Clear Path step · Business · Your industry's rules and risks
Get a BAA before any vendor, including AI, touches patient data
Why it matters: HIPAA allows outside companies to handle patient information only with written assurances. Personal chatbot accounts never come with those assurances.
On your path if you picked “Healthcare” for “What's your industry?”.
Do it
- Match your vendor list against signed BAAs.
- For AI tools, confirm the BAA covers the specific product and plan you use, and set it up as the agreement requires.
- Add a red-data rule to your AI policy: no patient information in any tool without a BAA.
- Ask AI vendors about retention, training on your data and where data is processed.
Check it worked: Every vendor handling patient information, including AI scribes and chatbots, has a signed business associate agreement, and staff know patient data never goes into tools without one.
Simply put
A business associate agreement (BAA) is like a signed confidentiality agreement before a contractor sees your files. Without one, patient information can't go to that vendor, and personal chatbot accounts never come with one.
In detail
A BAA often applies only to specific enterprise configurations of an AI product, so 'the vendor signs BAAs' isn't the same as 'our account is covered'.
If this is new to you: Not sure which vendors need one? Any vendor that creates, receives, keeps or sends patient information for your practice. Start by matching your vendor list against agreements you've signed.
Points toward the Long View: every AI tool in your practice backed by written promises about patient data.