Many telehealth companies use AI to generate patient replies if their employees aren't already doing so. Two central issues emerge when drafting patient correspondence using AI. Is your AI tool that accesses the patient's message covered by a business associate agreement (BAA)? Is your message being sent securely?

Data cam from the American Medical Association's 2026 survey concerning augmented intelligence. Augmented intelligence is is a subset of artificial intelligence in which AI technologies assist humans rather than replace them. A total of 1,692 US physicians contributed to the data collection, which occurred from January 15th to February 2nd, 2026. Among those who addressed the question of current AI use for patient portal response drafts, 19% confirmed they do. This was up from 9% in 2024.

 

What the AMA survey measured and what it did not

Doctors were asked in the survey to identify which of 17 AI applications they currently utilize. When it came to AI applications, crafting portal replies was close on the heels of tasks like summarizing research and handling documentation. Use of this feature has doubled over two years. The study doesn't specify the number of telehealth physicians using AI for message drafting, nor its effect on patient data. Therefore, let the 19% guide your company's expectations, but don't treat it as a precise measurement.

 

Why email-only telehealth practices face this question directly

Direct-to-patient businesses, especially those focusing on weight loss or hormone therapy, generally won't offer a patient portal. The patient will email a question, and a reply will be sent back through the same medium. Consequently, information is now held by the support desk, the AI platform, and email platform. Each of these represents a storage point for protected health information (PHI), and you'll need a definitive answer to the question of how they store and access it.

 

Does a drafting tool that sees patient messages need a BAA?

Usually yes. If a patient's message includes details about their medication, dosage, or any adverse reactions, it qualifies as PHI. Inputting that information into an AI chat means you could be revealing it to the AI vendor. HHS’s cloud guidance indicates that electronic PHI (ePHI) storage is permissible in the cloud when a BAA is in place with the vendor. It also states that “lacking an encryption key does not exempt a CSP from business associate status and obligations under the HIPAA Rules.” The existence of a BAA often varies based on the specific product level. A law firm released an article covering chatbots and HIPAA. They say most consumer products will not offer a BAA but some will at higher levels of the product. Ensure the BAA specifically covers the product your staff is using on their computers.

 

Which parts of a drafted reply carry PHI

A potential reply to a patient's email might combine the refill request with details like the medication, its dosage, and the shipping date. Every detail here serves to identify a patient's specific treatment. Restrict what an AI tool used for writing assistance can see as it generates your draft. A clinician can ask for a general explanation of a side effect they're unsure about. Patients' names and test results are not required for input. When patient information is required to finalize the response, verify that it's generated using a platform secured by a BAA.

 

Delivering the response to the patient

Several options exist to ensure the safe delivery of emails to your patients. According to HHS's commentary in the 2013 Omnibus Rule, covered entities have the option to send unencrypted emails provided the individual is aware of the risks and consents. Ensure your method of communication is informed by the risk assessment, and this will most likely direct you to secure means such as HIPAA compliant email. You can also notify patients that they have the option to receive communications through alternative means per 45 CFR 164.522(b). Make sure you are documenting these so you can send your responses to the correct location and method of communication.

 

Reviewing your AI generated drafts

In a JAMA Network study, physicians utilizing AI-generated responses spent more time reading, with no significant change in the speed of their replies, though their answers tended to be more extensive. The investigation looked into how much time physicians spent and how long their answers took. Researchers in npj Digital Medicine commissioned a study where 20 primary care doctors reviewed 18 patient portal messages. The AI's generated responses had errors in four instances. The report indicates that between 35% and 45% of AI-generated responses containing mistakes were dispatched without any review.

 

Be aware of shadow AI in your organization

According to a survey by Paubox of 150 healthcare organizations in the US, 95% of companies have employees using AI in their emails. And 1 in 4 have not implemented an approved method of using AI. A data sheet by Paubox mentions that 85% of Health IT leaders believe shadow AI is happening on their platform. Only 26% know it is happening. Make sure your telehealth company has an approved AI tool and email program that staff can utilize to respond to patients. If you do not provide them with that, they will use what works best for them.

 

How HIPAA compliant email fits in

All of your emails that leave Paubox are encrypted by default. No need to remind your staff to hit that encrypt button. Paubox also provides a secure email API for your transactional emails, while offering AI-powered inbound email security to identify any phishing attempts.

See also: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQs

Does HIPAA prohibit using AI to draft replies to patients?

No, but any AI vendor that receives PHI to produce the draft generally needs a BAA, and the clinician remains responsible for the content of the reply.

 

Can a patient choose to receive replies by unencrypted email?

Yes, if the patient has been told about the risk and still asks for it, although that choice is the patient’s and should not become your organization’s default.

 

Does encrypting the outgoing email cover the AI drafting step?

No, because encryption protects the message in transit and does not address what the AI vendor did with the patient’s information before the reply was sent.