compliance

HIPAA for AI Healthtech Products: What UK Developers Need to Know

The US Health Insurance Portability and Accountability Act, setting national standards for protecting sensitive patient health information (PHI) in digital systems.

If your AI product handles health information belonging to US patients or works with US healthcare organisations, HIPAA applies to you regardless of where your company is incorporated. The Health Insurance Portability and Accountability Act sets national standards in the United States for protecting sensitive patient health information in digital systems. UK founders often assume US federal law stops at the US border, but that assumption is incorrect for HIPAA: if you process protected health information on behalf of a US covered entity, the law applies to your company as a business associate regardless of whether you are based in Hemel Hempstead or Helsinki. The consequences of non-compliance are serious, ranging from civil penalties of USD 100 to USD 50,000 per violation up to criminal charges for wilful neglect. For UK-based AI teams building healthtech products that target US markets alongside NHS Digital or MHRA-regulated workflows, HIPAA compliance is a procurement gateway that US hospital and insurer buyers will check before signing any contract. SpeedMVPs, based in Hemel Hempstead, delivers AI MVPs in 2 to 3 weeks at a fixed price of GBP 8,000 with full code ownership, and HIPAA-aware architecture can be scoped in from day one rather than retrofitted after your first US sales conversation. This guide explains what protected health information is, who must comply, the technical safeguards required, and how HIPAA intersects with UK GDPR for dual-market products.

What HIPAA Protects and Who It Covers

HIPAA's Privacy Rule and Security Rule govern protected health information, known as PHI. PHI is individually identifiable health information held or transmitted by a covered entity or its business associates in any form, including electronic, paper, or oral. The key categories include health status, provision of healthcare, and payment for healthcare when they can be linked to a specific individual. The definition is broad: a diagnosis, a prescription, a lab result, a claims record, an appointment date, or even a patient's name combined with a visit date all constitute PHI. Covered entities are healthcare providers, health plans, and healthcare clearinghouses. Business associates are any third party that creates, receives, maintains, or transmits PHI on behalf of a covered entity. If your AI product receives patient records from a US hospital, processes them, and returns results, you are almost certainly a business associate and HIPAA applies to your systems and your contracts. UK companies are not exempt simply because they are not incorporated in the US.

Technical Safeguards Required Under HIPAA

The HIPAA Security Rule requires covered entities and business associates to implement specific technical safeguards for electronic PHI. Access controls must ensure only authorised users can access ePHI, implemented through unique user identification, automatic logoff, and encryption and decryption controls. Audit controls require hardware, software, and procedural mechanisms to record and examine access and activity in information systems that contain ePHI. Integrity controls must protect ePHI from improper alteration or destruction, and you must have mechanisms to authenticate ePHI to confirm it has not been altered. Transmission security requires protecting ePHI during transmission over electronic communication networks, which in practice means TLS encryption at a minimum. For AI products, additional considerations apply: LLM prompts containing PHI must be handled with the same controls as any other ePHI; vector stores indexing patient records require access logging and encryption at rest; and any model fine-tuned on PHI creates obligations around model access controls and data deletion that must be addressed in your architecture.

Business Associate Agreements

If you are a business associate, you need a Business Associate Agreement, or BAA, in place with every covered entity you work with before you handle any PHI. The BAA is a contract that specifies how you will use, safeguard, and disclose PHI, what you will do if there is a breach, and how PHI will be returned or destroyed when the relationship ends. You also need sub-BAAs with any subprocessors you use who will handle PHI on your behalf. For AI products, this includes your LLM API provider. OpenAI and Microsoft Azure OpenAI both offer BAAs for healthcare customers. Google Cloud also provides BAA-eligible services. Anthropic's HIPAA BAA availability should be verified directly with them for current commercial terms. Using a consumer-tier LLM API without a BAA while handling PHI is a HIPAA violation regardless of whether you intend to use the data for any purpose. The technical fact of transmission is sufficient.

HIPAA Breach Notification Requirements

HIPAA requires covered entities to notify affected individuals, the US Department of Health and Human Services, and in some cases the media, when unsecured PHI is breached. Business associates must notify the covered entity within 60 days of discovering a breach. A breach is defined as the acquisition, access, use, or disclosure of PHI in a way not permitted under the Privacy Rule, unless the covered entity or business associate demonstrates a low probability that PHI has been compromised based on a four-factor risk assessment. The risk assessment considers the nature and extent of the PHI involved, who accessed it, whether PHI was actually acquired or viewed, and the extent to which the risk has been mitigated. UK teams should build breach detection and notification workflows into their incident response plans from the start, not as an afterthought. The 60-day business associate notification window sounds generous but incident investigation, remediation, and documentation all need to happen within it.

