HIPAA Security Rule and AI handling of electronic health information

The Security Rule covers ePHI that covered entities and business associates create, receive, maintain, or transmit, so it reaches AI tools and workflows that handle ePHI. Organizations must assess and manage risks and maintain appropriate safeguards. Changes to technology and risk can require reevaluating those safeguards. Next key date: none recorded. Last verified October 29, 2026.