HIPAA compliant AI tools
Chat assistants and copilots. The consumer product and the business product usually have completely different terms under the same brand.
The brand on the screen tells you nothing here. The same assistant, with the same name and the same interface, can be covered on one subscription and explicitly excluded on another, including business-labelled plans that sound as though they ought to qualify. Terms are also unusually granular: eligibility may depend on which product line you bought, whether a particular data-retention setting has been applied to your account, and which individual features or endpoints you use.
The larger exposure is not the account you buy but the one you did not. Staff already hold personal assistant accounts, and pasting in a difficult paragraph to have it reworded is a natural thing to do. That single paste sends patient information to a consumer service with no agreement behind it. Nothing logs it and nobody notices, so a written policy plus a sanctioned alternative is the only realistic control.
Can be used with patient information
Each of these requires a signed agreement and, usually, specific settings. Open an entry for the exact conditions.
What to check before you adopt one
- Confirm eligibility for the exact product and subscription you intend to buy, since consumer and even some business tiers of the same assistant are excluded while others are covered.
- Ask whether a specific retention or data-handling setting must be applied to your account before patient information may be processed, and get confirmation it is active.
- Check which features an administrator can switch on that fall outside the agreement, and whether those features are off by default.
- Establish how plugins, custom assistants and connected apps are treated, as these carry their own terms and are rarely reached by yours.
- Re-check the vendor's eligibility page far more often than you would in other categories, because these product lines and their terms change within months.
The expensive mistake
Deploying an approved assistant for the organization and stopping there. The risk sits in the personal accounts staff already use, pasting a letter to shorten it, a note to reword it, a difficult message to soften it. Unless you name the sanctioned tool, discourage or block the consumer version, and explain why, the approved deployment simply runs alongside the unapproved one.
Tracking which of these your organization uses?
The vendor and BAA register keeps every tool that touches patient information, its agreement status and its renewal date in one place — seeded from this research. See pricing.
Information, not certification and not legal advice. Each entry reflects that vendor’s published documentation as read on the date shown on its page. Vendors change terms without notice — confirm anything you rely on directly with them.