HIPAA

HIPAA governs protected health information handled by covered entities, health plans, providers and clearinghouses, and by their business associates, vendors that handle protected health information on a covered entity's behalf. A vendor acting as a business associate must sign a Business Associate Agreement setting out how it will safeguard that data, and the Department of Health and Human Services' Office for Civil Rights enforces the requirement.

HIPAA was enacted on August 21, 1996. Covered entities have had to comply with the Privacy Rule since April 14, 2003, and with the Security Rule since April 21, 2005.

Any AI system that reads, stores or summarizes patient information is handling protected health information. A clinical intake agent summarizing patient notes on a hospital's behalf is doing exactly the kind of processing a Business Associate Agreement is meant to cover, whether or not anyone thought of it as a HIPAA question at the time.

In Dynamiq, HIPAA is supported with a signed Business Associate Agreement available, and PII detection can flag identifiable information before it reaches a model or leaves a workflow, so a healthcare team can see where protected health information enters a process before deciding how that step should be handled.

Sources: HHS.gov, Summary of the HIPAA Privacy Rule, HHS.gov, Summary of the HIPAA Security Rule