Regulatory primer
HIPAA
Health Insurance Portability and Accountability Act of 1996 (Privacy + Security Rules, 45 CFR Parts 160 + 164) · United States · In force; rules continuously updated by HHS Office for Civil Rights
HIPAA is the US federal framework governing protected health information (PHI). It comprises the Privacy Rule (45 CFR Part 164 Subpart E), the Security Rule (Subpart C), and the Breach Notification Rule (Subpart D). For AI in healthcare, §164.312(b) audit controls + §164.308 administrative safeguards are the most directly engaged provisions.
What it is
HIPAA was enacted in 1996; the implementing rules came in successive waves. The Privacy Rule (2003) governs uses + disclosures of PHI. The Security Rule (2005) governs technical, administrative, and physical safeguards for electronic PHI. The HITECH Act (2009) added enforcement teeth + the Breach Notification Rule. The 2013 Omnibus Rule expanded direct liability to business associates.
Enforced by the HHS Office for Civil Rights (OCR). State attorneys general have parallel enforcement authority for HIPAA + (often) state-specific health-privacy laws (e.g. California CMIA, Texas HB 300, New York SHIELD).
Penalties: tiered civil monetary penalties ($141-$71,162 per violation in 2024-adjusted amounts, annual cap ~$2.1M per identical-provision violation). Criminal penalties for wilful violations: up to $250K + 10 years.
Who's in scope
- Covered entities: health plans (insurers, HMOs, government health plans), healthcare clearinghouses, healthcare providers transmitting health information electronically in connection with HIPAA-defined transactions.
- Business associates: any person/entity that performs functions involving PHI on behalf of a covered entity (cloud providers handling ePHI, billing services, IT contractors, AI/SaaS vendors processing PHI).
- Subcontractors of business associates (added by 2013 Omnibus Rule).
- Hybrid entities: organisations with both HIPAA-covered + non-covered functions can designate the covered component.
Key obligations
§164.312(b) — audit controls
Implement hardware, software, and/or procedural mechanisms that record + examine activity in information systems containing or using ePHI. The 'audit controls' implementation specification (technical safeguard).
§164.308 — administrative safeguards
Required: risk analysis (164.308(a)(1)(ii)(A)), risk management (164.308(a)(1)(ii)(B)), sanction policy (164.308(a)(1)(ii)(C)), information system activity review (164.308(a)(1)(ii)(D)), workforce security (164.308(a)(3)), information access management (164.308(a)(4)), security awareness training (164.308(a)(5)), security incident procedures (164.308(a)(6)), contingency plan (164.308(a)(7)), evaluation (164.308(a)(8)). Addressable: many sub-specs.
§164.310 — physical safeguards
Facility access controls, workstation use, workstation security, device + media controls. Less relevant for cloud-deployed SaaS but operative for the covered-entity's own infrastructure.
§164.312 — technical safeguards
Access control (unique user identification, emergency access, automatic logoff, encryption + decryption — addressable). Audit controls (required). Integrity (mechanism to authenticate ePHI — addressable). Transmission security (integrity controls + encryption — addressable). Person/entity authentication (required).
§164.504 — Business Associate Agreement (BAA)
Required contract between covered entity + business associate. Specifies permitted uses, prohibited uses, safeguards, subcontractor flow-down, breach notification to covered entity, return/destruction at termination, audit/inspection rights.
§164.402-414 — Breach Notification Rule
Breach of unsecured PHI → notify affected individuals (Art. 164.404, within 60 days), the Secretary (164.408, immediately if 500+ affected, annually otherwise), the media (164.406, if 500+ in a single state/jurisdiction), and the covered entity (where the BA discovered the breach).
Timeline + applicability
- 21 Aug 1996HIPAA enacted (Pub. L. 104-191).
- 14 Apr 2003Privacy Rule compliance date.
- 20 Apr 2005Security Rule compliance date.
- 23 Sep 2013Omnibus Rule effective — business associates directly liable, breach-notification harm-threshold revised.
- OngoingOCR enforcement actions + proposed Security Rule modernisation (notice of proposed rulemaking issued Dec 2024 addressing encryption, MFA, asset inventory, vulnerability management).
What's still being worked out
Areas where the regulation's interpretation is genuinely unsettled. Vendor pages skip this; we don't. Your counsel is the right venue for definitive guidance on your deployment.
