Definition
U.S. federal law governing how covered entities (hospitals, health plans, providers) and their business associates protect Protected Health Information (PHI). Consumer AI products are generally not covered entities.
Key Points
- Consumer chatgpt-health (Free/Go/Plus/Pro) does not operate under a HIPAA Business Associate Agreement
- Connecting EHR data to a consumer AI assistant typically moves that copy outside HIPAA jurisdiction into ToS/state privacy regimes
- openai offers separate HIPAA-eligible enterprise/clinical products — distinct from consumer Health
- Critical framing for privacy journalism: “not HIPAA” ≠ “no privacy controls,” but legal protections differ