HIPAA and AI tools

In this lesson you'll

• Explain what counts as protected health information (PHI) when you use AI tools
• Describe when a business associate agreement is needed before an AI tool touches PHI
• Use de-identified or made-up data for practice and testing

Welcome

Welcome to AI in Healthcare Administration from the Enterprise Technology Association (ETA). Healthcare organizations are adopting AI for scheduling, documentation, patient messages and revenue cycle work. Done well, it gives staff time back and helps patients. Done carelessly, it can expose patient information, send wrong information to patients or payers, and treat some patients unfairly. This course assumes you've completed Level 1: Foundations of the ETA Certified AI Empowered Professional.

PHI: broader than you think

Under HIPAA, protected health information is individually identifiable health information held by a covered entity (most providers, health plans and clearinghouses) or its business associates. It isn't only diagnoses. A name plus an appointment date, an account number, a photo or an address tied to care can all be PHI. If you could reasonably identify the patient, treat it as PHI.

Rule 1: PHI only goes into approved tools

A public AI chatbot is not an approved place for PHI. When a vendor creates, receives, keeps or sends PHI for your organization, HIPAA generally requires a business associate agreement (BAA): a contract in which the vendor commits to protect the information. Many AI vendors offer BAAs only on certain business plans and only for certain features.

So before any AI tool touches patient information, your privacy or compliance officer should confirm:

• The tool is approved for PHI, and a BAA is in place where required
• Which features are covered (some add-ons or connectors may not be)
• How data is stored, kept and used, including whether it can be used to train models

Rule 2: minimum necessary

HIPAA's minimum necessary standard asks you to use and share only the PHI needed for the task. Drafting a reminder letter template needs no patient details at all. Summarizing a denial needs the claim details, not the patient's full chart.

Rule 3: practice with de-identified or made-up data

HIPAA describes two ways to de-identify data: removing a list of 18 kinds of identifiers (the Safe Harbor method) or a formal expert determination. Removing just the name is not enough. For practice, testing prompts and building templates, the simplest safe path is made-up data.

Workplace example: a pediatric practice

A billing specialist wanted help writing an appeal and pasted a denial letter into a free AI chatbot, with the child's name, birth date and member ID. The practice manager reported it to the privacy officer as policy required. The fix that followed: the practice's approved AI tool (covered by a BAA) for real work, and a set of made-up sample denials for practice and training.

Try it

Without using any real patient information, ask your approved AI tool:

Create 3 realistic but entirely made-up insurance denial letters for an outpatient physical therapy practice, with fake patient names, fake member IDs and different denial reasons. Label each clearly "SAMPLE: NOT A REAL PATIENT."

Save them as practice material for this course. Then find out from your privacy or compliance officer which AI tools your organization has approved for PHI, and whether a BAA covers them.

Key takeaways

• PHI is any identifiable health information; if a patient could be identified, treat it as PHI.
• PHI goes only into approved tools, with a BAA where required; confirm with privacy or compliance.
• Use the minimum necessary, and practice with made-up data.

Sources

• Guidance on de-identification of PHI (HHS) (opens in a new tab)
• Business associate contracts: sample provisions (HHS) (opens in a new tab)