HIPAA and UK GDPR: Running Both Frameworks

Many UK healthtech products target both NHS-connected workflows and US healthcare markets, which means running HIPAA and UK GDPR compliance simultaneously. The two frameworks overlap in meaningful ways but are not identical. Both require access controls, encryption, breach notification, and contractual obligations on data processors. Where they differ: UK GDPR gives individuals stronger rights over their data including erasure and portability; HIPAA has specific minimum necessary use requirements that map to GDPR's data minimisation principle but apply differently; HIPAA breach thresholds and notification timelines differ from GDPR's 72-hour ICO notification obligation. When building a dual-market product, design to the stricter standard in each area rather than the average. This typically means GDPR's individual rights model combined with HIPAA's technical safeguard specificity. SpeedMVPs builds GDPR-aware architecture as a baseline, which provides a solid foundation for layering HIPAA technical controls on top for US-facing deployments.

Practical Architecture for HIPAA-Compliant AI Products

HIPAA compliance for AI products requires deliberate architecture decisions from the first sprint rather than compliance retrofitting. Encryption at rest and in transit must be present from day one. All data access must be logged with sufficient detail to reconstruct who accessed what PHI and when. Role-based access control must restrict PHI access to the minimum necessary for each role's function. Audit logs must be tamper-evident and retained for six years. For LLM-powered features, PHI should be de-identified before being used in prompts where the clinical function permits it. Where de-identification is not possible, ensure your LLM provider has a BAA in place and that the API traffic is routed through HIPAA-eligible service tiers rather than standard API endpoints. In practice, many LLM providers operate separate API infrastructure for HIPAA customers with enhanced security controls. Verify this with your provider before moving PHI into any AI workflow.

Frequently Asked Questions

Does HIPAA apply to a UK company building a health AI product?+

Yes, if your product handles protected health information on behalf of US-based covered entities such as hospitals, insurers, or clinics, HIPAA applies to your company as a business associate. US law does not limit its reach to US-incorporated entities. You will need to sign Business Associate Agreements with your US customers, implement the required technical safeguards, and have breach notification procedures in place. Many UK healthtech founders discover this requirement when a US customer requests a BAA during procurement.

Can I use ChatGPT or Claude with patient data?+

Only if your LLM provider has signed a Business Associate Agreement with you and you are using a HIPAA-eligible service tier. Consumer APIs for ChatGPT are not HIPAA-eligible. OpenAI offers HIPAA BAAs for enterprise customers using specific service configurations. Microsoft Azure OpenAI Service can be HIPAA-eligible. Verify current BAA availability directly with each provider before using any LLM API with real patient data, as commercial terms change and the contractual position must be current.

How does HIPAA's minimum necessary rule apply to AI prompts?+

HIPAA's minimum necessary standard requires that access to PHI be limited to the minimum necessary to accomplish the intended purpose. For AI prompts, this means you should not include full patient records in an LLM prompt if only certain fields are needed to complete the task. De-identify data before prompting where clinically appropriate. Build prompt construction logic that filters PHI to what the specific AI function actually requires rather than passing complete records. Document your minimum necessary analysis in your HIPAA compliance documentation.

What is the difference between HIPAA and NHS Digital data security requirements?+

HIPAA is US federal law governing PHI in the US healthcare system. NHS Digital's Data Security and Protection Toolkit is a UK framework for organisations handling NHS patient data, aligned with UK GDPR and the National Data Guardian's standards. They are separate requirements for separate markets. A product handling both NHS patient data and US PHI must comply with both frameworks independently. There is meaningful overlap in the technical controls each requires, which reduces duplication, but the contractual, notification, and documentation obligations are distinct and must be managed separately.

What penalties apply if we breach HIPAA as a UK business associate?+

HIPAA civil penalties range from USD 100 to USD 50,000 per violation, with annual caps up to USD 1.9 million per violation category. Criminal penalties apply for wilful neglect and can reach USD 250,000 with prison terms. The US Department of Health and Human Services Office for Civil Rights enforces HIPAA and has pursued enforcement actions against business associates including non-US entities. Beyond direct penalties, a HIPAA breach typically triggers contract termination with the covered entity and reputational damage that can end a healthtech company's US market access.

Building a healthtech AI product that needs to work for both NHS and US healthcare customers? We can scope HIPAA and GDPR compliance into your architecture from day one. Get a free consultation at speedmvps.co.uk

Get a Free Quote