Artificial intelligence is quickly becoming part of everyday operations in healthcare. AI-powered tools are being introduced for everything from documentation and scheduling to patient communication, marketing, analytics, administrative workflows, and clinical support. But there is an important question that healthcare organizations should be asking as they adopt these tools:
How does this change our HIPAA security risk?
If an AI tool creates, receives, maintains, or transmits electronic protected health information (ePHI), or changes how that information is accessed or handled within your organization, it may introduce risks that need to be considered as part of your HIPAA Security Rule risk analysis. And that conversation applies to far more organizations than just hospitals.
Who Are We Talking About?
When people hear “healthcare cybersecurity,” they often picture large hospitals and health systems. But HIPAA can apply across a much broader healthcare ecosystem. Depending on the services provided, information handled, and whether the organization qualifies as a HIPAA covered entity or business associate, this conversation may include:
- Medical practices and physician groups
- Med spas and aesthetic practices
- Dental and orthodontic practices
- Physical therapy and rehabilitation centers
- Podiatry practices
- Ophthalmology and other eye care practices
- IV hydration and wellness clinics
- Behavioral health and therapy centers
- Specialty clinics
- Diagnostic and imaging centers
- Home health organizations
- Other healthcare organizations and their business associates that create, receive, maintain, or transmit ePHI
If your organization falls into one of these categories, adding a new AI platform isn’t simply a productivity decision. It can also change the environment in which sensitive patient information is being handled.
AI Adoption Can Change Your Risk Environment
A HIPAA risk analysis isn’t meant to be something an organization completes once and forgets about. Under the HIPAA Security Rule, covered entities and business associates are required to conduct an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. That means understanding where ePHI exists, who and what can access it, what threats and vulnerabilities exist, what safeguards are already in place, and the potential likelihood and impact of those risks.
Introducing new technology can change that picture. An AI tool may introduce a new vendor, new integration, new user permissions, new data flows, or an entirely new location where information is processed or stored. That doesn’t mean healthcare organizations shouldn’t use AI. It means AI adoption should happen with an understanding of what the technology is actually touching.
Start by Understanding What Your AI Actually Touches
Before implementing an AI tool, healthcare organizations should understand how it interacts with their existing environment.
Questions worth asking include:
- What information is being entered into the AI system?
- Does that information contain ePHI?
- Where is the information processed and stored?
- Who has access to it?
- Does the AI platform integrate with your EHR, CRM, scheduling platform, email, cloud environment, or other systems?
- Does the vendor retain information submitted to the platform?
- Is submitted information used to train or improve models?
- What security controls are available?
- Does the vendor need to function as a HIPAA business associate, and if so, is an appropriate Business Associate Agreement in place?
The answers can be very different from one AI product to another. That’s why simply saying an application “uses AI” doesn’t tell you much about its actual security or HIPAA implications.
When Was Your Last HIPAA Security Risk Assessment?
If your organization hasn’t recently completed a HIPAA security risk assessment, HHS provides a resource that can help. The Security Risk Assessment (SRA) Tool, developed by the Office of the National Coordinator for Health Information Technology in collaboration with the HHS Office for Civil Rights, was designed to help small and medium-sized healthcare practices and business associates assess security risks. The important distinction we wanted to make here is: The assessment identifies the risks. The next question is what you’re going to do about them.
Finding the Risk Is Only the Beginning
A risk assessment may reveal outdated systems, inadequate access controls, missing MFA, insufficient network segmentation, backup weaknesses, patching problems, unsupported technology, poor visibility, or other technical vulnerabilities. Identifying those issues is important. Remediating them is where the technical work begins. And as healthcare organizations introduce AI into more areas of their operations, understanding the relationship between those new technologies and the rest of the environment becomes increasingly important.
Where Alvaka Can Help
Alvaka can help healthcare organizations address the technical side of the risks identified through their security assessments. That can include evaluating existing security controls, identifying technical vulnerabilities, improving patching and system management, strengthening backup and recovery capabilities, improving visibility into the environment, and implementing cybersecurity safeguards designed to reduce operational risk. And because Alvaka also responds to ransomware incidents, our team sees what happens when weaknesses in real-world environments are successfully exploited. That experience informs how we approach prevention, resilience, and recovery.
AI Adoption Doesn’t Have to Mean Uncontrolled Risk
Healthcare organizations don’t need to choose between adopting AI and protecting sensitive information. But new technology should not be introduced without understanding how it changes the organization’s security environment. If your practice is implementing new AI tools, integrating AI into existing systems, or simply hasn’t revisited its HIPAA security risk analysis recently, now may be the right time to take another look. Understanding where your information lives, how it moves, who can access it, and what new technologies interact with it is an important part of protecting both your patients and your organization.
