Many AI contracts cap vendor liability at twelve months of fees, which falls to zero if an incident happens years later.

 

What happened

HIPAA applies to an AI tool the moment it can reach protected health information, "Same as it does to every other technology," said Tatiana Melnik, a Tampa health care attorney with Melnik Legal who represents physician practices, speaking to Medical Economics at the Medical Group Management Association annual conference on September 28. Practices are using these tools to draft visit notes, schedule appointments, and handle prior authorizations. Her first recommendation is to go back through vendor contracts, both existing and new, and establish what consents the practice has already granted.

 

Going deeper

Liability caps are where the contracts fail. Many of these agreements limit the vendor's liability to twelve months of fees paid before an incident, Melnik said. Where the contract also lets the vendor keep patient data after the relationship ends, an incident three years later falls outside that window entirely. "Then the damages cap is zero," she said, and under HIPAA the covered entity carries most of the risk regardless. She named two contract terms practices should pin down before signing. Usage data clauses conventionally cover the clicks a vendor tracks to troubleshoot its software, and it is not settled whether an AI prompt now falls inside that definition. Confidential information needs the same treatment, alongside whether the vendor may retain data after termination and whether it is technically able to delete it.

 

What was said

"Now, in the age of AI, you might decide it's high risk because re-identification is so easy," Melnik told Medical Economics, describing a decision to let a vendor de-identify patient data that would have looked low risk before these tools existed. On consent, her recommendation is to ask patients directly and obtain affirmative agreement, with a process ready for those who refuse. A practice may be able to switch the tool off for that patient, or may decide, as some did when electronic records arrived, that patients who object cannot be seen there.

 

In the know

Patients in California have filed consumer class actions against practices and hospital systems using AI scribes, arguing they did not consent to being recorded, according to Melnik's account. She expects malpractice carriers to begin denying coverage in some cases involving AI, such as where a physician signed off on a note the scribe produced without reviewing it, with the carrier arguing in her words that "that's a technology issue. That's not a malpractice issue." She drew the comparison to electronic health records, whose audit trails gave plaintiffs' attorneys a way to question notes edited months after a visit.

 

The big picture

Research published this year reached the same conclusion about where liability lands, finding that any disclosure of protected health information to an AI system outside HIPAA safeguards is a violation under the law's strict liability framework even where the actual risk of exposure is low, in an analysis of AI use in emergency department workflows. Its authors note that even well-intentioned use, such as generating discharge instructions through a chatbot, can produce an unauthorized disclosure where no business associate agreement is in place. Melnik points practices toward a document they already maintain, saying the notice of privacy practices is the right place for AI disclosures and that "there is no reason why they can't add AI terminology to their existing notice of privacy practices." Patients arriving having consulted a chatbot about symptoms should be handled through whatever process the practice already uses for patients who searched online, in her assessment.

 

FAQs

Why does data retention after termination matter so much?

A liability cap measured in fees paid before an incident assumes the incident happens during the relationship. If the vendor still holds patient data years after the contract ends and suffers a breach, then no fees were paid in the relevant period, and the cap provides nothing.

 

What is a usage data clause?

A contract term covering information the vendor collects about how its software is used, historically clicks and navigation data for troubleshooting. Whether the text a clinician types into an AI tool falls within that definition is the open question, and practices should establish the answer before signing.

 

Has re-identification changed the calculation on de-identified data?

In Melnik's assessment, yes. Permitting a vendor to de-identify patient data was previously a low-risk concession. The ease of re-identification now makes it worth treating as a high-risk term.

 

How should a practice handle a patient who declines an AI scribe?

With a process decided in advance. Options include turning the tool off for that encounter or declining to see patients who object, and the decision needs to be made before a patient raises it rather than at the point of care.

 

Where should AI disclosures go?

Into the notice of privacy practices the practice already maintains under HIPAA. Adding AI terminology there covers every patient through an existing document rather than requiring a separate form.