HIPAA and AI: What Your Compliance Officer Won't Tell You

The gap between HIPAA guidance and real-world AI usage. How to evaluate vendor BAAs, what counts as PHI in AI workflows, and the malpractice implications nobody talks about.

SharePost Share

Dr. Sajad Zalzala

Physician & Technologist

Isam Waqar

Product & Strategy

At a Glance

Key Takeaways

Most AI vendor BAAs have carve-outs that shift liability to you
Prompt engineering with patient data creates PHI even if you think it doesn't
The OCR hasn't issued specific AI guidance, but enforcement actions are coming
Document everything: which tools, which data, which patients

Show Notes

HIPAA was written before AI existed. In this episode, we break down the real compliance landscape for physicians using AI tools.

Transcript(click to expand)

Transcript will be available when this episode is published.

AI Scribes: Which Ones Actually Work in 2026?

Consumer Lab Results: How to Talk to Patients Who Test Themselves

Newsletter

Get the most from this episode

Subscribe for show notes, transcripts, and CME-eligible resources delivered weekly.

Join 2,000+ physicians. Unsubscribe anytime.

Listen On

More Compliance

AI Hallucinations in Clinical Settings: Real Risks, Real Mitigations

13 min