Is AI medical coding HIPAA-compliant?

Table of Contents

1. What is HIPAA-compliant AI medical coding?
   1. The direct answer: yes, with conditions
   2. Covered entities and business associates in AI coding
   3. Why AI introduces new PHI risks
2. How does HIPAA compliance work for AI medical coding?
   1. The three HIPAA rules that govern AI coding
   2. Minimum necessary standard and AI data access
   3. What a BAA must cover for AI coding vendors
3. HIPAA-compliant AI coding vs consumer AI tools: what is the difference?
   1. Encryption, access controls, and audit logs
   2. Data retention and model training policies
   3. De-identification: Safe Harbor vs Expert Determination
4. How do you check if your AI coding vendor is HIPAA-compliant?
   1. Questions to ask any AI coding vendor
   2. Security certifications to verify
   3. Quick test: check your vendor's HIPAA readiness
5. What do people get wrong about HIPAA-compliant AI coding?
   1. Shadow AI and unsigned BAAs
   2. Training on PHI without authorization
   3. Treating AI output as final without human review
6. What should you do next to stay compliant?
   1. Update your risk analysis
   2. Establish human-in-the-loop workflows
   3. Document your AI vendor inventory
7. Takeaways
8. Frequently asked questions
   1. Can AI be used for medical coding under HIPAA?
   2. Does my AI coding vendor need to sign a BAA?
   3. Can AI vendors train their models on patient data?
   4. Are standard consumer AI chatbots HIPAA-compliant for medical coding?
   5. What is human-in-the-loop in AI medical coding?
9. Next steps

---

Yes, AI medical coding can be HIPAA-compliant, but only when three conditions are met. The vendor signs a Business Associate Agreement (BAA), the covered entity updates its risk analysis before deployment, and required technical safeguards are in place. Each section gives you something to check, ask, or do this week.

This article is not legal advice; consult your compliance officer or legal counsel for your situation.

What is HIPAA-compliant AI medical coding?

HIPAA-compliant AI medical coding uses AI to suggest ICD-10-CM, CPT, or HCPCS codes from clinical documentation. It must satisfy all applicable HIPAA Privacy, Security, and Breach Notification Rule requirements.

The direct answer: yes, with conditions

Three conditions must be met before any chart is processed. The vendor signs a BAA, the covered entity conducts and documents a risk analysis, and the tool implements required technical safeguards including encryption and access controls. HIPAA is technology-neutral, so the same rules that govern any business associate apply to an AI coding vendor.

Covered entities and business associates in AI coding

When an AI tool processes protected health information (PHI) to suggest codes, the vendor becomes a business associate under HIPAA. A signed BAA must be in place before the first chart is processed. Without it, every chart the AI sees is an unauthorized PHI disclosure.

Business associates are directly liable for their own HIPAA violations. Covered entities are responsible for taking corrective action, including curing the breach or terminating the contract if feasible, upon learning of a material breach by a business associate. Delegating coding to an AI vendor does not delegate the covered entity's own HIPAA obligations.

Why AI introduces new PHI risks

Traditional rule-based coding engines do not learn from input data. They look up codes from structured inputs and do not retain PHI in model weights. Generative AI models are different. They can retain or memorize PHI from training data, creating downstream disclosure risks that rule-based systems never produce.

The proposed HIPAA Security Rule published January 6, 2025 clarifies that the Security Rule governs ePHI used in AI training data. It also governs prediction models and algorithm data maintained by regulated entities. HHS notes that generative AI tools have produced the names and personal information of people in their training data.

How does HIPAA compliance work for AI medical coding?

HIPAA compliance for AI coding rests on three rules, a minimum access principle, and a contract that defines what the vendor may do with PHI.

The three HIPAA rules that govern AI coding

Three HIPAA rules apply to AI coding. The Privacy Rule governs permissible uses and disclosures of PHI, including the minimum necessary standard. The Security Rule requires administrative, physical, and technical safeguards for electronic PHI (ePHI).

The Breach Notification Rule requires notification of unauthorized PHI disclosures to affected individuals, HHS, and in some cases the media. Business associates must notify covered entities of a breach without unreasonable delay and no later than 60 days after discovery.

Minimum necessary standard and AI data access

The minimum necessary standard requires that AI tools access only the PHI needed for coding, not entire patient histories. Vendors often want broad datasets to optimize performance, which conflicts with this requirement. Covered entities must configure access to limit exposure, ingesting only required fields and excluding full notes or images when summaries suffice.

