AI Readiness in Healthcare IT: Why HIPAA Comes First

In most industries, the path to AI goes roughly like this: pick a tool, try it, then work out the controls. In healthcare, that order is backwards, and following it can create a reportable problem before anyone has finished the trial. AI readiness in healthcare IT starts with HIPAA, because the rules about protected health information decide which tools you can use, for what, and under which agreements, before a single patient record gets anywhere near an AI tool.

That doesn’t make healthcare slower at AI. Done in the right order, it can move quickly. This post covers the order that works, where healthcare IT needs extra care, and the use cases that tend to be safe starting points.

A note before we start: this is a practitioner’s guide, not legal advice. Your privacy officer and counsel make the final calls on what HIPAA requires of your organization.

Why HIPAA changes the order

Three HIPAA mechanics shape everything else:

Business associate agreements. Any vendor that creates, receives, maintains, or transmits protected health information on your behalf is a business associate, and you need a business associate agreement with them. That includes AI vendors. Many will sign one only for specific enterprise plans or configurations, and consumer plans generally aren’t covered. Don’t assume; ask, and get it in writing.
Minimum necessary. For many uses and disclosures, you’re expected to limit protected health information to the minimum needed for the purpose. An AI workflow that sends a whole chart when it needs one field is a design problem, not just a technical one.
Risk analysis. The Security Rule requires you to analyze risks to electronic protected health information. An AI tool that touches it belongs in that analysis before it’s used, not after.

Put together, the order becomes: know where the data is, get the agreements, update the risk analysis, then use the tool.

The biggest risk is already happening

The most urgent healthcare AI risk usually isn’t a sanctioned project. It’s shadow AI: a staff member pasting part of a patient message or a clinical note into a public chatbot to summarize it or draft a reply, with no agreement in place and no way to retrieve the data. That’s why the first step for most healthcare organizations is the same as for everyone else, with higher stakes: give people an approved tool covered by a business associate agreement, and make the rule about protected health information in unapproved tools unmistakable. The shadow AI policy your IT team actually needs covers the approach.

The order of operations that works

Map where protected health information lives, including in email, file shares, and collaboration tools, not just the EHR. Permissions on those locations matter as soon as an assistant can search them.
Find out where AI is already in use, including AI features inside systems you already license. Many clinical and administrative platforms now include AI features.
Choose an approved AI tool with a business associate agreement, and confirm exactly which plan, features, and configurations the agreement covers.
Update your acceptable use policy so protected health information sits in the “never in any unapproved tool” tier, with named approved tools for anything else. A template is in publish your AI acceptable use policy this month.
Add AI to your security risk analysis, including data flows, access controls, logging, and retention for each tool.
Start with use cases that don’t involve protected health information, and build experience before moving to ones that do.
Bring clinical leadership in before any AI touches clinical workflows.

Where healthcare IT needs extra care

Other sensitive categories

HIPAA isn’t the only rule. Substance use disorder treatment records have their own federal protections, and some states have health data laws that reach beyond HIPAA. Your privacy officer should map which apply, and your AI inventory should record which tools touch each category. Mapping obligations before the pilot covers the method.

De-identification is harder than it looks

HIPAA recognizes two ways to de-identify data: removing a defined list of identifiers, or having an expert determine that the risk of re-identification is very small. Free-text clinical notes are especially difficult, because identifying details hide in narrative. Don’t treat “we removed the names” as de-identified.

Clinical decisions need clinical governance

Administrative AI and clinical AI are different categories. Some software that supports clinical decisions is regulated as a medical device, and any AI that influences care needs clinical oversight, human review, and attention to how it performs across patient populations. IT can run the infrastructure and security; clinical leadership has to own the decisions about care.

Use cases that tend to be good starting points

Without protected health information, suitable for an early pilot:

Answering staff questions about HR, IT, and administrative policies.
The IT service desk: ticket summaries and knowledge-base drafting.
Drafting training materials, internal communications, and grant applications.

With protected health information, once agreements, risk analysis, and oversight are in place:

Drafting replies to patient portal messages for clinician review.
Drafting prior authorization and appeal letters for staff review.
Clinical documentation support, such as ambient note drafting, under clinical governance.

In every case, a person reviews the output before it’s used. That’s good practice everywhere; in healthcare it’s essential.

The asset: a HIPAA-first AI readiness checklist

We know where protected health information lives outside the EHR, and permissions on those locations are reviewed.
We know which AI tools and AI features are already in use.
Every AI tool that could touch protected health information has a signed business associate agreement covering the specific plan and features in use.
Our acceptable use policy names protected health information explicitly and lists approved tools.
AI tools are included in our security risk analysis.
We have a plan for honoring minimum necessary in AI workflows.
Staff have been trained on the policy with healthcare-specific examples.
Other sensitive categories, such as substance use disorder records and state-regulated health data, are mapped.
Clinical leadership oversees any AI that touches clinical workflows.
Our first pilot doesn’t require protected health information, or has all of the above in place.

The first 90 days for a healthcare IT team

Days 1 to 30: confirm which AI tools are in use, choose an approved tool with a business associate agreement that covers the plan you’ll use, and publish an acceptable use policy that names protected health information explicitly. Review permissions on the file shares and collaboration sites where patient information turns up outside the EHR.

Days 31 to 60: add AI to your security risk analysis, train staff with examples drawn from their own work, and build an inventory that records which tools touch which sensitive categories. Launch one pilot that needs no protected health information, such as staff policy questions or the IT service desk.

Days 61 to 90: measure that pilot against its baseline, and work with clinical leadership to choose the first use case involving protected health information, with every agreement and review in place before it starts.

Where does your team actually stand?

The free AI Readiness Score uses 10 of the 24 assessment questions, spread across all six dimensions, and gives you a score in a few minutes.

Get your free AI Readiness Score →

Want to see what the full assessment covers first? Flip through a complete 38-page sample report.

Related guides

Frequently asked questions

Do AI vendors need a business associate agreement?

If they create, receive, maintain, or transmit protected health information on your behalf, yes. Many AI vendors sign one only for specific enterprise plans or configurations, and consumer plans generally aren't covered. Confirm in writing which plan and features the agreement covers. Your privacy officer makes the final call.

What is the right order for AI in healthcare IT?

Map where protected health information lives, find existing AI use, choose an approved tool with a business associate agreement, update the acceptable use policy, add AI to your security risk analysis, start with use cases that don't involve PHI, and bring clinical leadership in before any clinical use.

Is removing patient names enough to de-identify data for AI?

No. HIPAA recognizes two methods: removing a defined list of identifiers, or an expert determination that re-identification risk is very small. Free-text clinical notes are especially hard, because identifying details hide in the narrative.

What are safe first AI use cases in healthcare?

Ones that don't involve protected health information: answering staff questions about HR, IT, and administrative policies, the IT service desk, and drafting training materials, internal communications, and grant applications. Uses involving PHI come later, with agreements, risk analysis, and oversight in place.