PHI and AI: Where Protected Health Information Actually Leaks

What Counts as PHI in an AI Context

Nobody in your organization is copying a full medical record into a chatbot. That scenario, the one every warning email describes, is the least common way PHI reaches an AI tool. The common ways look like work: a scheduler summarizing a voicemail, a case manager drafting a prior-auth appeal, a meeting assistant sitting in on a care coordination huddle. Each one feels like a task, not a disclosure.

Protected health information is any individually identifiable health information held or transmitted by a covered entity or business associate, in any form. In an AI context, the definition does not shrink, but the surface expands. A prompt is a transmission, a generated summary is a new copy, and a meeting transcript is a record. The eighteen HIPAA identifiers still define "identifiable," and the practical test for a prompt is simple: if a name, date, location, or detail in it could point back to one patient, PHI just moved.

The part staff miss is that identifiability survives paraphrase. "78-year-old woman on the cardiac unit who fell twice this week" names no one and identifies someone.

The Control That Matches Each Leak

The pattern in that list: PHI leaks at surfaces policy cannot see. The matching controls, in the order they pay off: a sanctioned, governed AI path so the work has somewhere safe to happen, PHI screening between users and models so the paraphrase problem is caught mechanically rather than by memory, tool rules that name meeting assistants and document AI specifically, calendar and title hygiene in scheduling workflows, and retention rules for AI output, which is the copy everyone forgets exists.

Training still matters, but note what it is for, teaching staff to recognize the six surfaces, not to memorize the eighteen identifiers. Nobody fails HIPAA by forgetting identifier twelve. They fail it by not recognizing a transmission as one.

What De-Identification Does and Does Not Buy

Properly de-identified data is not PHI, and HIPAA has two recognized methods, expert determination and safe harbor removal of the eighteen identifiers. Two cautions apply in an AI context. First, casual redaction is not de-identification; removing the name while keeping the story usually fails the test. Second, several AI vendors reserve rights to use de-identified data, which is legal under HIPAA and still worth a contractual look if your data governance standards are stricter than the statute.