HIPAA Security Rule 164.312(a)(2)(iv): Encryption is an addressable implementation specification. AES-256 encryption is recommended for all stored PHI.

HIPAA Security Rule 164.312(e)(1): Transmission Security. TLS 1.2 or newer is mandatory for PHI transmission over open networks.

HIPAA Privacy Rule 164.502(b): Minimum Necessary. AI training should only use the PHI that is necessary to accomplish its intended purpose.

HIPAA 164.530(j): A 6-year retention period is required. PHI within AI models must also be securely deleted after this retention period (e.g., secure wipe/degaussing).

HIPAA Security Rule 164.308(a)(7): Contingency Plan. A data backup plan, disaster recovery plan, and emergency mode operation plan are mandatory.

HIPAA Security Rule 164.312(a)(2)(i): Unique User Identification. All access to PHI must be traceable to a unique user.

HIPAA Security Rule 164.312(a)(2)(iii): Automatic Logoff. This is an addressable specification; a timeout of 15-30 minutes is recommended for sessions accessing PHI.

HIPAA Security Rule 164.308(a)(4): Access authorization. Role-based access is required for workforce members based on their specific job functions.

HIPAA Security Rule 164.312(a)(2)(ii): Emergency Access Procedure. A mechanism for emergency access to PHI is mandatory for situations like life-threatening emergencies.

HIPAA Security Rule 164.312(b): Audit Controls. All events involving access to or modification of PHI must be recorded (including user, timestamp, action, and data identifier).

HIPAA Privacy Rule 164.514(b): Safe Harbor involves removing 18 specific identifiers. Expert Determination involves a statistical expert certifying that the risk of re-identification is very low.

During AI inference, the model must not generate outputs that enable the re-identification of individuals. Periodic testing is required.

HIPAA 164.514(e): A Limited Data Set can retain some identifiers (like dates/zips), but a DUA is mandatory for recipients using it for research, public health, or health care operations.

Large Language Models (LLMs) can memorize and regurgitate PHI from their training data. Techniques like differential privacy or testing for membership inference attacks are recommended to mitigate this.

HIPAA 164.502(e): A BAA is mandatory with all Business Associates (including vendors and cloud providers) who create, receive, maintain, or transmit PHI on your behalf.

HIPAA 164.504(e)(2): A BAA must include specific clauses, such as requiring safeguards, reporting breaches, ensuring subcontractors comply (flow-down), and allowing for audits.

The location of PHI can be relevant for OCR (Office for Civil Rights) enforcement. While HIPAA applies to US-based entities globally, OCR oversight is clearer for data stored within the US.

HIPAA 164.308(b)(1): Monitoring Business Associates is mandatory. Due diligence should include reviewing compliance attestations, security questionnaires, or SOC 2 reports.

HIPAA Breach Notification Rule (164.404-408): Requires 60-day reporting to OCR, notification to affected individuals, and media notification (if 500+ individuals are affected).

HIPAA Security Rule 164.308(a)(1)(ii)(A): A Security Risk Assessment is mandatory. It must identify all threats and vulnerabilities to ePHI.

HIPAA Security Rule 164.308(a)(5): A security awareness and training program is mandatory for all workforce members. Annual refresher training, including AI-specific scenarios, is recommended.

HIPAA 164.316(b): Documentation must be retained for 6 years. You must be able to produce all relevant HIPAA policies, procedures, and records (like training logs) during an OCR audit.