The Conversation You Cannot Avoid Anymore
If you are a HIPAA officer in 2026 and you have not yet had a serious internal conversation about generative AI, it is already overdue. Your front-desk staff are using AI to draft patient emails. Your billing team is using it to summarize denial letters. Your providers are using ambient scribes during exams. The question is not whether AI is in your practice — it is whether it is inside your compliance program or sitting outside of it as unmanaged shadow IT.
Why “Just Don't Use It” Is Not a Policy
The instinct to ban AI tools outright is understandable, and for some categories of tool it is the right call. But a blanket prohibition rarely survives contact with the workflow improvements staff are seeing. People who can summarize a 40-page denial letter in twenty seconds are not going back to reading it line by line because a memo told them to. A policy that everyone ignores is worse than no policy: it tells OCR you knew and did nothing.
The defensible position in 2026 is a tiered policy: explicitly approved tools, explicitly prohibited tools, and a clear path to request review of anything in between.
The Three Categories Every Practice Needs
Approved with a BAA
Tools your practice has vetted, signed a Business Associate Agreement with, and configured for HIPAA-aligned use. This list might include a vendor's enterprise version of a major chat assistant, an ambient scribe with a healthcare-specific BAA, or a coding-and-billing assistant from your EHR vendor. PHI may be entered into these tools within the documented use cases.
Approved without PHI
Consumer or general-purpose tools that staff may use for non-PHI tasks: drafting a generic patient-education handout, summarizing a public regulation, brainstorming marketing copy. No patient data, no employee data, no internal documents marked confidential. The line is bright and it must be enforced.
Prohibited
Tools that have been specifically reviewed and rejected, usually because they retain inputs for training, route data through jurisdictions you cannot accept, or refuse to sign a BAA. The list should be named, not just described in the abstract, so that “I didn't know” is not a defense.
What to Put in a BAA With an AI Vendor
Standard BAA language was written before generative AI existed. When you negotiate or renew a BAA with an AI vendor in 2026, push for explicit clauses on:
- Training data use. The vendor must commit in writing that customer inputs will not be used to train models, even “in aggregate.”
- Retention. Inputs and outputs should be retained only as long as operationally necessary, with a stated maximum.
- Sub-processors. If the vendor routes inference through another provider's API, that provider is also touching PHI and needs to be disclosed.
- Logging. The vendor must produce per-user audit logs on request — you cannot investigate an incident without them.
- Geographic processing. If you are sensitive to where inference runs, get it in writing.
The Workforce Training Update You Owe Your Staff
Your annual HIPAA training almost certainly does not cover AI yet. Add a module that addresses three concrete behaviors:
- What an approved tool looks like and how to identify it (URL, login method, the words “Enterprise” or “HIPAA” on the screen).
- What counts as PHI in an AI prompt — including indirect identifiers like an unusual diagnosis combined with a small-town zip code.
- What to do when staff are not sure: ask, do not assume.
Make this training mandatory and document completion. The audit trail matters as much as the training itself.
The Risk Assessment Angle
Add AI use to your annual risk analysis explicitly. Walk through the workflows where AI is now embedded, identify the data that flows into and out of those tools, and rate the residual risk after your controls are applied. The HIPAA Security Rule's requirement to assess “reasonably anticipated threats” absolutely covers AI in 2026 — the regulators have been signaling this for a year.
Watch for Shadow Adoption
Even with a clear policy, staff will adopt new tools faster than you can review them. Practical countermeasures:
- Quarterly anonymous surveys asking what AI tools staff actually use.
- Endpoint inventory data that flags new browser extensions and locally installed AI assistants.
- An open intake channel where staff can request review of a new tool without fear of being scolded for asking.
The goal is to surface shadow adoption early, not to play whack-a-mole after the fact.
The Enforcement Outlook
OCR has not yet brought a marquee enforcement action that hinges entirely on generative AI, but the agency has telegraphed clearly that AI-related disclosures will be evaluated under existing Privacy and Security Rule frameworks. Practices that can show a written AI policy, a BAA-backed approved-tools list, completed staff training, and a documented risk assessment will be in a dramatically better position than practices that cannot.
Getting Started This Quarter
If you are starting from zero, the first four weeks are enough to make material progress: name an owner, inventory current AI use, draft a one-page policy with the three categories above, and add a short training module. The second four weeks: review and sign at least one BAA-backed approved tool, retire the riskiest unmanaged ones, and add AI to your risk assessment template. By the end of the quarter you have something defensible.
Call to Action
Talk to us about how HIPAA Security Suite can help you document your AI policy, training, and vendor reviews — the same workflows that handle your other vendors apply directly to AI tools.