{"head":{"title":"Can I Send PHI to an LLM? HIPAA Rules for AI APIs | OceanLab","description":"You can send PHI to an LLM API only if the provider signs a BAA that covers that service and you apply HIPAA safeguards.","canonical":"https://oceanlab.in/questions/can-i-send-phi-to-an-llm"},"crumbs":[{"name":"Home","path":"/"},{"name":"Questions","path":"/questions"},{"name":"Can I send PHI to an LLM?","path":"/questions/can-i-send-phi-to-an-llm"}],"question":"Can I send PHI to an LLM?","answer":["Yes, but only if the LLM provider signs a ",{"href":"/glossary/baa","text":"BAA"}," with you that covers the exact service and endpoint you call, and you treat it like any other vendor that handles ",{"href":"/glossary/phi","text":"PHI"},". Without a BAA, send only properly de-identified data, or keep the model inside an environment you already cover."],"sections":[{"heading":"Why the BAA is the deciding point","body":[["Under HIPAA, a vendor that creates, receives, maintains or sends PHI for a covered entity or a business associate is itself a business associate. An LLM API that receives prompts containing patient data fits that description, so the contract rules in 45 CFR 164.504(e) apply."],["Many AI providers offer a BAA only on certain plans, accounts or endpoints. A consumer chat app, a free tier or a beta feature is often outside it. Check the BAA's scope against the exact API, model and features you use, including logging, file storage and any data retention settings."]],"bullets":[]},{"heading":"What to set up before sending PHI","body":[["A signed BAA is necessary, not sufficient. The Security Rule still applies to the whole data path:"]],"bullets":[["Send the minimum PHI the task needs. Strip identifiers the model does not need to see."],["Turn off or limit provider-side retention and training on your data where the provider allows it, and confirm this in writing."],["Keep audit logs of which user or service sent which data, without copying PHI into general logs or analytics tools."],["Check every other vendor in the path: ",{"href":"/glossary/vector-database","text":"vector databases"},", observability tools, queues and email. Each one that touches PHI needs its own BAA."],["Add the AI feature to your risk analysis and test it with ",{"href":"/glossary/llm-evals","text":"evals"}," and ",{"href":"/glossary/guardrails","text":"guardrails"},", since a ",{"href":"/glossary/hallucination","text":"hallucination"}," in a clinical setting is a safety issue, not only a quality one."]]},{"heading":"When de-identification is the better route","body":[["HIPAA does not apply to data de-identified under 45 CFR 164.514, either by removing the listed identifiers (Safe Harbor) or by an expert determination. For analytics, summarisation of trends or model testing, de-identified data can remove the need for a BAA. Free-text clinical notes are hard to de-identify reliably, so treat them as PHI unless an expert says otherwise."]],"bullets":[]}],"faqs":[{"question":"Is a provider's \"HIPAA eligible\" label enough?","answer":"No. The label usually means the provider will sign a BAA for that service. You still need the signed BAA in place before sending PHI, and your own safeguards around it."},{"question":"Can staff paste patient notes into a public chatbot?","answer":"Not unless that product is covered by a BAA with your organisation. Most consumer chat apps are not, so this is a common source of accidental disclosures."},{"question":"Does running an open model on our own servers avoid the issue?","answer":"It removes the AI provider from the data path, but your hosting provider and the servers are still part of the system that handles PHI, so the Security Rule and any hosting BAA still apply."}],"terms":[{"href":"/glossary/phi","label":"PHI"},{"href":"/glossary/baa","label":"BAA"},{"href":"/glossary/llm","label":"LLM"},{"href":"/glossary/rag","label":"RAG"},{"href":"/glossary/guardrails","label":"guardrails"},{"href":"/glossary/human-in-the-loop","label":"human-in-the-loop"}],"tools":[{"href":"/tools/hipaa-checklist","label":"HIPAA checklist","detail":"Free tool"},{"href":"/tools/hipaa-risk-assessment","label":"HIPAA risk assessment","detail":"Free tool"},{"href":"/tools/llm-model-picker","label":"LLM model picker","detail":"Free tool"}],"links":[{"href":"/compliance/hipaa","label":"HIPAA guide","detail":"Who HIPAA applies to and what it asks of software."},{"href":"/glossary/business-associate","label":"Business associate","detail":"Glossary"},{"href":"/ai-automation","label":"AI automation","detail":"How OceanLab automates company workflows with AI."}],"related":[{"href":"/questions/does-my-app-need-hipaa","label":"Does my app need to be HIPAA compliant?","detail":"Question"},{"href":"/questions/what-is-a-baa","label":"What is a BAA?","detail":"Question"},{"href":"/questions/how-much-does-a-telehealth-app-cost","label":"How much does a telehealth app cost?","detail":"Question"},{"href":"/compare/ai-agent-vs-workflow-automation","label":"AI agent vs workflow automation","detail":"Comparison"},{"href":"/compare/rag-vs-fine-tuning","label":"RAG vs fine-tuning","detail":"Comparison"},{"href":"/glossary","label":"Glossary","detail":"Every term, in plain words."}],"sources":[{"title":"45 CFR 160.103, Definitions (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103","checkedAt":"2026-10-25"},{"title":"45 CFR 164.504(e), Business associate contracts (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504","checkedAt":"2026-10-25"},{"title":"45 CFR 164.514, De-identification of PHI (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514","checkedAt":"2026-10-25"},{"title":"45 CFR Part 164 Subpart C, the HIPAA Security Rule (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}