HHS Office for Civil Rights (OCR) Director Paula Stannard told the September 2026 Safeguarding Health Information conference that a vendor providing an AI tool that handles protected health information (PHI) is a business associate, and that organizations should not begin using the tool before a business associate agreement (BAA) is in place. There is no AI-specific HIPAA rule. The Security Rule is technology neutral and applies to AI as written, so AI tools belong in your risk analysis now.
What OCR and NIST said applies today
- BAA first. A signed BAA is a precondition for use, not a follow-up item after a pilot.
- Risk analysis covers AI. Assess the threats and vulnerabilities to electronic PHI (ePHI) that the tool introduces, and reduce them to a reasonable and appropriate level before deployment.
- Named AI risks. OCR identified model manipulation, data poisoning that affects ePHI integrity, and unauthorized disclosure of ePHI to third parties.
- Civil rights. OCR enforces civil rights laws as well as HIPAA, so bias in AI-supported decisions falls within its jurisdiction.
- Existing controls. NIST advised asking how an AI deployment weakens controls you already rely on. If you could previously explain how a result was reached and now cannot, that affects your compliance posture.
Where AI risk shows up in practice
- Shadow AI. Staff paste PHI into consumer AI tools or photograph screens to get around device restrictions. Federal and industry panelists agreed that prohibition alone does not work. Provide an approved tool and a clear policy.
- Vendor data sharing. Assume every vendor uses AI internally. The control you hold is how much data you send. Apply minimum necessary at the field level and use data use agreements to specify what each vendor receives.
- Model retirement. Vendors can retire an underlying model with less than 30 days’ notice. Tools built into clinical workflow or the EHR need a transition plan.
- Drift in use. A model validated for one purpose can be applied to another without anyone deciding it should be. NIST recommends a process to track how deployed AI is actually used, plus periodic revalidation, because AI performance changes over time.
- Training data exposure. Data protected by access controls can still be revealed through model output.
The Health Sector Coordinating Council (HSCC) published a Third-Party AI Risk and Supply Chain Transparency Guide in April 2026. It provides procurement questions, contract terms, and lifecycle guidance aligned to the NIST AI Risk Management Framework (AI RMF). Ohio DD boards and county agencies that use AI in eligibility or service decisions should note the civil rights dimension and document how those decisions are reviewed.
What to do now
- Inventory AI in use. Include AI features embedded in existing software and tools staff use on their own.
- Confirm a BAA for every AI vendor that creates, receives, maintains, or transmits PHI. Pause use where one is missing.
- Add AI tools to your risk analysis. Cover the OCR-named risks and any loss of explainability or audit capability.
- Limit what vendors receive. Specify data fields in a data use agreement, not only in the BAA.
- Adopt an AI acceptable use policy. Name approved tools and set a defined human review point for decisions affecting care or coverage.
- Plan for change. Require notice and transition terms for model retirement, and schedule periodic revalidation.
Organizations that document these steps now will have a defensible answer when OCR asks how an AI tool was assessed.
How Eagle can help
Eagle Consulting Partners performs AI risk assessments using a methodology tailored from the NIST AI RMF, adds AI systems to HIPAA Security Risk Assessments, reviews AI vendor BAAs and data sharing terms, and drafts AI governance and acceptable use policies. We work with healthcare providers, business associates, and Ohio county boards. Contact us to talk about your timeline.
Sources: NIST AI Risk Management Framework; HSCC: Third-Party AI Risk and Supply Chain Transparency Guide; AHA News: HSCC releases guide on third-party AI risk. This article is general information, not legal advice.
