Ask a room of healthcare administrators about AI and privacy and you'll hear a familiar refrain: the rules aren't clear yet, so we're waiting. It sounds prudent. It is, in fact, the most dangerous sentence in the building — because while everyone waits for a statute, a nurse is pasting a patient's note into a public chatbot to "clean it up real quick," and a biller is dropping a claim into a consumer AI to draft an appeal. The compliance emergency isn't coming. It's already open in a browser tab.
The thesis
Here it is plainly: you do not need a new AI law to have a HIPAA problem, because you already have HIPAA. Artificial intelligence does not sit outside the rule — it is simply another mechanism through which protected health information can be used or disclosed (HIPAA Journal). When staff feed PHI into an ungoverned, consumer AI tool, there is no Business Associate Agreement, the data leaves your control and may be retained or used to train a model, and the existing Privacy and Security Rules already make that an impermissible disclosure. "The AI rules aren't finalized" is true and irrelevant. The disclosure rules are finalized. They have been for two decades.
"We're waiting for guidance" is not a compliance posture. It's an unmonitored one.
And the timeline confirms the trap. The proposed HIPAA Security Rule update — encryption, multi-factor authentication, tighter technical safeguards — is still not final, now carried on the federal agenda as a long-term action with final action projected around 2027 (HIPAA Journal). If your plan is to act when the rule lands, your plan is to be exposed until then.
The honest counterpoint
Now the fair rebuttal, because this deserves more than a scold. There genuinely arehard AI questions that current HIPAA doesn't cleanly answer — algorithmic bias, the safety and validation of AI used in clinical decision-making, transparency about when a model influenced a diagnosis, and accountability when it's wrong. For those higher-risk clinical uses, dedicated AI guidance and standards are not just nice to have; they're overdue, and "HIPAA already covers it" is too glib a response (Healthcare IT News). The people asking for clearer AI rules are right.
But notice the sleight of hand that the "we're waiting" posture performs. It borrows the legitimacy of those hard, unsettled clinical questions to excuse an easy, settled administrative one. Whether an AI model should co-sign a diagnosis is genuinely unresolved. Whether your staff may paste a patient's identifiers into a public chatbot with no BAA is not. Conflating the two is how an organization talks itself out of the one fix entirely within its control today.
What to actually do — this week
Write an AI-use policy. Plainly: what tools are approved, what data may touch them, and the hard line that PHI never goes into anything unapproved.
Publish an approved-tools list. People don't reach for shadow tools when a sanctioned one exists and is easy to use.
Train the why, not just the what. Staff paste PHI into chatbots because it saves them time and no one told them the stakes.
Get a BAA with any vendor whose AI touches PHI — and treat "no BAA" as a hard stop.
Where FHC stands
Waiting for perfect rules is not a strategy; it's a liability that grows quietly every day. If putting a real AI-use policy in place isn't the best use of your team's hours, that's what we do. FHC provides HIPAA consulting and risk management consulting — talk to us, and let's close the browser tab before it closes on you.
This is an opinion piece reflecting FHC's perspective. It is general information, not legal advice; confirm your specific HIPAA obligations with qualified counsel.
Sources
HIPAA, Healthcare Data, and Artificial Intelligence — HIPAA Journal
AI accountability frameworks may soon be as standard as HIPAA compliance — Healthcare IT News
HIPAA Updates and HIPAA Changes in 2026 — HIPAA Journal
