PHI, BAAs, and AI: A Plain-Language Primer for Behavioral Health

Most AI privacy questions in behavioral health come down to four terms: PHI, de-identified, BAA, and Part 2. If you understand those, you can have a real conversation with a vendor and with your attorney. This primer covers them in plain language.

It isn't legal advice. It's a map so you know which questions to ask.

PHI: what it is

Protected health information, or PHI, is health information that can identify a person and is held by a HIPAA covered entity or its business associate. It covers past, present, or future physical or mental health, the care someone received, and payment for that care.

In a behavioral health program, nearly everything is PHI. A name on an intake form. A phone number in your call log, tied to the fact that someone called a treatment center. A drug screen result. An insurance member ID. A text reminder log. A therapy note.

Who's covered. HIPAA applies to health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with standard transactions like claims, according to HHS's covered entities page. It also applies to business associates. Some recovery coaches, recovery community organizations, and sober living homes may not be covered entities. They still handle deeply sensitive information, and other laws may apply.

De-identified data: the safe zone

Data that has been properly de-identified is not PHI. That's why the safest first uses of AI are the ones built on de-identified or aggregate data.

HIPAA recognizes two methods, described in the HHS de-identification guidance:

• Safe Harbor. Remove 18 types of identifiers, including names, geographic units smaller than a state (with a limited exception for parts of ZIP codes), all elements of dates except the year, phone numbers, email addresses, record numbers, device identifiers, IP addresses, photos, and any other unique identifying number or code. And you can't have actual knowledge that what's left could identify the person.
• Expert Determination. A qualified expert applies statistical or scientific methods and documents that the risk of re-identification is very small.

Removing names is not de-identification. A spreadsheet with admission dates and ZIP codes can point straight at a person, especially in a small town.

Aggregate data (counts, averages, rates) is usually safe when the groups are big enough. Small counts can identify people. If a report says one person from a small county was admitted this month, that may be enough.

BAAs: the contract that has to exist

A Business Associate Agreement is a contract HIPAA requires between a covered entity and a vendor that creates, receives, maintains, or transmits PHI on its behalf. HHS's business associates page lists examples, and one of them is a third-party AI chatbot on a provider's patient portal that handles patient information for things like symptom assessment, reminders, and scheduling.

HHS publishes sample BAA provisions. A BAA generally spells out what the vendor may use and disclose, requires safeguards, requires breach reporting, and requires the vendor to pass the same terms down to its subcontractors.

A few things people get wrong:

Encryption doesn't get a vendor out of it. HHS's cloud computing guidance says a cloud service provider that stores encrypted ePHI is a business associate even if it doesn't have the key.

The chain matters. An AI agent vendor often uses a phone provider, a transcription service, a cloud host, and an AI model provider. Each one that handles PHI needs to be covered by a BAA, either with you or with the vendor as a subcontractor agreement. Ask for the list.

Consumer versions are usually different. A company may offer a BAA on an enterprise or healthcare plan and not on its free or consumer product. The plan you're on is what counts. Get the BAA in writing for the specific product your staff uses.

A BAA isn't a safety certificate. It makes the vendor responsible for protecting data. It says nothing about whether the AI gives accurate answers, handles crises well, or belongs in clinical work.

Part 2: the extra layer for SUD records

If you run a federally assisted substance use disorder program, your records are also governed by 42 CFR Part 2. HHS updated the rule in 2024 to align it more closely with HIPAA, and compliance was required by February 16, 2026, according to the HHS Part 2 fact sheet.

Key points from the fact sheet:

• Patients can now give a single consent for future uses and disclosures for treatment, payment, and health care operations.
• Records still can't be used in civil, criminal, administrative, or legislative proceedings against the patient without consent or a court order.
• Breach notification rules now mirror HIPAA's.
• A new category, SUD counseling notes, needs its own separate consent, similar to HIPAA's psychotherapy notes.

HHS's Office for Civil Rights began accepting Part 2 complaints and breach notifications on February 16, 2026, per its enforcement announcement.

For AI, Part 2 means you need to know where SUD records flow, whether your vendor's system respects consent scope, and whether anything could end up redisclosed. Ask counsel to review any AI tool that touches Part 2 records.

Minimum necessary

HIPAA's minimum necessary standard generally requires covered entities to limit uses and disclosures of PHI to the minimum needed for the purpose. It doesn't apply to disclosures to a provider for treatment, among other exceptions.

For AI this is a design rule. If the scheduling agent only needs a name, phone number, and appointment type, don't give it access to the whole chart.

Risk analysis

The HIPAA Security Rule requires covered entities and business associates to conduct an accurate and thorough assessment of risks to ePHI. HHS has guidance on risk analysis. Every new AI tool that touches ePHI belongs in yours.

Where the line sits, in one table

What you're doing	Data involved	What you need
Drafting blog posts, handbooks, FAQs	No patient data	Nothing special. Keep patient stories out.
Reporting volumes, wait times, trends	Properly de-identified or aggregate	A de-identification method you can explain. Watch small counts.
Phone or chat agent collecting intake	PHI (and possibly Part 2)	BAA, subcontractor list, risk analysis, Part 2 review, crisis handoff
AI scribe for sessions	PHI, often very sensitive	BAA, written client consent, review of every note, retention rules
Crisis response, clinical decisions, referral payments	Anything	Don't automate

Your next step

Make a list of every AI tool anyone on your team uses, including the free ones on personal phones. For each one, write down what information goes in and whether there's a BAA. That list is usually a surprise. Then take it to your counsel.

When you're ready to look at new tools, use the vendor evaluation guide. To keep your team out of trouble with the tools you already have, see the staff training guide.