Why it matters for your business
Any AI tool, automation platform, transcription service or developer that handles patient information for a covered entity generally needs a signed BAA, and that includes model API providers. Many vendors offer BAAs only on certain plans or for specific services, and consumer AI chat apps are typically not covered. Using an uncovered tool with patient data can be a HIPAA violation even if nothing is breached. A BAA is necessary but not sufficient: access controls, audit logs and minimum necessary data handling still apply. Confirm the details with your compliance counsel.
Example
A physical therapy practice wants an AI assistant that drafts visit notes from session recordings. Before any build, it confirms that the transcription service, the language model provider and the hosting platform will each sign a BAA covering the services used, and that the development firm signs one too, since it may access recordings during testing.