HIPAA Considerations for AI Agents in Behavioral Health: A Working Checklist

Adding an AI agent to a behavioral health program is a HIPAA project, whether the vendor calls it one or not. This checklist covers the questions to answer before the agent touches protected health information. It's built from HHS sources, linked below, and it's meant to organize a conversation with your counsel and compliance officer.

1. Know whether HIPAA applies to you

HIPAA applies to health plans, clearinghouses, health care providers that conduct certain transactions electronically, and their business associates, per HHS's covered entities page. Some recovery coaches, recovery community organizations, and sober living homes may not be covered entities. Other laws may still apply, including the FTC's Health Breach Notification Rule for some non-HIPAA health apps. If your program handles substance use disorder records, also read the Part 2 and AI guide.

2. Get a BAA before any PHI goes in

A vendor that creates, receives, maintains, or transmits PHI for you is a business associate. HHS explains the requirements on its business associates page, and HHS guidance on cloud computing says a cloud provider storing encrypted ePHI is still a business associate even without the key. Track every agreement in one place. See the vendor BAA tracker.

Ask each vendor in writing: will our data be used to train models, how long is it kept, which subcontractors see it, and where is it stored?

3. Update your risk analysis

The Security Rule requires an "accurate and thorough assessment" of risks to electronic PHI (45 CFR 164.308(a)(1)(ii)(A)). HHS's risk analysis guidance says the process should be ongoing, and that when you plan to bring in new technology, the potential risk should be analyzed. Add each AI tool to the analysis: what ePHI it touches, who can access it, and what happens if it fails or is breached. Start with an AI tool inventory.

4. Send only what the task needs

HIPAA's minimum necessary standard generally requires limiting uses and disclosures to the minimum needed. For AI, that means designing each workflow so the tool sees only the fields the task needs. Where you can, use de-identified or aggregate data instead.

5. Audit your website and chat tools

HHS has published guidance on online tracking technologies used by HIPAA regulated entities. Chat widgets, pixels, and session recorders on admissions and intake pages deserve a close look. See the website tracking audit.

6. Check for discrimination risk

Section 1557's rule at 45 CFR 92.210 bars covered entities from discriminating through patient care decision support tools. HHS's Section 1557 FAQ says those tools include AI. Starting May 1, 2025, covered entities have an ongoing duty to make reasonable efforts to identify tools that use race, color, national origin, sex, age, or disability as inputs, and to mitigate the risk of discrimination. Ask your vendors what their tools take as inputs.

7. Keep a person in the loop

AI tools make mistakes. Decide, in writing, who reviews each kind of output before it's relied on: notes, letters, messages to patients, and anything that feeds a clinical, admissions, or billing decision. Test crisis handoffs before launch. See the crisis phrase test suite and the guide to what AI should never do in addiction treatment.

8. Train staff and write it down

Most AI privacy mistakes are a staff member pasting something into the wrong tool. Write a one-page policy, train on it, and check that it stuck. See the staff training guide and the staff AI policy quiz.

Bring this to your counsel

Every item above turns on facts about your program, your state, and your contracts. Use this list to prepare, then have your attorney and compliance officer sign off before launch.