Skip to main content
Patient Protect circular logo mark in purple and white used for site navigationPatient Protect

Breach analysis · Patient Protect

AI vendor risk and the HIPAA Security Rule: governing the tools your practice didn't know needed a risk assessment

AI tools embedded in EHR platforms and clinical workflows introduce PHI exposure and vendor risk that standard HIPAA Security Rule checklists weren't built to catch — here's how to govern them.

Patient Protect ResearchJune 4, 2026First reported in HIPAA Pulse →

The control gap

Third-party AI tools — embedded in EHR platforms, clinical documentation suites, and patient communication products — now represent one of the fastest-growing categories of unexamined PHI exposure for independent practices. Unlike traditional software integrations, AI systems introduce distinct threat surfaces: training-data retention, inference-time data flows, and model updates that can silently change how a vendor handles your patients' data. The Healthcare and Public Health Sector Coordinating Council's new AI cybersecurity guide makes this explicit, noting that HIPAA's Security Rule was not designed with AI-specific vectors in mind and that provider organizations must build their own governance structures while federal regulators catch up. First reported in HIPAA Pulse →

The core problem for small and mid-sized practices is that AI features often arrive pre-bundled in tools they already use — making adoption frictionless and governance nearly invisible.

The HIPAA Security Rule provision in play

§164.308(a)(1) — Risk Analysis and Risk Management requires covered entities to assess all reasonably anticipated threats to ePHI, across all systems that create, receive, maintain, or transmit it. AI tools that process PHI — even as a secondary function of a billing or scheduling platform — fall squarely within scope. Additionally, §164.308(a)(4) — Information Access Management and §164.314(a) — Business Associate Contracts are implicated wherever a vendor's AI system touches PHI without a contract that specifies data-use terms, training-data handling, and audit rights.

How Patient Protect addresses this

  • Security Risk Assessment (SRA): Patient Protect's SRA workflow is designed to surface all systems touching ePHI — including AI-enabled modules that practices may have activated without a separate risk review. Running or updating your SRA to explicitly include AI tools is the fastest way to close the documentation gap regulators would look for first.
  • BAA Management / Vendor Risk Scanner: Patient Protect's BAA Management feature tracks business associate agreements by vendor, flagging those that lack current, executed agreements. For AI vendors, this is the structural control the HSCC guide calls out directly — BAAs for AI tools must address training-data use and audit rights, not just standard breach notification.
  • Information Systems Inventory: Patient Protect's Information Systems Inventory provides a structured asset register. Logging AI tools here — including EHR-embedded AI features — creates the audit-ready documentation a risk analysis requires.
  • Autonomous Compliance Engine: As vendor data-handling practices change (e.g., a model update that introduces new PHI retention), Patient Protect's Autonomous Compliance Engine recalculates compliance posture continuously, rather than waiting for an annual review cycle to surface drift.
  • Policy Generation: AI governance requires written policies assigning internal accountability for AI tool oversight. Patient Protect's Policy Generation module produces customizable, Security Rule-aligned policies that can be extended to cover AI-specific responsibilities.

Practical next steps

  • Inventory every AI feature currently active in your EHR, billing platform, and patient communication tools — treat embedded AI as a distinct system, not a passive software feature.
  • Pull and review your BAAs for AI vendors; confirm each specifies how PHI is used for model training, what data is retained, and what audit rights you hold.
  • Update your SRA to include AI-specific threat scenarios: training-data exposure, inference-time PHI flows, and the clinical consequences of erroneous outputs.
  • Designate an internal owner for AI governance — someone accountable for reviewing vendor model-update notices and documenting how AI outputs are reviewed before action is taken.
  • Before enabling any new AI feature, verify data-use terms and confirm you can disable the feature independently of the underlying platform.

Try Patient Protect

This commercial companion is published by Patient Protect and may be co-written with editorial AI assistance, drawing on the source HIPAA Pulse article. First reported in HIPAA Pulse → https://hipaapulse.com/new-hscc-guide-addresses-cybersecurity-risks-specific-to-healthcare-ai-d106ca6f