Agents in RecoveryAI for compliance, risk management, and privacy staff
Compliance teams are often the last to hear about a new AI tool. The goal is to become the first, by making the approval path easy and the rules clear.
Who this is for
Compliance officers, privacy officers, risk managers, and security leads at treatment centers, mental health practices, and recovery organizations.
Your top challenges, and where AI can help
1. Shadow AI
The problem. Staff use free AI tools with patient details because nobody told them not to.
How an agent can help. Start an AI tool inventory and train with a staff AI policy quiz. A new hire policy assistant can answer routine questions from your own policies.
2. BAAs and subcontractors
The problem. AI products stack vendors: phone carrier, transcription, cloud host, model provider.
How an agent can help. Track every vendor, its BAA, its subcontractors, and renewal dates with a vendor BAA tracker. HHS's business associate guidance names a third-party AI chatbot that handles patient information as an example of a business associate.
3. Part 2 consent and redisclosure
The problem. SUD records carry stricter rules, and staff can't always tell what a consent covers.
How an agent can help. A Part 2 consent scope check shows staff what a consent covers before records go out. The HHS Part 2 fact sheet explains the 2024 changes, including breach notification for Part 2 records.
4. Trackers on intake pages
The problem. Ad pixels can collect what people type into forms and chat widgets.
How an agent can help. Run a website tracking audit. HHS's online tracking technologies guidance still stands in part, after a federal court vacated part of it in 2024. Treatment centers that advertise on Google should also see the ad certification readiness check.
5. Checking AI output at scale
The problem. Nobody can read every AI-drafted note or every call.
How an agent can help. Sample and score: an AI note compliance audit and admissions call quality review surface patterns for people to review. Run a crisis phrase test suite after every agent update.
6. Reports that identify people by accident
The problem. Small counts in grant or board reports can point to one person.
How an agent can help. Use a small-count suppression check and HHS's de-identification guidance.
Three starter steps
- Publish a one-page list of approved AI tools and what data each may receive.
- Add AI tools to your HIPAA risk analysis and your vendor BAA tracker.
- Run the crisis phrase test suite and the website tracking audit, and repeat both after every change.
Risks and guardrails for this role
- Risk analysis. HHS's risk analysis guidance expects you to assess risk when you bring in new technology.
- Part 2. Compliance with the 2024 Part 2 rule was required by February 16, 2026. See the HHS Part 2 fact sheet.
- AI calls and texts. The FCC confirmed in February 2024 that AI-generated voices are artificial voices under the TCPA. Have counsel review consent language.
- State law. Illinois's Wellness and Oversight for Psychological Resources Act limits AI in therapy. Check every state you serve.
- Non-HIPAA apps. If you run a consumer health app outside HIPAA, the FTC's Health Breach Notification Rule may apply.
- Ad certification. Google's addiction services ad policy generally requires certification such as LegitScript.
Every use case below keeps a person in charge of the decision. Agents gather, draft, sort, and remind. People approve.
Matching use cases (11)
Ad certification readiness check
Organizes the documents a treatment center needs before applying for addiction treatment ad certification.
Idea
Admissions call review on de-identified transcripts
AI scores admissions calls against your script so leaders can coach reps.
Idea
AI review of notes for documentation and billing gaps
AI scans clinical notes and flags missing elements and billing risks before payers find them.
Live product
AI tool inventory
A running list of every AI tool staff use, what data goes in, and whether a BAA exists.
Idea
Consent scope check before a disclosure
Shows staff what a patient's Part 2 consent covers before records go out.
Idea
Crisis phrase test suite for agents
A fixed set of test conversations run against every agent after every update.
Idea
New hire policy assistant
Answers new staff questions from the employee handbook and policy manual.
Idea
Small-count check before publishing a report
Flags any count in a report small enough to identify someone.
Idea
Staff AI policy practice quiz
Short scenario cards that teach staff what can and can't go into AI tools.
Idea
Vendor BAA tracker
Tracks which vendors have signed BAAs, their subcontractors, and renewal dates.
Idea
Website tracking audit for intake pages
Finds ad pixels and trackers on pages where people type intake details.
Idea
Frequently asked questions
Is ChatGPT HIPAA compliant?
There's no official HHS certification that makes any product HIPAA compliant. What matters is whether the vendor will sign a BAA for the specific product and plan you use, and how the tool is configured. Consumer versions without a BAA shouldn't receive PHI.
How do we find out which AI tools staff already use?
Ask. A short anonymous survey, a review of browser extensions and software purchases, and a no-blame reporting window usually surface most of them. Then publish an approved list.
Does Part 2 have breach notification now?
Yes. The 2024 Part 2 final rule applies breach notification requirements to Part 2 records, according to the HHS fact sheet. Ask counsel how that fits your incident response plan.