Does HIPAA apply to AI systems in healthcare?

Yes. Any AI system that receives, creates, maintains, or transmits Protected Health Information (PHI) on behalf of a HIPAA covered entity is subject to HIPAA as a Business Associate. This includes LLMs used for clinical documentation, diagnostic AI, AI-powered coding systems, and any cloud AI service that processes patient data. A signed Business Associate Agreement (BAA) is required before any PHI flows to these systems.

Does FDA regulate AI in healthcare?

Yes. AI systems used in clinical decision-making to diagnose, treat, mitigate, cure, or prevent disease are regulated as Software as a Medical Device (SaMD) under FDA authority. Depending on risk level, they require 510(k) clearance (Class II) or Pre-Market Approval (Class III). The FDA's 2021 AI/ML Action Plan introduced Predetermined Change Control Plans (PCCPs) to manage model updates within a cleared device.

Is healthcare AI high-risk under the EU AI Act?

Yes. AI systems intended to be used as medical devices under EU MDR (Regulation 2017/745) or IVDR (Regulation 2017/746) are automatically classified as high-risk under Annex III of the EU AI Act. They must meet all six high-risk obligations: technical documentation (Annex IV), conformity assessment, EU database registration, instructions for use, human oversight mechanisms, and post-market monitoring.

What is a Business Associate Agreement (BAA) for AI?

A BAA is a written contract required by HIPAA before any Protected Health Information can be shared with a vendor who will process it on the covered entity's behalf. For AI systems, this means any AI service that receives patient data - including API calls to LLMs - requires a signed BAA specifying how PHI will be used, safeguarded, and disposed of. Many standard AI API tiers do not include HIPAA-compliant BAAs.

What is the HIPAA minimum necessary standard for AI?

The minimum necessary standard requires that PHI used in any processing activity - including AI training and inference - is limited to the minimum amount necessary to accomplish the specific purpose. For AI training, this means you cannot use complete patient records if only specific fields are needed. For AI inference, a diagnostic AI cannot request PHI fields irrelevant to its specific clinical function.

AI Compliance in Healthcare 2026: What HIPAA, FDA, and the…

Three overlapping regulatory frameworks, one AI system - mapped to specific obligations.

Why Healthcare AI Compliance Is Different in 2026

Healthcare AI compliance in 2026 is not a single regulatory problem - it is three simultaneous regulatory problems with different enforcement bodies, different penalties, and different compliance timelines. An AI diagnostic tool deployed in a US hospital that also serves EU patients faces HIPAA Security Rule obligations, FDA SaMD regulatory requirements, and EU AI Act high-risk AI obligations - concurrently, not sequentially. The stakes are proportionally higher. A HIPAA breach carries civil penalties up to $1.9M per violation category per year. An FDA enforcement action can result in market withdrawal, consent decree, and criminal referral. An EU AI Act violation for a medical AI system can result in fines up to €15M or 3% of global turnover. And unlike most compliance domains, a healthcare AI failure can directly harm patients - which triggers liability exposure that dwarfs regulatory fines.

HIPAA Requirements for AI Systems

HIPAA protects Protected Health Information (PHI) - any individually identifiable health information held or transmitted by a covered entity or their business associates. For AI systems, HIPAA creates four specific obligations:

Business Associate Agreement (BAA) Requirement

Any AI vendor that receives, creates, maintains, or transmits PHI on behalf of a covered entity is a Business Associate. Before any PHI flows to an AI system - including API calls to LLMs used for clinical documentation, coding, or diagnosis support - a signed BAA must be in place. The BAA must specify how PHI is used, safeguarded, and disposed of. Vendors who will not sign a BAA cannot legally receive PHI. Many general-purpose AI APIs (including some from major providers) do not offer HIPAA-compliant BAAs for standard tiers.

HIPAA Security Rule - Administrative, Physical, and Technical Safeguards

The HIPAA Security Rule requires covered entities to implement safeguards across three categories:

Administrative safeguards: risk analysis, workforce training, contingency planning, access management policies
Physical safeguards: facility access controls, workstation security, device and media controls
Technical safeguards: access controls (unique user IDs, automatic logoff), audit controls (logs of all ePHI access), integrity controls, and transmission security (encryption in transit)

For AI systems specifically, the 2024 NPRM (proposed HIPAA Security Rule update) would add requirements for multi-factor authentication for all ePHI access, encryption at rest (currently "addressable" - effectively required but with discretion), and network segmentation for ePHI systems. The NPRM is expected to finalise in 2026.

