On Dec 4th, 2025, HHS released an AI strategy that tells the department to put AI into internal operations, research, and public health. The strategy text says use should stay consistent with HIPAA protections for PHI, and it encourages AI for standardized administrative work. That is a green light with a footnote. It is not a Security Rule rewrite, and it does not bind a hospital’s shadow chatbot.
Until those two documents exist, healthcare AI is running on a Security Rule that never had to imagine a prompt box.
PHI Is Already Leaving the Building
The honest counterargument is that this is enough, and that rushing a more prescriptive rule would freeze useful clinical software. The proposed Security Rule, issued in January 2025, would drop the old split between “required” and “addressable” implementations and set firmer rules on encryption, network segmentation, compliance audits, and security risk analyses. Andrea C. Harris and Natalie S. Lesnick, writing for Feldesman on Aug 21st, 2026, report nearly 5,000 comments, many of them about lost flexibility and cost, and they report that Reginfo.gov now shows final action in July 2027. That volume of comment is real. Smaller providers do not have spare security teams. A rigid rule can sit unimplemented.
HHS OCR should publish a final Security Rule, with a Federal Register date anyone can check, that treats AI software handling ePHI as a technology asset, requires encryption of that ePHI, and ends the addressable loophole for those controls. Covered-entity boards should adopt a written inventory of every AI tool that can receive PHI, with a business associate agreement or an explicit ban, and record that inventory in board materials. The check is simple: a final rule on the Federal Register before the July 2027 placeholder, and an AI-and-PHI inventory that exists on paper, not in a slide about innovation.
The Tools HIPAA Never Named
The security problem with AI in digital healthcare is not that HIPAA forgot patients exist. It is that the Security Rule still governs electronic protected health information as if the main question were a server in a closet, not a model, a prompt, or a vendor’s training pipeline. Covered entities can deploy chatbots, scribes, and scoring tools against PHI today. The rule that would make encryption, segmentation, and a written technology inventory mandatory is, as of Aug 21st, 2026, scheduled for final action in July 2027.
That is a live gap, not a paperwork delay.
On Jan 21st, 2026, ECRI, an independent patient-safety organization, ranked misuse of AI chatbots in healthcare as the top health technology hazard for 2026, ahead of sudden loss of electronic systems and counterfeit products. ECRI’s list is a hazard ranking from surveys, literature, device testing, and incident reviews. It is not a HIPAA penalty docket. It is still a current, named judgment that chatbot misuse is the technology risk health systems should take first.
What the Law Already Does, and Where It Stops
The thesis would be wrong if OCR put a final Security Rule in force that requires a written inventory of AI systems handling ePHI and makes encryption of that ePHI required rather than addressable, or if, with the current rule unchanged, ECRI’s hazard list and hospital surveys of unsanctioned AI both showed chatbot misuse and unofficial tools receding as operational risks. Comment volume on a proposed rule is not that evidence. Neither is a departmental strategy that tells staff to use AI “consistent with HIPAA.”
In 2025, the Federal Register notice for that proposed rule quoted the National Committee on Vital and Health Statistics on the need to run risk analyses on AI through the life cycle of the system, and it tied a written inventory of technology assets to AI software. That notice is historical context for what HHS already knew last year. It is not current law. The inventory is still a proposal.
The current Security Rule can be read to cover that paste. Encryption of ePHI is still an addressable specification, not a hard requirement. Risk analysis is required; an AI-specific inventory is not. A workforce member can be sanctioned after the fact. None of that stops the copy.
As of June 2026, the HIPAA Journal counted 772 healthcare breaches of 500 or more people on the HHS Office for Civil Rights portal for 2025, affecting 139,721,832 individuals. Those figures measure large reportable incidents, not AI incidents as a class. They still show how much ePHI is already in circulation when a new class of tools starts copying it.
Adoption Is Being Pushed. The Control Set Is Not.
A Wolters Kluwer survey released on Jan 22nd, 2026, found a broad presence of unsanctioned AI tools in hospitals and health systems. Wolters Kluwer sells clinical AI products, including UpToDate Expert AI, so it has a commercial interest in sanctioned tools winning. The finding that still matters is the one in the headline: unofficial tools are already inside the workflow. Consumer chatbots do not sign business associate agreements. A note pasted into one of them is PHI on someone else’s disk.
HIPAA Journal’s 2025 Healthcare Data Breach Report, published in February 2026, put 57.5% of those incidents at healthcare providers and 35.8% at business associates. AI vendors that touch PHI sit in that second bucket. The report does not say those associate breaches were caused by models. It does show that a large share of last year’s exposure happened outside the four walls of the clinic, which is exactly where an unexamined AI contract tends to live.
HIPAA’s Privacy Rule, Security Rule, and Breach Notification Rule apply to PHI in an AI system the same way they apply to PHI in an EHR. If a vendor creates, receives, maintains, or transmits PHI for a covered entity, a business associate agreement is required. OCR has kept a risk-analysis enforcement focus, and Feldesman LLP is right that organizations remain bound by the current Security Rule while they wait.
Adjacent, not proof of AI causation: the IBM 2026 Cost of a Data Breach Study, as reported by HIPAA Journal on July 29th, 2026, put the average healthcare breach at .64 million, still the highest of any industry, even after a 10.5% year-over-year drop. IBM sells security products. The figure measures breach cost in healthcare, not the share caused by AI. It is the price tag on the data these tools now touch.
Grant the cost complaint. It does not rescue the status quo. Addressable encryption was written for a different generation of systems. Generative tools invite staff to type identifiable clinical detail into products that may retain, train on, or reroute that detail. Calling that “just another information system” is how unsanctioned tools stay off the asset list.
