Navigating AI compliance with HIPAA essentials

Norton Rose Fulbright writes that "although HIPAA predates modern AI, its requirements are intentionally technology‑neutral."[1] The firm says covered entities must still carry out a thorough risk analysis of threats to patient health information (PHI) before adopting AI tools.[1]According to the firm, sharing PHI with an AI vendor "will almost always require a Business Associate Agreement."[1] In practice, the firm says, this means identifying AI uses that involve PHI, updating or signing these agreements with vendors, limiting staff to approved tools and documenting risk analyses.[1]The firm points to Texas law known as TRAIGA, which it says requires providers to disclose AI use in healthcare services or treatment no later than the date of treatment.[1] Norton Rose Fulbright adds that failure to disclose may be considered a deceptive trade practice under Texas law.[1]The firm also recommends that organisations use strong encryption and strict access controls, and remove identifying details from data wherever possible before AI processing.[1]Norton Rose Fulbright says providers "that ground their AI strategies in HIPAA fundamentals, transparent patient communication and disciplined vendor oversight will be best positioned to adapt."[1]The firm's attorney profiles show that the piece first appeared as a client alert on April 7, 2026[2]. Its authors include partner Susana Medeiros and senior counsel Susan Ross, and LexisNexis published a version in September 2026[2].