---
title: "HIPAA"
description: "HIPAA sets privacy and security rules for U.S. health data held by covered entities and their business associates. Why pasting PHI into AI tools is a HIPAA disclosure event."
url: "https://sonomos.ai/glossary/hipaa/"
source: "https://sonomos.ai/glossary/hipaa/"
---

# HIPAA

The U.S. Health Insurance Portability and Accountability Act, which sets privacy and security rules for individually identifiable health information held by covered entities.

## In depth

HIPAA (Health Insurance Portability and Accountability Act, 1996) governs how covered entities — providers, plans, clearinghouses — and their business associates handle Protected Health Information (PHI). The Privacy Rule restricts disclosure; the Security Rule requires administrative, physical, and technical safeguards; the Breach Notification Rule mandates reporting. HIPAA does not directly regulate consumer-facing AI services like ChatGPT, but the moment a covered entity or business associate sends PHI to an AI service that has not signed a Business Associate Agreement (BAA), that transmission becomes a disclosure event the covered entity is responsible for.

## Examples

- A clinician pasting a patient's chart note into ChatGPT for summarisation — a disclosure event because OpenAI is not a BAA-covered partner.
- A medical biller routing claim data through an unsanctioned AI tool to draft appeal letters.
- A health-plan analyst using a personal Gemini account to forecast utilisation from member-level data.

## How Locke handles hipaa

Locke detects patterns consistent with PHI — MRNs, ICD-10/CPT codes, NPIs, demographic combinations — locally, before any text reaches an AI tool. Because Sonomos itself never sees the data, no new BAA is required. See the Healthcare page for the full regulatory walk-through.

[See the product](https://sonomos.ai/locke/)

## Related terms

- Protected Health Information (PHI)

  Individually identifiable health information held or transmitted by a covered entity, regulated under HIPAA in the United States.
- Business Associate Agreement (BAA)

  A HIPAA-mandated contract between a covered entity and a vendor that handles PHI on its behalf, defining each party's privacy and security obligations.
- Data Loss Prevention (DLP)

  A category of security tooling that inspects outbound data flows to prevent sensitive content from leaving an organisation's control.

## Reading on this topic

- [HIPAA-Compliant AI: A Complete Checklist for Healthcare Organizations in 2026](https://sonomos.ai/blog/hipaa-compliant-ai-checklist-2026/)
- [Is Gemini HIPAA Compliant? Workspace, Vertex AI, and the BAA in 2026](https://sonomos.ai/blog/is-gemini-hipaa-compliant-2026/)
- [Is Claude HIPAA Compliant? A 2026 Guide for Healthcare Providers](https://sonomos.ai/blog/is-claude-hipaa-compliant-2026/)
- [Is ChatGPT HIPAA Compliant? A 2026 Guide for Clinicians and Health Tech Teams](https://sonomos.ai/blog/is-chatgpt-hipaa-compliant-2026/)