What a BAA must cover for AI coding vendors

A BAA must define permitted data uses, including whether the vendor may train models on customer PHI. Training on PHI generally requires patient authorization or proper de-identification under Safe Harbor or Expert Determination methods per 45 C.F.R. § 164.514. The BAA should also address data retention, deletion procedures, subcontractor flow-down obligations, and breach notification timelines.

CLAIRE's AI Medical Coding Assistant pairs each suggested code with its clinical reasoning, so coders can verify accuracy rather than blindly accepting AI output.

The NPRM would require encryption of ePHI at rest and in transit, multi-factor authentication, and a technology asset inventory, which HHS expects to list AI software interacting with ePHI.

HIPAA-compliant AI coding vs consumer AI tools: what is the difference?

Consumer-grade AI tools are not HIPAA-compliant and cannot process PHI unless offered under an enterprise agreement with a signed BAA.

Encryption, access controls, and audit logs

A compliant AI coding tool encrypts ePHI at rest and in transit. HIPAA does not name an algorithm, but HHS guidance points to NIST standards, and AES-256 at rest with TLS 1.2 or higher in transit are the common benchmarks consistent with them. It enforces role-based access control and multi-factor authentication. Audit logs record every instance of PHI access with user identity and timestamp, retained for HIPAA's six-year documentation-retention period.

Consumer-grade tools typically lack these controls. If a tool does not offer a BAA and enterprise-grade security configuration, processing PHI through it would constitute an unauthorized disclosure under HIPAA.

Data retention and model training policies

A compliant vendor defines how long PHI is retained and can delete it on request. The BAA specifies retention timelines and deletion procedures. Consumer AI tools may retain user inputs by default to improve their models, meaning PHI entered into the tool could persist indefinitely. If a vendor cannot confirm zero data retention or document deletion procedures, PHI processed through that tool remains at risk of unauthorized secondary use.

De-identification: Safe Harbor vs Expert Determination

De-identification must follow one of two HIPAA methods. Safe Harbor removes 18 specified identifiers from the data. Expert Determination involves a qualified expert in statistical methods certifying that re-identification risk is very small.

Vendor claims of "anonymized" data without meeting either standard are insufficient under HIPAA. If data is not fully de-identified under one of these methods per 45 C.F.R. § 164.514, it is still PHI, and all HIPAA requirements continue to apply.

How do you check if your AI coding vendor is HIPAA-compliant?

Use this checklist to evaluate any AI coding vendor before processing PHI. Each question has an acceptable answer and a red flag that should stop the conversation.

Questions to ask any AI coding vendor

Every question in the table above should get a specific, documented answer, not a general assurance. CLAIRE integrates ICD-10-CM, CPT, HCPCS, and ICD-10-PCS codes into a single searchable platform, reducing the need to switch between tools and minimizing PHI exposure across multiple systems. For a deeper evaluation framework, see CLAIRE's checklist for evaluating medical coding AI platforms.

Security certifications to verify

Verify independent security certifications before signing a BAA. SOC 2 Type II and HITRUST certification indicate the vendor has undergone third-party assessment of its controls. Ask for the current attestation report, not a marketing claim.

The proposed Security Rule NPRM would require business associates to verify their technical safeguards at least once every 12 months. This verification would take the form of a written analysis by a subject matter expert.

Quick test: check your vendor's HIPAA readiness

Open your AI coding vendor's terms of service or privacy policy. Search for "BAA" or "Business Associate." If the document does not mention a BAA, the vendor's default terms are not set up for HIPAA-compliant use. The same applies if it states that user data may be used to improve services or train models. This takes under a minute. It immediately tells you whether the vendor's default terms permit secondary use of your data.

What do people get wrong about HIPAA-compliant AI coding?

Five specific mistakes create HIPAA exposure when using AI for medical coding. Each one is preventable, but all of them appear regularly in healthcare settings.

• Using consumer AI tools with PHI and no signed BAA (shadow AI)
• Assuming data is de-identified without verifying Safe Harbor or Expert Determination compliance
• Allowing vendor contracts that permit "service improvement" use of PHI without patient authorization
• Treating AI-suggested codes as final without credentialed coder review
• Not maintaining audit logs that capture AI-suggested versus human-selected codes

Shadow AI and unsigned BAAs

Shadow AI is one of the most preventable HIPAA violations in AI coding. Coders who paste patient information into consumer AI tools without a signed BAA create unauthorized PHI disclosures for every chart processed. No pilot period or trial exemption excuses the BAA requirement. If a coder uses a consumer chatbot to look up an ICD-10-CM code and includes any PHI in the prompt, that is an impermissible disclosure, presumed to be a reportable breach unless a risk assessment shows a low probability that the PHI was compromised.

