Monday’s email says the AI vendor has added file search and a web connector. The practice approved the chat feature six months ago, so a manager assumes the green light carries over. It may not. The new release can add a retrieval store, another service, different logs, and a support path that the old review never covered.
That is the useful meaning of “HIPAA-compliant AI”: not a permanent label on a company, but a current decision about a named workflow. The decision has to survive changes in the service, contract, configuration, and people using it.
The release note that reopens approval
One AI platform can contain several data routes. Chat text may go straight to a model. File search may copy a document into an index. A meeting feature can create audio, a transcript, and a summary. A connector may send part of a prompt to another system. A support engineer may gain temporary access while investigating an incident.
The HHS cloud guidance says a cloud service provider that creates, receives, maintains, or transmits ePHI on behalf of a covered entity or business associate is itself a business associate. That remains true when the provider holds encrypted ePHI without the decryption key. A new place that maintains the data is therefore not a cosmetic product change.
Reopen the decision when a release adds a connector, retrieval feature, model provider, storage region, support channel, or new data-use term. Disable the feature for PHI until the review catches up. An approval that cannot name its change triggers is already stale.
Write an approval receipt
The output of review should be short enough for a staff member to use. Call it an approval receipt. Give the receipt an owner, effective date, and recheck date, then record:
- the exact product, account tier, feature, and region;
- the permitted user, task, data, and decision;
- the BAA parties, covered service, exclusions, and controlling document;
- the path through the model, retrieval store, logs, backups, export, and deletion;
- user roles and any vendor support access;
- written terms for training, evaluation, abuse monitoring, and subprocessors;
- the person who handles a wrong output, outage, misrouted record, or incident; and
- the changes that cancel the receipt and require a new decision.
Do not put a scribe, general chatbot, document assistant, and coding helper on the same receipt. They solve different tasks and can move data through different systems. “Enterprise AI” is not a sufficiently precise service name, just as “clinical use” is not a sufficiently precise purpose.
The receipt also prevents quiet account drift. A contract for an enterprise workspace may not cover a personal login, beta feature, or consumer plan. Product names and bundles change. Record the document version and setting you actually checked.
Send the change through seven questions
The review meeting does not need a long presentation. Put the proposed workflow on screen and answer seven questions in order.
1. Contract and BAA scope
Read the BAA beside the order form and current feature documentation. The HHS business-associate guidance describes business associates as people or organizations performing certain functions involving PHI on behalf of a covered entity. It also requires appropriate assurances from subcontractors. If the exact service, party, or account is missing, keep PHI out while the contract owner resolves it.
2. The complete copy map
Follow one realistic request through the prompt, uploaded files, retrieval index, model route, response, logs, support tooling, storage, export, backup, and deletion. Every copy needs an owner and a retention answer. A diagram that stops at the vendor’s front door is incomplete.
3. Settings that widen the route
Look for public links, broad workspace roles, long retention, optional history, copied prompts in debug logs, and connectors enabled by default. Test a denied user and a deletion. The successful demo shows what the tool can do; the denied path shows whether the configuration holds.
4. Vendor data use
Ask for contract language on model training, product evaluation, safety monitoring, abuse review, and human support access. “Your data is private” is not a usable answer if it never defines the service, purpose, or retention period.
5. Staff obligations
The HHS Security Rule summary covers administrative, physical, and technical safeguards. It includes risk analysis, workforce controls, access control, audit controls, authentication, integrity, and transmission security. Staff therefore need an approved account, a permitted-use rule, a reviewer for the output, and a clear route for errors. Encryption cannot substitute for those decisions.
6. Error and outage ownership
Name the human decision owner and the fallback workflow. A clinical output remains a draft for qualified review. A service outage needs a route that does not depend on the failed tool. A misrouted record needs an incident owner, preserved evidence, and a contact path.
7. Closure evidence
Keep the contract references, settings, screenshots, synthetic test results, unanswered questions, owners, and next review date together. NIST’s AI Risk Management Framework is voluntary, but its Govern, Map, Measure, and Manage functions are a useful reminder that a risk decision needs ownership, context, testing, and follow-through.
Use three verdicts, not a vague green check
An approval meeting should end in one of three states.
Approved for the named workflow means the receipt is complete, the exact configuration was tested with synthetic data, and the people who own privacy, security, clinical use, and operations accepted their parts.
Approved with conditions means the use can start only after named settings, training, or contract evidence are complete. Put an owner and due date on every condition. Until then, the feature stays off for PHI.
No PHI means a required BAA, service boundary, access control, retention answer, or accountable owner is missing. Staff can still use synthetic or properly de-identified data if policy allows, but the verdict is not permission to improvise with a real chart.
This language is deliberately narrow. It tells a user what is allowed today and tells the next reviewer what would invalidate the answer.
Run the re-approval drill
Take the newly announced feature and compare it with the existing receipt. Use synthetic data to send one representative request, try access from a denied role, delete the item, and open a support case. Observe where the request and support evidence appear. Do not rely on the sales demo or the behavior of the older feature.
Then make one of the three verdicts. If the change passes, issue a new receipt. If it does not, leave the old approval in place only for its old scope. That separation is the difference between feature governance and a vendor-wide badge.
Put Patient Square through the same gate
Patient Square is an AI clinical platform. Practice Copilot brings the whole practice under one AI copilot: an ambient AI Medical Scribe that hands back a structured SOAP note, ICD-10 suggestions, and a prescription draft minutes after the visit, plus a bundled AI EHR, scheduling, and messaging as you move up the plan. Hospitals get Hospital Copilot.
Patient Square states that it is HIPAA compliant, makes BAAs available, encrypts data with TLS 1.2 or higher in transit and AES-256 at rest, uses role-scoped logged access, and has a SOC 2 Type II audit in progress. Those statements are published on the Patient Square security page. They answer vendor questions; they do not replace a practice’s risk analysis, account controls, workflow policy, or feature-specific approval.
For an ambient documentation workflow, use the AI scribe BAA and consent guide and the AI scribe security checklist as inputs. review the current Practice Copilot scope, test the named workflow, and leave with a verdict your staff can follow.