Being able to technically process a scanned medical record and being authorized to handle PHI under HIPAA are two different things — and most AI tools, including general-purpose ones, are not set up for the second one unless a specific agreement says otherwise.
The gap buyers in healthcare run into
A tool can be excellent at OCR, redaction, or summarization and still not be a HIPAA business associate — meaning using it on real patient data without the right agreement in place is a compliance problem regardless of how good the tool is technically.
What to ask, before sending PHI to any vendor
Ask directly: will you sign a Business Associate Agreement before I send PHI? What happens to the data if I don't have one in place? To be direct about where this site stands: we are not a HIPAA business associate by default — a separate agreement would need to come first, and that hasn't been put in place. Treat any non-PHI processing accordingly until it has.
Where this breaks down — said plainly
- This is a compliance checklist, not a guarantee. A signed BAA with any vendor doesn't eliminate your own obligations under HIPAA; it's one requirement among several.
- "HIPAA compliant" as a marketing phrase means nothing on its own — the actual BAA, and what it covers, is what matters.
Related guides
Where this fits on the site: this is part of how every job runs here, across all services. See Services & Pricing for what's actually sold, or go straight to Choose your job.