An accurate and thorough risk analysis that includes the AI tool and assesses it like any other system that touches electronic PHI. That is the document OCR’s recent HIPAA enforcement has turned on, under 45 CFR 164.308(a)(1)(ii)(A). A policy that says AI is governed, or a vendor’s claim that its product is secure, is not that document. OCR created its Risk Analysis Initiative to focus investigations on this one requirement, and the initiative reached its 14th enforcement action in June 2026.
What has OCR enforced under the Risk Analysis Initiative?
OCR announced the initiative’s first enforcement action in October 2024: a $90,000 settlement with Bryan County Ambulance Authority in Oklahoma, after a ransomware attack affected the protected health information of 14,273 patients and OCR found the entity had not conducted a compliant risk analysis. Later actions include Top of the World Ranch Treatment Center, an Illinois substance use disorder treatment provider, announced February 19, 2026 after a phishing attack, and MMG Fusion, LLC, a software company acting as a business associate, announced March 5, 2026, where OCR found the protected health information of approximately 15 million individuals had been impermissibly disclosed. On April 23, 2026, OCR announced four ransomware settlements that brought the initiative to 13 completed investigations, for a combined $1,165,000 and corrective action plans monitored for two years. Every action named here includes a risk analysis finding.
None of these settlements names an AI tool. The breaches behind them were ransomware, phishing, and intrusion incidents. What they show is not an AI-specific rule but the document OCR looks for in any system that holds ePHI. The corrective action plans we read for Top of the World, MMG Fusion, and Regional Women’s Health Group, one of the April 2026 settlements, each require the risk analysis to cover all the electronic equipment, data systems, and applications that hold ePHI, built from a complete inventory, and to be repeated annually.
Has OCR published anything specific to AI tools?
Not under HIPAA, as of this writing. The Security Rule does not name AI, and OCR’s Security Rule guidance and risk analysis guidance pages, both reviewed by HHS in 2026, do not mention it. The nearest HHS statement is in the January 2025 proposal to update the Security Rule: its preamble says HHS expects a regulated entity using AI to include those tools in its risk analysis, considering the type and amount of ePHI the tool accesses, to whom the data is disclosed, and to whom the output is provided. That is a proposal, not current law. The OCR rule that reaches AI-driven clinical tools sits under a different law: the Section 1557 regulation on patient care decision support tools at 45 CFR 92.210, covered in what the Section 1557 rule requires for AI decision support tools.
Under HIPAA, that leaves the same principles reaching AI tools that reach any other technology. Protected health information may be used or disclosed only as the Privacy Rule permits or requires, under 45 CFR 164.502(a). The minimum necessary standard at 164.502(b) requires reasonable efforts to limit PHI to the minimum necessary for the purpose of a use, disclosure, or request, with exceptions that include disclosures to a provider for treatment. And covered entities and business associates carry the risk analysis and audit-control duties whatever technology processes the data. An AI tool does not get a lighter standard for being new, and it does not get a specific one either.
What does an AI tool add to the risk analysis, specifically?
The risk analysis has to reach “the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate,” per 164.308(a)(1)(ii)(A). On our reading, if an AI tool, whether it is an in-house model, a hosted API, or an ambient scribe, creates, receives, maintains, or transmits ePHI, it belongs in that assessment by name, the way the corrective action plans above require every application holding ePHI to be inventoried. Its own vulnerabilities belong there too: whether output is retained, whether a subprocessor sees the data, who can reach the tool, and whether an incident there would surface. A risk analysis that names the EHR and the network but not the AI tools in use has the kind of gap the initiative focuses on. Who keeps the transcript from an ambient scribe works through what that gap looks like for one kind of tool.
What else does the rule point to for an AI tool?
OCR has not published AI-specific expectations beyond the risk analysis, so this part is our reading of the rule and of the settlements. The corrective action plans pair the risk analysis with a risk management plan and a monitored term: three years for Bryan County and MMG Fusion, two years for Top of the World and the April 2026 settlements. The three plans we read also require written procedures for regular review of information system activity. Applied to an AI tool, the same rule points to access control under 164.312(a) that covers who can reach the tool, regular review of its activity records under 164.308(a)(1)(ii)(D), and a sanction policy under 164.308(a)(1)(ii)(C) that reaches misuse of it, since that provision requires sanctions against workforce members who fail to comply with the entity’s security policies and procedures.
Is a signed business associate agreement itself evidence of anything to OCR?
Not on its own. A BAA establishes the vendor’s contractual duty. It does not establish that the covered entity assessed the tool, controlled access to it, or reviewed its activity. Is ChatGPT HIPAA compliant covers in depth what a BAA changes and what it leaves with the institution; the short version is that the contract and the evidence trail are two different things, and the settlements above turned on the second.
OCR’s recent HIPAA enforcement turns on whether an accurate and thorough risk analysis exists that covers the systems holding ePHI. An AI tool is not exempt from that test, and nothing in the rule singles it out for a harder one.
What you need in place
- Every AI tool that touches ePHI named in a risk analysis dated within the current cycle, not inherited from a prior one.
- Access controls scoped to who can reach the AI tool, distinct from general network access.
- A regular, documented review of the tool’s activity records, with an owner accountable for doing it.
- A sanction policy that clearly covers misuse of AI tools, not just general data handling.
- A remediation trail for any gap the risk analysis finds, since risk management under 164.308(a)(1)(ii)(B) requires security measures sufficient to reduce the risks it identifies.
Sources
- 45 CFR 164.308(a)(1)(ii)(A) to (D), risk analysis, risk management, sanction policy, and information system activity review
- 45 CFR 164.312(a) and (b), access control and audit controls
- 45 CFR 164.502(a) and (b), permitted uses and disclosures, and minimum necessary
- 45 CFR 92.210, nondiscrimination in the use of patient care decision support tools
- HHS resolution agreements index, including the Bryan County Ambulance Authority settlement announced October 31, 2024
- OCR settlement with Top of the World Ranch Treatment Center, HHS press release, February 19, 2026
- OCR settlement with MMG Fusion, LLC, HHS press release, March 5, 2026
- OCR settles four HIPAA Security Rule ransomware investigations, HHS press release, April 23, 2026
- Regional Women’s Health Group resolution agreement and corrective action plan, HHS
- OCR settles ransomware investigation with health plan, HHS press release, June 18, 2026, the initiative’s 14th enforcement action
- HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information, Notice of Proposed Rulemaking, 90 FR 898, January 6, 2025
Where Verillian fits
Verillian governs AI use on the devices you enroll. A checkpoint on each device sits between your people’s AI tools and agents and the AI providers. A tool call your policy bans is removed before your machine can run it. Each record is signed on the device it came from and hash-chained to the one before it, so a change to its signed fields is detectable, and it stays on your own infrastructure. The admin server runs where you choose: on premises or in a private cloud you run. macOS, Windows and Linux are supported. For a health system, that record shows what AI use passed through the checkpoint on enrolled devices, so it can be checked against what the risk analysis assumed.
When a vendor’s service calls a model on the vendor’s servers, as an ambient scribe or a hosted report-writing tool does, the record of what that model received is created on the vendor’s side, and the contract is your lever for it. What Verillian gives you is the record of AI use that starts on your own devices.
See what the audit controls standard requires in more depth on does HIPAA require logging what an AI model received, and how this maps to healthcare and other regulated sectors.