Training on PHI without authorization

Some vendor contracts include broad language permitting "service improvement" uses that constitute unauthorized training on PHI. Scrutinize every contract clause that mentions data reuse, and require the vendor to state its training policy in writing.

Treating AI output as final without human review

AI hallucinations can fabricate clinical information or misattribute data to the wrong patient. Inserting incorrect codes into a patient record without human validation undermines record integrity and creates billing-compliance risk. Billed codes must be supported by the medical record whether a human or an AI suggested them. A credentialed coder must review and approve every AI-suggested code before it enters the record, bearing the same accountability as on a manually coded claim.

What should you do next to stay compliant?

• Update your HIPAA risk analysis to inventory every AI tool that touches ePHI
• Require a signed BAA from every AI vendor before processing any PHI
• Define human-in-the-loop review checkpoints for every AI-suggested code
• Document your AI vendor inventory with data sensitivity classifications
• Schedule regular compliance audits including accuracy spot-checks and audit log reviews

Update your risk analysis

Update your organization's HIPAA risk analysis to inventory every AI tool that touches ePHI, including coding assistants and CDI query tools. Document the type and amount of data each tool accesses, how the AI uses or discloses ePHI, and who receives AI-generated outputs. The proposed Security Rule NPRM would require regulated entities to incorporate AI into their risk analysis and update it regularly to address changes in technology.

Establish human-in-the-loop workflows

Define review checkpoints where credentialed coders validate AI-suggested ICD-10-CM, CPT, and HCPCS codes before they enter the patient record. Audit logs must capture both the AI suggestion and the human decision, including override rationale. HHS set an April 3, 2026 internal deadline for its divisions to apply minimum risk management practices to high-impact AI. That deadline covers HHS's own use of AI, but it signals the direction federal oversight is taking.

Document your AI vendor inventory

Maintain a current inventory of every AI vendor that processes PHI on your behalf, classified by data sensitivity and volume. Verify that each BAA addresses model training, data retention, and breach notification. Vendors that provide explainable clinical reasoning for every code suggestion make human oversight easier to document during compliance audits.

Takeaways

• The proposed Security Rule NPRM published January 6, 2025 would require technology asset inventories that include AI, encryption of ePHI, MFA, and annual compliance audits.
• Using consumer AI tools with patient data is an impermissible disclosure, presumed to be a reportable breach

Frequently asked questions

Can AI be used for medical coding under HIPAA?

Yes, when the vendor signs a BAA and the covered entity conducts a risk analysis first. The proposed Security Rule NPRM published January 6, 2025 would require regulated entities to maintain a technology asset inventory.

That inventory must identify AI technologies interacting with ePHI. Regulated entities would also need to incorporate AI into their risk analysis processes. If finalized, it would also remove the distinction between "required" and "addressable" implementation specifications, making all safeguards mandatory.

Does my AI coding vendor need to sign a BAA?

Yes. Any vendor that processes PHI to suggest codes is a business associate under HIPAA. The proposed NPRM would require covered entities to conduct formal BAA risk assessments for every business associate, including AI vendors and evaluate them based on written security verifications. Business associates would also need to verify their technical safeguards.

Can AI vendors train their models on patient data?

Generally only with patient authorization or if the data is de-identified under Safe Harbor or Expert Determination per 45 C.F.R. § 164.514. The BAA should explicitly prohibit training on identifiable PHI by default. See the BAA requirements section above for the full contractual terms to include.

Are standard consumer AI chatbots HIPAA-compliant for medical coding?

No. Enterprise versions offered under a signed BAA may handle PHI, but the covered entity must still configure access controls, audit logging, and data retention settings before processing any charts.

What is human-in-the-loop in AI medical coding?

Human-in-the-loop is the oversight model where AI suggestions cannot be finalized without human approval. At least one state now requires it: since July 1, 2026, Indiana has barred providers from using AI to submit a health benefits claim without human review, making oversight a legal requirement there.

Next steps

If your organization is evaluating AI coding tools, apply the vendor checklist above before processing any PHI. CLAIRE's AI Medical Coding Assistant is built by coders for coders. Explore how CLAIRE supports compliant coding workflows for your team.