Can employees use ChatGPT and other AI tools with patient data under HIPAA?

The short answer

Employees can use an AI tool with patient data only if the organization has a business associate agreement (BAA) with the vendor for that specific product, or if the data has been properly de-identified first. Free and personal accounts an employee opened on their own almost never meet either condition. This guide is general information, not legal advice.

The hard part is rarely the rule. HIPAA has been clear about business associates for years. The hard part is knowing which AI tools your workforce is actually using, because a BAA you signed for one approved product says nothing about the other five tools people opened in a browser tab.

What HIPAA covers, and who counts as a business associate

The HIPAA Privacy and Security Rules apply to covered entities (health plans, health care clearinghouses and most health care providers) and to their business associates. The rules protect protected health information (PHI), and the Security Rule specifically covers the electronic form, ePHI. Your workforce is part of the picture: the regulation defines it as people whose conduct is under the direct control of the entity, whether or not they are paid.

A business associate is, broadly, a person or company that creates, receives, maintains or transmits PHI on behalf of a covered entity. A software vendor whose system your employees type patient details into fits that description, and so does a subcontractor of a business associate. The formal definition sits in 45 CFR 160.103.

The rule that decides it: the business associate agreement

Under 45 CFR 164.502(e)(1), a covered entity may disclose PHI to a business associate only if it obtains satisfactory assurance that the associate will appropriately safeguard the information, documented in a written contract that meets 45 CFR 164.504(e). The Security Rule repeats the requirement for ePHI at 164.308(b)(1).

An AI chat service is, technically, a cloud service that receives whatever text is typed into it. That is why the practical question for a compliance officer is not whether the model is accurate. It is whether a signed BAA exists for the exact product in use, and whether the employee is using that product.

Which AI vendors offer a BAA, and for which products

Each vendor below documents its own HIPAA position. We read each official page on September 20, 2026, and the table restates only what the pages say. Terms change, and a product being eligible does not make it covered until the agreement is in place, so verify the current contract before relying on any row.

Two things follow. First, a BAA is a contract for a product tier and an organization, not for a brand, so the same vendor can be fine on one plan and unsuitable on another. Second, the BAA is one control among several. It does not decide who may use the tool, with what data, or how you would notice that someone used it.

Without a BAA: de-identification and minimum necessary

There are two ways an AI tool can lawfully see health-related text without a BAA. One is that the text is not PHI. Under 45 CFR 164.514(b), data is de-identified either by an expert determination, in which a qualified person documents that the risk of identifying an individual is very small, or by the Safe Harbor method, which removes 18 categories of identifiers. These include names, geographic units smaller than a state, dates other than year, phone numbers, email addresses, Social Security numbers, medical record numbers, device identifiers, IP addresses and full-face photographs.

The other is discipline about scope. The minimum necessary standard in 164.502(b)(1) requires reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose. Even with a BAA in place, an employee who pastes a full chart to get a two-line summary has a minimum-necessary problem. A short policy that names what may and may not be entered, with examples, does more than a long one nobody reads.

What a violation can cost

HHS adjusts civil money penalty amounts for inflation every year. The notice published in the Federal Register on January 28, 2026 sets the figures below for violations of the administrative simplification provisions. The tier depends on what the organization knew and how quickly it corrected the problem.

These are civil penalties per the notice. They do not include the cost of investigating, notifying and remediating an incident, which is where the larger number usually sits. In IBM’s 2025 study, the healthcare sector’s average breach cost was the figure below.

There is no official HIPAA certification

Vendors sometimes advertise themselves as HIPAA certified. HHS’s FAQ on the subject says it does not endorse or otherwise recognize private organizations’ certifications regarding the Security Rule, and that such certifications do not absolve covered entities of their legal obligations. What a vendor can legitimately offer is a signed BAA, documented safeguards and evidence of how they operate.

That is also the standard Tangerin AI holds itself to. It does not claim to be HIPAA certified or HIPAA compliant, because there is no such credential to hold.

Why you cannot prove what you never saw

A BAA covers the tools you approved. A privacy officer who is asked whether PHI reached an unapproved AI service needs to answer from records, not from belief, and without an inventory of the AI tools in use the honest answer is that nobody knows. The same IBM study puts numbers on how common that gap is.

Tangerin AI addresses the inventory piece, and only that piece. It sees usage metadata, such as which AI tool a workstation reached and how often, and never the content of a conversation or a prompt. It tracks HIPAA as one of its frameworks and does not certify anyone. It does not offer a BAA or a data processing agreement today, and it does not replace the contracts described above.

A starting path, in five steps

This is our reading of a practical sequence, not regulatory text. It puts discovery before policy because a policy written without knowing the tools tends to be rewritten.

• 1. Inventory. Find out which AI tools are used, by which teams and how often, including the ones nobody approved. See how to build an AI-BOM.
• 2. Classify by data. Mark the tools that could plausibly receive PHI, such as those used by clinical, billing and support staff.
• 3. Sort by contract. For each tool, record whether a BAA exists for the exact plan in use. Tools without one are prohibited for PHI.
• 4. Write the policy. Say what data may be entered, what must be de-identified first, and who approves new tools. See the annotated AI usage policy template.
• 5. Keep evidence. Records of what was found, decided and remediated are what you show a regulator or a covered-entity customer. See how the same idea works in the NIST AI RMF guide.

Frequently asked questions