As healthcare organizations increasingly integrate AI-based tools into their vendor offerings, a pressing question arises: who has ownership over the data, and what rights does the vendor have regarding its use? Under HIPAA, data ownership is not explicitly defined. It primarily outlines how protected health information (PHI) can be used and shared, leaving ownership issues and data usage rights to be clarified in contractual agreements. This discussion emphasizes the vital considerations healthcare entities must take into account when partnering with vendors that utilize AI technologies.
In the context of HIPAA, vendors who “create, receive, maintain, or transmit” PHI on behalf of a covered entity are labeled as "business associates." This broad definition includes health IT companies, cloud service providers, and data analytics platforms, as well as AI-powered tools that manage patient data or clinical records. Notably, even a vendor handling encrypted electronic PHI (ePHI) qualifies as a business associate, a point highlighted by the HHS’s Office for Civil Rights in December 2022 guidance regarding HIPAA and cloud computing. Therefore, simply hosting or processing PHI—irrespective of encryption—triggers HIPAA compliance requirements.
Once deemed a business associate, a vendor must sign a HIPAA-compliant Business Associate Agreement (BAA) before accessing PHI. This agreement outlines acceptable uses and disclosures of PHI, imposing direct HIPAA obligations on the vendor.
Many organizations might be surprised to find that just because a vendor has access to PHI does not mean it can use that data for AI training or product enhancement. According to HIPAA, a business associate is permitted to use or disclose PHI only as outlined in its contract or as legally required. If the BAA does not specifically allow such uses, the vendor must refrain from engaging in them, no matter the vendor's internal justifications for those activities.
The BAA may allow for limited uses of PHI for the vendor's internal management purposes and data aggregation services related to the covered entity’s operations, but these terms should be narrowly interpreted. Vendors sometimes attempt to categorize AI model training under these provisions, making it crucial for the BAA to explicitly define whether AI utilization falls within these limited categories.
Federal regulations around interoperability do not alter this dynamic; vendors cannot assume they have a blanket right to use any received data simply because it relates to interoperability. Those regulations focus on the access and sharing of ePHI for permitted activities and do not grant a new right for vendors to use PHI for AI model training purposes outside the BAA.
Organizations should be cautious not to take a vendor's generic agreement at face value, as these documents may contain broad data usage provisions that conflict with HIPAA requirements. The BAA must clearly articulate what the vendor is allowed to do with PHI, ensuring those uses do not exceed the permissions available to the covered entity under HIPAA.
De-identification of PHI presents an alternative pathway for vendors wishing to utilize healthcare data for AI development. The HIPAA Privacy Rule permits covered entities to share PHI to generate information that is not identifiable, freeing that data from HIPAA restrictions. However, proper de-identification is not straightforward; HIPAA stipulates that either a specific set of identifiers must be removed or a qualified expert must verify that the risk of re-identification is minimal. Organizations should remain vigilant regarding vendor claims of data anonymization to ensure they comply with HIPAA standards.
When establishing agreements with AI-focused vendors, healthcare organizations need to incorporate several practical measures to safeguard their data and comply with regulatory standards.
1. Explicitly clarify whether model training using PHI is permitted or prohibited, avoiding ambiguous language. 2. Ensure that any restrictions on data use extend to any third-party vendors or subcontractors associated with the primary vendor. 3. Incorporate terms that allow for audits of the vendor's data handling practices and require clear communication about any data breaches or unauthorized use of PHI. 4. Address how PHI will be handled at the termination of the BAA, ensuring provisions for the return or destruction of data, which should comply with recognized standards. 5. Define the ownership of any outputs or derivatives generated from the use of the data to prevent disputes over intellectual property rights.
In addition to HIPAA, other regulations, such as state privacy laws and emerging AI legislation, may also apply to personal data outside of HIPAA's reach.
In summary, if the terms related to the use of PHI within an AI vendor's contract do not permit it, the vendor is prohibited from such use. For organizations navigating these intricacies, expert guidance can help refine vendor relationships and contractual practices.
