HIPAA Business Associate Agreement

A HIPAA Business Associate Agreement is a legal promise a hospital gets in writing from any outside company that will handle patient information, before handing that information over.

It's similar to how a landlord gets a moving company to sign a contract saying "we'll be liable if anything is lost or damaged" before letting them handle the belongings. When a hospital wants to send sensitive information like medical records or test results to an outside vendor — a cloud service or an AI chatbot, for example — it requires that vendor to sign a document pledging to protect the information to the same standard the hospital itself must meet. That document spells out specifics: how the data will be encrypted, who can access it, and how quickly a breach must be reported if one happens.

Under U.S. law, without this agreement in place, a hospital cannot share patient information with an outside service at all. So before any service can connect an AI chatbot to a hospital's electronic health record system, this kind of agreement has to already be established between the hospital and the AI company.