Why AI Use Matters Under HIPAA
An AI service that receives protected health information is handling PHI for the practice, so it needs a business associate agreement. When staff paste a patient note into a consumer chatbot, PHI leaves for a vendor with no agreement and no audit trail.
Controls ProctoredAI Evidences
| Control | Evidence in the Monthly Report |
|---|---|
| 164.312(b) Audit controls | Inspected AI requests and policy decisions are recorded per device and user. |
| 164.308(a)(1)(ii)(D) Information system activity review | Policy alerts raised and triaged in the period. |
| 164.502(b) Minimum necessary | PHI findings stopped or redacted before reaching AI services. |
| 164.310(d)(1) Device and media controls | Removable media governed per policy; files written to media inspected for PHI. |
Each client's report lists these controls with a status. Evidenced means the mechanism produced records in the period; Active means it is enforced with nothing to record; Not configured means the feature is off for that client.
Policy Packs Applied
Selecting HIPAA for a client applies these packs in one step:
- HIPAA — Protected Health Information. PHI may only go to approved (BAA-covered) AI apps, and only after a warning.
- Personal Data (GDPR/GLBA). Redact government IDs; warn on bulk contact data.
- Sensitive Documents. Contracts, financial statements, HR and medical records, customer lists and credential files may only go to approved AI apps.
The Setup Checklist
Some steps live outside the policy rules. The console hands the provider this list:
- Approve only BAA-covered AI apps under Applications
- Set work email domains and mark clinical AI apps Work accounts only
- Publish the AI Use Policy and collect acknowledgments
What the Auditor Receives
- A monthly AI Governance Report for the client, stored with a SHA-256 digest so the copy an auditor holds can be matched to the console.
- An evidence bundle with every non-usage event in the period, the client's audit-log entries and the head hash of the audit chain.
- The AI Use Policy generated from the client's real configuration, with each employee's acknowledgment and version.
AI Apps to Decide On First
- OpenEvidenceHigh
- Doximity GPTMedium
- OverjetMedium
- PearlMedium
- Bola AIMedium
- VideaHealthMedium
- AbridgeHigh
- NablaHigh
- FreedHigh
- SukiHigh
- Heidi HealthHigh
- DeepScribeHigh
Questions
Can staff use ChatGPT at a HIPAA-covered practice?
Only with a service covered by a business associate agreement, and only for the minimum necessary information. ProctoredAI lets the provider approve the covered tool, block the others, and stop patient identifiers on their way to any AI app that is not approved.
Does ProctoredAI make a practice HIPAA compliant?
No product does that on its own. ProctoredAI enforces the AI part of the practice's safeguards on every device and records evidence for the audit-control, activity-review, minimum-necessary and device-and-media controls listed on this page.
What about AI scribes?
Ambient scribes record whole patient visits. The catalog lists the scribes ProctoredAI recognizes, so the provider can approve the one under a business associate agreement and block the rest.
ProctoredAI supports a client's compliance program; it does not by itself make a client compliant, and it is not legal advice. All frameworks · The MSP AI governance guide