Which AI tools are HIPAA compliant, and what does that mean for your insurance?

What this means for you

• The tier is the compliance.The same model is compliant on one plan and prohibited on another. A clinic whose staff paste notes into a personal ChatGPT account has a HIPAA breach with every paste, while the practice next door using ChatGPT for Healthcare under a signed BAA does not. Make the approved tools a written list.
• A BAA is necessary and not sufficient.The agreement makes the vendor a business associate. Your side is access controls, audit logs, training, a risk analysis that names the tool, and a rule about what may be entered. An underwriter asks for exactly those documents, because a BAA with no controls behind it is the file they see after a breach.
• The insurance reads the tool list.A cyber or privacy claim arising from PHI entered into a tool with no BAA is a violation you caused, and some forms exclude regulatory penalties for knowing violations. Tech E&O for a vendor building on these APIs turns on the same question: whose BAA covers the model your product calls.
• Vendors building for healthcare inherit the whole chain.A startup selling an AI scribe or a patient-facing assistant is a business associate of every practice it serves and needs a BAA upstream with its model provider and downstream with each customer. Tech E&O, cyber and privacy liability are the three policies a hospital procurement team will ask that startup for, usually at $2,000,000 or more.

Related questions

Is there a list of HIPAA-compliant AI tools?

Not an official one, because HIPAA certifies nothing and no regulator publishes an approved list. What exists is each vendor’s statement of which products it will sign a BAA for. As of September 2026 that is ChatGPT for Healthcare and the OpenAI API, the Claude API, Bedrock and HIPAA-ready Claude Enterprise, Gemini in Workspace and Vertex AI, Azure OpenAI, and Amazon Bedrock. Every consumer tier of every one of those is excluded, and the clinical scribes built on top of them carry their own BAAs.

What happens if an employee puts patient information into a personal AI account?

It is an impermissible disclosure to a party with no BAA, which is a breach under the Privacy Rule regardless of what the vendor does with the data. The practice must assess it, and if it cannot show a low probability of compromise, notify the patients and HHS. Cyber insurance covers the response costs on most forms; whether it covers a penalty depends on the policy and on whether the violation was knowing. A written policy naming the approved tools is what turns a breach into a training failure.

What cyber covers after a breach

We are a health tech startup. Which insurance will a hospital ask us for?

Technology E&O and cyber, usually on one combined form, at limits of $2,000,000 to $5,000,000, with the hospital named as additional insured where the form allows and a certificate before onboarding. Larger systems add privacy liability wording and ask about your BAAs up and down the chain. A vendor whose product calls a frontier model needs to show that its own BAA with that provider exists, because the hospital’s BAA with you assumes it.

Tech E&O, placed for AI vendors

Does HIPAA apply to an AI tool used for scheduling or billing only?

Yes, when the data is protected health information, and appointment records with names and dates of service are. The rule follows the data rather than the purpose. A scheduling assistant, a billing bot and a chart summarizer are all business associates the moment PHI passes through them. The exception is data de-identified by a permitted method before it reaches the tool, which is outside HIPAA entirely.

Does our cyber policy cover AI-related HIPAA violations?

Most cyber forms cover breach response, notification and regulatory defense arising from a data incident, and an AI tool is a system like any other on that form. Two things narrow it in 2026. Some carriers have added AI-specific wording, affirmative or exclusionary, that has to be read. And a breach caused by knowingly using a tool with no BAA can fall into the exclusion for wrongful acts you knew about. Ask for the affirmative AI wording and keep the tool list current.

ChatGPT, tier by tier