HIPAA and BAA Compliance for Third-Party LLM Integrations
The short answer
If a third-party LLM service creates, receives, maintains, or transmits protected health information (PHI) for a covered entity, HHS guidance indicates that vendor is generally a business associate and a business associate agreement (BAA) is required. A BAA is necessary but not sufficient: you still need minimum-necessary data flows, access controls, audit logs, and a risk analysis for the integration.
When an LLM vendor becomes a business associate
HHS cloud computing guidance explains that a cloud service provider handling ePHI on behalf of a covered entity or business associate is itself a business associate, even if it only stores encrypted data. The same reasoning is commonly applied to hosted AI services that receive prompts containing PHI.
What the BAA should cover for AI
| Area | What to confirm |
|---|---|
| Permitted uses | PHI used only to provide the service — not to train or improve vendor models |
| Retention | How long prompts, outputs, and logs are kept, and deletion on request |
| Subcontractors | Downstream hosting or model providers also bound by BAA terms |
| Breach notification | Timelines and contacts consistent with the Breach Notification Rule |
| Safeguards | Encryption, access controls, and audit logging aligned with the Security Rule |
Architecture checklist beyond the BAA
- Include the AI integration in the HIPAA security risk analysis before go-live.
- Send only the minimum necessary PHI; de-identify or redact where the task allows.
- Use enterprise endpoints covered by the BAA — not consumer chat tools.
- Enforce role-based access so users only submit and see PHI they are permitted to.
- Log prompts, outputs, and users for audit, and protect those logs as PHI.
- Define human review before AI output enters the medical record or patient communication.
A common gap
Teams often secure the production integration while staff paste PHI into unapproved tools. An approved, BAA-covered option plus clear policy usually reduces that shadow use more effectively than a ban.
Frequently asked questions
Do I need a BAA to use an LLM with patient data?
Generally yes. If the vendor creates, receives, maintains, or transmits PHI on your behalf, HHS guidance treats it as a business associate and a BAA is required. Confirm with your privacy officer or counsel.
Is a BAA enough to make an AI tool HIPAA compliant?
No. The BAA allocates obligations, but you still need a risk analysis, minimum-necessary data use, access controls, audit logging, and staff policies.
Can vendors train their models on our PHI?
Only if the BAA and HIPAA permit it, which is uncommon. Most health systems require contract terms stating PHI is used solely to provide the service.
Does de-identified data need a BAA?
Data de-identified under the HIPAA Privacy Rule standard is not PHI. Verify the de-identification method meets HHS requirements before relying on it.
Official sources
- HHS: Guidance on HIPAA and Cloud Computing
- HHS: Sample Business Associate Agreement Provisions
- HHS: Minimum Necessary Requirement
- HHS: Guidance on De-identification of PHI
This article is general information, not legal or regulatory advice. Confirm how these rules apply to your organisation with your compliance team or counsel.