Is AI note-taking HIPAA compliant?
By Steven Van ·
Oasys Health says AI scribe compliance comes down to a BAA, Security Rule safeguards and authorized use, since no AI-specific HIPAA rule exists yet.
There is no HIPAA rule written specifically for AI note-taking, and Oasys Health says there won't be one soon. In a post on the question, the company argues that an AI scribe is compliant when the same three requirements any software touching a client record must meet are in place.
The three requirements
- A signed Business Associate Agreement (BAA) with every vendor in the pipeline. Transcription, drafting and storage are often three separate companies.
- The current Security Rule's safeguards actually implemented, such as access controls, audit logging and encryption in transit.
- The AI's output used and stored like any other protected health information, and only for the clinical purpose it was authorized for.
Oasys says "HIPAA compliant AI" is not a certification a vendor earns once. It depends on how a specific practice has a specific tool configured. A signed BAA is necessary but not sufficient: a practice that disables logging or lets staff share logins can be out of compliance on compliant software.
Where the rules stand
HHS proposed an overhaul of the HIPAA Security Rule in December 2024 and published it in the Federal Register on January 6, 2025. It has received more than 4,700 public comments. The proposal would remove the "addressable" category, making things like encryption and multi-factor authentication mandatory. Oasys says the final rule has slipped to at least July 2027.
HHS also published a Request for Information on accelerating AI adoption in clinical care on December 23, 2025. The post treats both as unresolved, so today's answer runs through the existing Security Rule and Privacy Rule.
What to ask a vendor
Oasys says a practice should ask to see the BAA before asking about features, and should ask what it covers:
- Which sub-processors it names.
- What happens to raw audio versus the finished note.
- How a breach is reported, and on what timeline.
- What retention window applies to raw audio, whether it is the same for in-person and telehealth sessions, and whether the clinician or the practice controls it.
- Whether the vendor's models train on session content.
Oasys says it treats every vendor that touches session audio or a drafted note as a HIPAA business associate by default.
ChatGPT and therapy notes
The post also addresses ChatGPT. It says consumer ChatGPT has no BAA available to a therapy practice, so pasting client information into it is a HIPAA exposure. A BAA-covered enterprise or API deployment is a separate question.