Minimum Necessary Standard

HIPAA's minimum necessary standard requires covered entities to limit PHI used or disclosed to the minimum necessary to accomplish the intended purpose. For AI training, this means you cannot use a complete patient record to train a model if only specific fields are needed. For inference, an AI diagnostic system cannot request or receive PHI fields it does not need for the specific clinical function it is performing.

Right of Access and Amendment

Patients have HIPAA rights to access their PHI and to request amendment of inaccurate records. If an AI system contributes to a patient record - clinical notes, diagnostic codes, risk scores - the patient's right to access and amend extends to that AI-generated content.

FDA AI/ML SaMD: Software as a Medical Device

The FDA regulates AI systems used in clinical decision-making as Software as a Medical Device (SaMD) when they meet the definition of a device under 21 CFR Part 880 or applicable product codes. The key question is whether the AI system's output is used to diagnose, treat, mitigate, cure, or prevent a disease or condition - if yes, it is a medical device and requires FDA clearance or approval.

Classification and Clearance Pathway

AI SaMD is classified into three risk tiers:

Class I: lowest risk, general controls, most are exempt from premarket notification
Class II: moderate risk, requires 510(k) clearance (substantial equivalence to a predicate device), or De Novo classification for novel devices
Class III: highest risk (life-sustaining, implanted), requires Premarket Approval (PMA) - the most rigorous pathway

Most clinical AI tools (diagnostic imaging AI, sepsis prediction, clinical documentation AI that influences treatment) are Class II. The 510(k) process requires demonstrating substantial equivalence to an already-cleared device - performance testing, clinical validation data, and documentation of the algorithm's design controls.

FDA AI/ML Action Plan: Predetermined Change Control Plan

The FDA's 2021 AI/ML SaMD Action Plan introduced the concept of a Predetermined Change Control Plan (PCCP). AI systems that learn or adapt post-deployment create a challenge for traditional device regulation: each model update is technically a device modification. The PCCP allows manufacturers to specify in advance the types of changes they anticipate making, the performance testing required before implementing each change, and the controls in place to ensure safety. This avoids the need for a new 510(k) submission for every model update.

EU AI Act: Medical AI as High-Risk

Under the EU AI Act, AI systems intended to be used as medical devices under the EU MDR (Regulation 2017/745) or IVDR (Regulation 2017/746) are automatically classified as high-risk under Annex III. This means all six high-risk obligations apply: technical documentation, conformity assessment, EU database registration, instructions for use, human oversight mechanisms, and post-market monitoring. For medical AI that is already CE-marked under MDR or IVDR, the EU AI Act conformity assessment may be folded into the existing MDR/IVDR notified body process. The European Commission has issued guidance on the interaction between the two frameworks, emphasising that MDR compliance does not automatically satisfy EU AI Act requirements - the AI-specific obligations (human oversight design, accuracy benchmarks, robustness testing) must be demonstrated separately.

The Compliance Stack: What to Build First

For a US healthcare AI provider also targeting EU markets, the compliance sequence is:

HIPAA BAA first - nothing moves until PHI handling agreements are in place
FDA pathway determination - is the system a medical device? If yes, what class? Engage the FDA's pre-submission process early
HIPAA Security Rule safeguards - implement administrative, physical, and technical safeguards before any PHI flows into the system
EU AI Act technical documentation - Annex IV documentation can be developed in parallel with FDA submissions; much of the content overlaps
Post-market monitoring plan - required by both FDA (post-market surveillance) and EU AI Act (Article 72)

How Bidda Maps Healthcare AI Compliance

Bidda's healthcare compliance nodes cover HIPAA (Security Rule, Privacy Rule, Breach Notification Rule, HITECH Act), FDA SaMD pathways (21 CFR Part 820 QSR, FDA AI/ML SaMD Action Plan), and EU AI Act medical device intersection. Each node is primary-source verified - the HIPAA Security Rule node cites the specific 45 CFR part and section, not a summary. The FDA AI/ML SaMD node specifies the exact PCCP documentation requirements referenced in FDA guidance. Compliance agents can chain these nodes to verify an AI system's full regulatory stack programmatically.

AI Compliance in Healthcare 2026: What HIPAA, FDA, and the EU AI Act Actually Require