes clear that when a cloud service provider creates, receives, maintains, or transmits ePHI on behalf of a covered entity or business associate, a HIPAA-compliant business associate agreement is required, and the Security Rule still requires regulated entities to protect ePHI through appropriate safeguards.</p><h2 id="1de0c8ac-d8ff-42e9-ac38-f00908af3bde" data-toc-id="1de0c8ac-d8ff-42e9-ac38-f00908af3bde" style="font-size: 24px; line-height: 1.2;">Start With the Workflow, Not the Demo</h2><p>A practical healthcare review should begin with the task the tool will support. Is the vendor helping draft messages, summarize internal notes, classify documents, support revenue cycle work, or analyze operational data? Those are very different workflows, and they create very different risk profiles. A polished demo can hide the most important question: what information is actually moving through the system, and what decisions or actions might depend on its output? That kind of workflow-first review aligns with HHS guidance that regulated entities need to understand the environment well enough to conduct their own risk analysis and risk management, rather than relying on a vendor’s marketing claims.</p><p>For healthcare leaders, this means mapping the use case before procurement moves too far. Identify the users, the systems touched, the type of data involved, the output produced, and what human review will exist before action is taken. That is not bureaucracy for its own sake. It is the foundation for deciding whether a tool belongs in a low-risk experimentation lane, a governed operational workflow, or nowhere near sensitive data at all. NIST’s AI Risk Management Framework is built around this kind of structured risk thinking, and its core functions emphasize governing, mapping, measuring, and managing AI risks across the lifecycle.</p><h2 id="28fbf597-a641-4509-b15f-ed6e02377493" data-toc-id="28fbf597-a641-4509-b15f-ed6e02377493" style="font-size: 24px; line-height: 1.2;">Determine Whether the Vendor Touches PHI or ePHI</h2><p>The next step is to determine the vendor’s actual role in your environment. If the vendor will create, receive, maintain, or transmit ePHI on your behalf, HHS states that a HIPAA-compliant BAA is required. That point matters because some organizations still treat cloud AI tools as if they are “just software,” when in reality the vendor may be functioning as a business associate depending on the service and the data flow.</p><p>This is where healthcare teams need to get concrete. Will prompts contain PHI? Will outputs contain PHI? Are logs retained? Is data stored temporarily or long term? Does the vendor use subprocessors? Can customer data be isolated? Can the organization retrieve or delete data at the end of the relationship? HHS’s cloud guidance also notes that BAAs should address return or destruction of PHI where feasible at termination, and that storage location and related risks should be considered in risk analysis.</p><h2 id="53ff6f51-6024-4bcb-9cce-29d8562a38c0" data-toc-id="53ff6f51-6024-4bcb-9cce-29d8562a38c0" style="font-size: 24px; line-height: 1.2;">A BAA Is Necessary, Not Sufficient</h2><p>A common mistake is treating the BAA as the finish line. It is important, but it is not the whole review. HHS says covered entities and business associates still need to understand the cloud environment so they can conduct their own risk analysis, establish risk management policies, and ensure other contract terms are consistent with HIPAA obligations. HHS also notes that service level agreements should not block a regulated entity from accessing its own ePHI.</p><p>That has a practical implication for AI procurement. Even with a signed BAA, a healthcare organization still needs to evaluate how the tool fits into identity and access management, auditing, incident handling, retention, business continuity, and change control. The Security Rule requires administrative, physical, and technical safeguards for the confidentiality, integrity, and availability of ePHI, and OCR’s risk analysis guidance describes risk analysis as the foundational first step in that process.</p><p>In other words, a good contract supports governance, but it does not replace governance. That is especially important with AI tools because the model, the deployment architecture, the logging behavior, and the operational workflow may change faster than traditional software. Framed as an inference from HHS and NIST guidance, this is why healthcare teams should review AI vendors as part of an ongoing risk program, not as a one-time paper exercise.</p><h2 id="b6507c2d-a90c-437e-83c5-c6e01905c5ea" data-toc-id="b6507c2d-a90c-437e-83c5-c6e01905c5ea" style="font-size: 24px; line-height: 1.2;">Minimum Necessary Still Matters</h2><p>Healthcare teams should also resist the habit of sending more data than a task requires. HHS says the HIPAA Privacy Rule’s minimum necessary standard generally requires covered entities to take reasonable steps to limit uses, disclosures, and requests for PHI to the minimum necessary for the intended purpose. That standard does not apply in every circumstance, including disclosures to or requests by a provider for treatment, but it remains a critical principle for many operational and administrative workflows.