"We're HIPAA certified" is one of the most common lines in healthcare software sales, and it's increasingly common with AI tools. It's also not a real thing. The U.S. Department of Health and Human Services, which enforces HIPAA, doesn't certify software, vendors, or products. Neither does anyone else on its behalf.
That doesn't mean the vendor is lying about everything. It means the badge isn't the evidence. Here's what to look for instead.
This is not legal advice. Your own privacy officer or a healthcare attorney should review any agreement before patient data flows.
What actually matters: the Business Associate Agreement
If a vendor creates, receives, stores, or sends protected health information (PHI) on your practice's behalf, HIPAA treats them as a business associate. Before they touch that data, you need a signed Business Associate Agreement (BAA) with them. In it, the vendor commits to protecting the data, using it only for the work you hired them for, and telling you about breaches.
A vendor that's serious about healthcare has a BAA ready and signs it without fuss. A vendor that hesitates, says it "isn't necessary," or points to a badge instead is telling you something.
The chain is what people miss
A BAA with the company you're buying from isn't the whole picture. Modern software is built on other services, and every one of them that can see your patients' data needs to be covered too. For an AI tool, that usually includes:
- the vendor itself
- the cloud provider it runs on
- the AI model provider that reads your data
- any texting, email, or phone service it uses to reach patients
One uncovered link breaks the chain. That's why "which AI model do you use, and is it under a BAA?" is a fair question. Many consumer AI chat apps won't sign a BAA at all. Some business and enterprise offerings will.
Five questions to ask any vendor
- "Will you sign our BAA, or send us yours?" The answer should be yes, in writing, before any patient data is shared.
- "Which other services see our data, and are they all covered?" Ask specifically about the AI model provider.
- "Where is our data stored, and for how long?" You want a concrete answer: which cloud, which region, how long it's kept.
- "Is our data used to train your AI or anyone else's?" The answer should be no, and it should be in the contract.
- "What outside security audits do you have?" Reports like SOC 2 aren't HIPAA certification, but they show someone independent has checked the vendor's controls. They're a reasonable thing to ask about, just not a substitute for the BAA.
What stays on your side
A BAA shares responsibility; it doesn't hand it off. Your practice still needs its own security risk analysis, staff training, and sensible access controls. And the easiest way to reduce risk is to keep patient data out of tools that don't need it. Drafting a job post or an office policy with AI involves no PHI at all, and that's a fine place to start.
For a deeper look at what a compliant AI system looks like in a clinic, including data boundaries and a crisis path, see our field guide on after-hours AI intake for clinics. For the full list of claims to be wary of, see five red flags in AI sales pitches.
Questions about a vendor you're evaluating? Start at /discuss or write to hello@fullspecstudio.com.