Navigating AI compliance with HIPAA essentials

According to Norton Rose Fulbright, healthcare providers are increasingly deploying artificial intelligence (AI) tools for diagnostics, documentation and operational efficiency.[1] The firm writes that large AI platforms are now marketing AI-enabled tools directly to healthcare providers.[1]The firm notes that the US Department of Health and Human Services (HHS) has proposed updates to the HIPAA Privacy and Security rules[1]. It also says that although HIPAA predates modern AI, its requirements are intentionally technology‑neutral.[1]Norton Rose Fulbright says that under the Security Rule, covered entities must carry out a risk analysis to identify vulnerabilities to the confidentiality, integrity and availability of PHI before adopting AI tools.[1] The firm adds that sharing PHI with an AI vendor will almost always require a Business Associate Agreement (BAA)[1].The firm reports that Texas providers face added complexity from new state-specific AI requirements.[1] According to the alert, Texas's TRAIGA law requires providers to disclose AI use no later than the date of treatment[1], and failure to disclose may be considered a deceptive trade practice under Texas Law.[1]Among other steps, Norton Rose Fulbright recommends that providers use robust data encryption and strict access controls[1] and de-identify data wherever possible before AI processing to minimize risk.[1]The firm concludes that AI governance is no longer optional for healthcare organizations in Texas and across other jurisdictions.[1]