What HIPAA actually requires for AI
- BAA in place with any vendor processing PHI (Anthropic, OpenAI Enterprise, Azure OpenAI all sign)
- No PHI to non-BAA endpoints — consumer ChatGPT is not compliant
- Audit logs retained for at least 6 years
- Access controls — least-privilege, MFA, role-based
- Encryption in transit and at rest
- Breach notification plan — including downstream AI vendors
Workflows that produce ROI
- AI ambient scribes — sit in the room (or telehealth call), generate clinical notes. Single biggest AI win in 2026 healthcare.
- Patient intake + scheduling AI — voice + chat, books appointments, captures insurance
- Prior auth automation — drafts and submits prior auths, tracks status
- Coding assistance — AI suggests CPT/ICD codes from notes (human reviews)
- Patient messaging triage — sorts portal messages by urgency + suggests responses
- Care-gap outreach — identifies overdue preventive care, automates reach-out
BAA-eligible vendors
- LLMs: Anthropic (signs BAA on Enterprise + AWS Bedrock), OpenAI Enterprise, Azure OpenAI, Google Vertex (Med-PaLM 2)
- Voice/STT: Deepgram (BAA), Google Speech (BAA), Azure Speech (BAA), AWS Transcribe Medical
- Scribes: Abridge, Suki, DeepScribe, Nuance DAX, Heidi Health
- Chat: Intercom (BAA on Enterprise), Salesforce Health Cloud, Microsoft Copilot for Healthcare
AI scribes — the dominant 2026 healthcare AI
Ambient AI scribes are the fastest-adopted AI in healthcare history. Why:
- Average physician saves 1–2 hours/day of charting
- Burnout scores drop 25–40% in measured deployments
- Note quality typically improves vs human baselines (more complete)
- Payback: 2–4 months
Top vendors: Abridge (best enterprise), Suki (best multi-EHR), Heidi (best price), Nuance DAX (best Epic integration).
AI in revenue cycle management
- Prior auth: 60–80% touchless submission
- Denial appeals: 3–5x faster turnaround
- Coding assistance: 5–15% revenue capture improvement
- Payment posting: 90%+ touchless
Want a HIPAA-safe AI build? Talk to us.