HIPAA and AI: What Private Practices Actually Need to Know

The Misconception That Gets Practices in Trouble

Most clinic owners assume that if a software vendor says the word "HIPAA compliant," they are covered. That is not how it works.

HIPAA compliance is not a certification you earn once. It is a set of ongoing requirements around how Protected Health Information (PHI) is stored, transmitted, and accessed. When you add AI tools to your practice, each one needs to be evaluated individually.

What Counts as PHI in an AI Context

If your AI system touches any of the following, HIPAA applies:

• •Patient names combined with appointment times
• •Phone numbers linked to health conditions or visit history
• •Any message that references a specific treatment or diagnosis
• •Insurance information

This means appointment reminder systems, review request tools, and patient reactivation campaigns all qualify as handling PHI.

The Three Things to Always Verify

1. Business Associate Agreement (BAA)

Any vendor that handles PHI on your behalf must sign a BAA. This is a legal contract that holds them accountable for protecting your patients data. If a vendor refuses to sign one or says it is not necessary, walk away.

2. Where Data Is Stored

Shared multi-tenant cloud databases are a red flag. Your patient data should be logically or physically isolated from other practices. Ask specifically: "Where is my data stored, and who else has access to the same infrastructure?"

3. Audit Logs

HIPAA requires that you can demonstrate who accessed PHI and when. Any AI system handling patient communications should maintain detailed logs of every message sent, to whom, and at what time.

How ClinicClaw Approaches This

We built ClinicClaw from the ground up with HIPAA in mind:

• •Each practice gets its own private server (no shared infrastructure)
• •Patient data is stored in an isolated Supabase database with BAA support
• •Every SMS sent by Aria, Vera, or Rex is logged with a full audit trail
• •We do not use patient data to train models or share it with third parties

For most practices, this architecture exceeds the technical safeguard requirements under the HIPAA Security Rule.

The Bottom Line

AI automation can dramatically improve your practice operations. But the implementation details matter. Before deploying any AI tool, ask hard questions about data storage, BAAs, and audit capabilities.

If a vendor cannot answer those questions clearly, that is your answer.