</p><p>In practice, that means a team using AI for scheduling support, policy drafting, FAQ generation, or internal operations should ask whether full patient detail is needed at all. Often, the safer starting point is de-identified, masked, synthetic, or otherwise reduced data when the task allows it. That is not a universal rule from HHS for every use case; it is a practical risk-reduction approach consistent with minimum necessary thinking and risk analysis obligations.</p><h2 id="0b14bbf2-9c40-4756-b6d2-60759e44b057" data-toc-id="0b14bbf2-9c40-4756-b6d2-60759e44b057" style="font-size: 24px; line-height: 1.2;">Ask Better Security and Incident Questions</h2><p>Security review should also go beyond generic checklists. HHS states that business associates must identify and respond to suspected or known security incidents, mitigate harmful effects where practicable, document incidents and outcomes, and report security incidents as required by the BAA. That makes incident handling a live operational issue, not just a contract clause buried in procurement paperwork.</p><p>For AI vendors, better questions usually include: how are access controls enforced, what logging is available, how are outputs monitored, how are changes communicated, what happens if the vendor introduces a new model or subprocessor, and how quickly will customers be notified of relevant incidents? NIST CSF 2.0 and the NIST AI RMF offer a useful structure here because they are designed to help organizations assess, prioritize, and communicate cybersecurity and AI risk without prescribing one exact method for every environment.</p><h2 id="79ffe1f8-ba94-4c41-93b7-876aa8840790" data-toc-id="79ffe1f8-ba94-4c41-93b7-876aa8840790" style="font-size: 24px; line-height: 1.2;">Put AI Vendors Into Ongoing Governance</h2><p>The strongest healthcare AI programs do not stop at approval. They inventory use cases, assign ownership, define review triggers, document approved data uses, and revisit vendors when workflows, integrations, or data exposure change. NIST’s AI RMF playbook explicitly connects AI governance to existing organizational governance and risk controls, including policies for monitoring, auditing, review, and incident response, and says third-party AI systems should be included in formal AI risk management policies.</p><p>That is the bigger shift healthcare teams should make now. Vendor review should not sit in a separate procurement lane disconnected from privacy, security, compliance, operations, and the actual frontline workflow. Responsible AI adoption happens when those groups look at the same use case together and decide what is safe, useful, and supportable in the real environment.</p><h2 id="5e100bf9-932d-4377-9ceb-12b45e0ba732" data-toc-id="5e100bf9-932d-4377-9ceb-12b45e0ba732" style="font-size: 24px; line-height: 1.2;">Conclusion</h2><p>In healthcare, choosing an AI vendor is really about understanding role, data exposure, safeguards, and accountability. The right first question is rarely “How impressive is this tool?” It is usually “What is this vendor doing in our workflow, what data is involved, and what controls do we need before this goes live?” That mindset leads to better rollout decisions, better protection of sensitive information, and more durable trust across compliance, security, operations, and frontline teams.</p><h2 id="74d4615e-52cb-4c03-840f-4e8efe300440" data-toc-id="74d4615e-52cb-4c03-840f-4e8efe300440" style="font-size: 24px; line-height: 1.2;">References</h2><ol><li><p>HHS, “May a HIPAA covered entity or business associate use a cloud service to store or process ePHI?”</p></li><li><p>HHS, “Guidance on HIPAA &amp; Cloud Computing.”</p></li><li><p>HHS, “The Security Rule.”</p></li><li><p>HHS, “Guidance on Risk Analysis.”</p></li><li><p>HHS, “Minimum Necessary Requirement.”</p></li><li><p>NIST, “AI Risk Management Framework.”</p></li><li><p>NIST, “The NIST Cybersecurity Framework (CSF) 2.0.”</p></li></ol>

AI vendor selection in healthcare is a data, compliance, security, and governance decision. Start with workflow, PHI exposure, and operational risk before rollout.

How to Evaluate AI Vendors in Healthcare Before PHI Moves Anywhere

Determine Whether the Vendor Touches PHI or ePHI

Ask Better Security and Incident Questions

Read practical AI safety, HIPAA, PHI, and responsible AI guidance for small clinics and healthcare teams using AI at work.

Healthcare AI Safety Blog for Small Clinics | EquipaWorks

Explore EquipaWorks articles on responsible AI use, PHI protection, HIPAA awareness, and safer healthcare workflows for small teams.

How to Evaluate AI Vendors in Healthcare Before PHI Moves Anywhere

How to Evaluate AI Vendors in Healthcare Before PHI Moves Anywhere

Related Posts

AI Vendors, BAAs, and the Questions Healthcare Teams Should Ask