When we consider HIPAA's definition of PHI within 45 CFR 160, it is clear that any AI conversation identifying a patient's health information qualifies as PHI for a HIPAA covered entity once it is in possession of it. It could be as simple as an email to the practice that's not yet in the patient's file.

The qualification of AI transcripts as PHI stands even without a formal diagnosis, including any chat concerning symptoms or medication questions. So when using a telehealth service, practices should be mindful of this, even if patients began the exchange on their own personal device, the medical practice itself must recognize the AI chat transcript as PHI once it is in their possession.

 

How the rest of the email can identify the patient

To meet HIPAA requirements, covered entities must follow HHS's guidance on de-identifying individuals. Removing a name by itself is not enough to ensure the remaining data meets de-identification standards.

Suppose a patient were to remove their name from a prescription discussion message in the AI transcript as a way to de-identify it. They might, however, still send their healthcare provider an email from an address the practice recognizes as belonging to that patient through a name or previous patient records. The patient's health data has therefore not been properly separated from their identity.

The same potential for exposure applies when practices and their staff review forwarded messages or any summaries. Even a few lines can be enough to identify a patient. Before sending, protocols should be in place to verify the intended recipients, the presence of attachments, and the quoted email thread. De-identification is not enough, and covered entities should ensure all communications are secure before sending them through the use of resources like Paubox’s HIPAA compliant email suite, which offers secure encryption, amongst other benefits.

 

Check every service that handles the conversation

Paubox’s report Shadow AI Is Outpacing Healthcare Email Security states, “75% of respondents say AI has added confusion, not clarity, to email compliance at their organization.” The review Privacy-Enhancing Technologies in Biomedical Data Science explains, “Conventional approaches for protecting privacy of biomedical data include policies and laws, technical security measures, and contractual agreements.” It defines business associate agreements (BAAs) as “contracts between HIPAA-covered entities” and their business associates, including outside providers handling PHI.

Business associate agreements as described by the HHS are needed for these situations. Covered entities should ensure the agreement clearly outlines the product's or service's actions, as discussed in Paubox's article for healthcare organizations on AI meeting assistants.

Here is the practical application when receiving a transcript through email:

  1. Is there an AI being used to summarize this conversation? Do you have an agreement that will allow that?
  2. Does it connect to other services that may place that transcript in a ticket, activities, or something else?
  3. Who will have access to those copies? Does the company keep those transcripts and use them to train their model?
  4. Any email provider should be reviewed as well, with proper agreements and security measures for PHI it processes and stores.

 

Turn the transcript into a clear, protected follow-up

The consensus guideline FUTURE-AI: international consensus guideline for trustworthy and deployable artificial intelligence in healthcare states, “Given the high stakes nature of medical AI, human oversight is essential and increasingly required by policy makers and regulators.”

Applied to conversations with patients, this would mean having a clinician verify any clinical information before replying using AI-generated responses. A chatbot's suggested condition should not automatically be treated as a confirmed diagnosis. The patient's reported symptoms must be distinguished from both chatbot suggestions and clinician assessments.

A patient might reach out in an email to inquire about a chat they had concerning medication. The provider can look over that and send back further guidance on the next steps. It is, however, necessary to ensure that patients have the opportunity to ask follow-up questions.

 

FAQs

Can a patient request a copy if we used the transcript for care decisions but kept it outside the main chart?

Generally yes, because records used to make decisions about patients can fall within the patient’s access rights even outside the main chart.

 

What if an AI summary puts something in the record that the patient never said?

Patients can request a correction, and the practice must assess the request and explain any denial.

 

Does HIPAA require us to keep every chat transcript for six years?

HIPAA does not set medical record retention periods, so check applicable state law, other requirements, and your retention policy.

 

Can we use a concern mentioned in the chat to target a promotional email?

Medical practices generally need the patient’s HIPAA authorization if the email meets the marketing definition and no exception applies.