- Whether + how HIPAA addresses AI-specific risk — current Security Rule was authored pre-AI; OCR's December 2024 NPRM proposes modernisation including specific cybersecurity controls but AI-specific guidance is not yet in the rule text.
- Cloud + SaaS vendor obligations — the 2016 OCR Cloud Computing Guidance clarified that hyperscalers handling ePHI are business associates regardless of whether they 'view' the data; subsequent practice continues to refine no-view configurations + BAA terms.
- De-identification + safe-harbor standards (§164.514) — whether de-identified data can be re-identified with current AI/ML capabilities is an active research + regulatory question.
- Interaction with state laws — California CMIA + Texas HB 300 + Washington 'My Health My Data' + Florida's protected-health-information laws layer on top of HIPAA with different scope + enforcement.
- AI training data + the use of PHI for model development — generally requires either authorization or a research exception with IRB review; what counts as 'limited dataset' use is fact-specific.
Sectors most affected
Primary sources
Where Promethean fits
Promethean's L12 chain operationalises §164.312(b) audit controls for the AI-decisioning slice of ePHI processing. Per-entry Ed25519 attestation + hash-chained continuity satisfy the 'record + examine activity' requirement with integrity protection. PII-safe-by-construction design (only SHA-256 hashes of inputs + outputs enter the chain, not raw PHI) supports §164.514(a) data-minimisation in the audit trail itself. The chain contributes to §164.308(a)(1)(ii)(D) information-system-activity review with verifiable evidence rather than reconstructed logs.
What Promethean does NOT solve
- Replace your BAA — business associate agreements with covered-entity customers remain operator responsibility.
- Cover the broader Security Rule (workforce training, contingency plans, physical safeguards, etc.) — Promethean is the AI-decisioning audit-trail slice, not full HIPAA compliance.
- Handle de-identification or safe-harbor pathway analysis — that's data-engineering + privacy-engineering work.
- Replace required risk analysis (§164.308(a)(1)(ii)(A)) — Promethean's chain is one evidence input, not a substitute for the analysis itself.
- Address state-law overlays (CMIA, HB 300, etc.) directly — though the per-decision evidence model transfers well to state-law audit demands.
FAQ
Is Promethean a HIPAA business associate?
Yes when Promethean processes (or has access to) ePHI on behalf of a covered entity or another business associate. In Promethean's actual deployment model, raw ePHI typically does NOT enter the L12 chain — only SHA-256 hashes. Whether this changes the BA analysis depends on legal-counsel review + the specific deployment configuration. For deployments where Promethean infrastructure handles ePHI directly, a BAA is required.
Does §164.312(b) require any specific audit-log format?
No. §164.312(b) requires 'hardware, software, and/or procedural mechanisms that record and examine activity'. It doesn't prescribe format. Industry practice + OCR enforcement experience suggest tamper-resistant logs with sufficient detail to reconstruct activity, retention sufficient to meet investigation timelines (typically 6+ years for the broader HIPAA documentation requirement), and integrity protection. Cryptographic hash-chained logs exceed the minimum technical bar.
What's changing in the proposed Security Rule modernisation?
OCR's December 2024 NPRM proposes: removing the addressable/required distinction (making most specifications required), specific encryption requirements (in-transit + at-rest), MFA on systems accessing ePHI, asset inventory + network mapping, vulnerability management with response timelines, contingency plan with annual testing, formal BAA verification. Final rule expected late 2025 / 2026. Substantive impact: meaningful uplift in baseline expectations for the AI-vendor + cloud-vendor BAA landscape.
How does HIPAA interact with state health-privacy laws?
State laws can be stricter — HIPAA preempts state law only where the state law is contrary to and less stringent than HIPAA. Most state health-privacy laws (CMIA, HB 300) layer on top with broader scope, additional individual rights, or stricter enforcement. Compliance posture: meet the strictest applicable standard per data flow.
Does HIPAA cover AI training data?
When the training data contains PHI from a covered entity, yes — same use + disclosure rules apply. Training a model on PHI typically requires either patient authorization (§164.508) or qualifying as a permitted use (treatment, payment, healthcare operations under §164.506) or research with IRB review + waiver (§164.512(i)). De-identified data per §164.514 (safe-harbor or expert determination) is outside HIPAA scope.