Every vendor that handles PHI must sign a BAA.
HIPAA requires any vendor that handles Protected Health Information on behalf of a covered entity to sign a Business Associate Agreement. A BAA is a legally binding contract that establishes how the vendor will protect that data, what they can do with it, and what happens in the event of a breach.
Without a signed BAA, using a vendor to process, transmit, or store PHI is a HIPAA violation regardless of whether a breach occurs.
Every AI tool your team uses to draft communications, summarize client information, or process intake data involving a covered client is a potential BAA requirement. Most organizations have not assessed which of their tools are covered.
Five tools. Same pattern. Different price points.
Here is what the publicly available vendor documentation says about each major AI tool as of May 2026. This is not legal advice. Always verify directly with vendors and consult qualified legal counsel regarding your specific situation.
Every tool follows the same structure.
There is a consumer version that is fast, free, and widely adopted. And there is an enterprise version that can be covered under a BAA with proper configuration, significant cost, and deliberate setup.
The consumer version is almost certainly what your staff is using.
The gap between those two versions is where most organizations currently sit. It is not a technology problem. It is a documentation and governance problem that most organizations have not yet addressed.
OCR has been explicit that AI tools processing PHI must be covered under a BAA. The absence of a breach does not mean the absence of a violation.
The regulatory environment is tightening.
In January 2025 OCR proposed the first significant update to the HIPAA Security Rule in over two decades. Among the proposed changes, organizations would be required to formally include AI tools that interact with protected health information in their risk analysis documentation.
Most organizations have never completed a formal risk analysis. Almost none have one that addresses AI tools specifically.
The proposed rule has not been finalized. Organizations should monitor HHS Office for Civil Rights communications and consult qualified legal counsel regarding applicability to their specific situation.
Source: HHS Notice of Proposed Rulemaking, January 2025
The first step is understanding where you stand.
Most organizations are surprised by the scope of current AI tool usage when they actually look at it.
MMC Signal works with organizations to assess their current AI tool usage against applicable compliance frameworks and help address identified gaps using infrastructure they already have. We help organizations understand where they stand and what addressing it looks like in practice.
We do not provide legal advice or compliance certification. Organizations should consult qualified HIPAA legal counsel regarding their specific obligations.