What happens when an AI tool causes a HIPAA breach?

The direction of the obligations is the first thing to get right, because it is counter-intuitive. A vendor that mishandles information is required to report the incident to the practice. It is the practice — the covered entity — that owes notification to the affected individuals, to the Department of Health and Human Services, and, above a threshold, to prominent media in the state or jurisdiction. The vendor's failure becomes the practice's notification, and no contract redistributes that, though a contract can allocate who pays for it.

The clock is the second thing. Individual notification runs without unreasonable delay and no later than sixty days from discovery, and discovery includes what the practice should have known through reasonable diligence. In an AI arrangement the practical consequence is that a vendor's own reporting timetable eats part of the practice's window before the practice has heard anything, which is why the reporting deadline the vendor owes you is one of the more consequential lines in an agreement people sign without reading.

The part that actually determines the size is the scope question, and it is decided long before an incident. An acquisition, access, use or disclosure not permitted by the rules is presumed to be a breach unless the practice can demonstrate a low probability that the information was compromised, through a risk assessment that considers the nature of the information, who received it, whether it was actually acquired or viewed, and the extent to which the risk has been mitigated. Every one of those is an evidence question. A practice that can show which records that account could reach, and which it opened, has a bounded incident. A practice that cannot must treat the reachable set as the affected set.

This is why access scoping is a notification control rather than a security preference. A connection with broad read access to the whole record system is not merely more dangerous; it is more expensive when nothing bad happens, because the absence of a bound turns an incident into a mass notification. The narrow connection with a query log is cheaper in exactly the scenario nobody budgets for.

There is a second class of incident specific to these tools and no less real: the exposure that happens with no security failure at all. Staff pasting patient material into a personal account, a note drafted with one patient's history and sent to another, a shared workspace where a colleague on an unrelated matter can retrieve what was entered. None of these involves a vendor being compromised, and all of them are impermissible disclosures on the same analysis. They are also the ones a practice will find only if somebody is looking, which is an argument for knowing what accounts staff actually use.

Finally, the notification itself is a document that will be read closely by people deciding whether to be angry. Practices that describe what was reachable, what was confirmed accessed, what has changed, and what the patient should do tend to get a proportionate reaction. Practices that describe an incident involving a third-party vendor and reassure the reader that they take privacy seriously get the other one, and the difference is entirely in whether the practice did the scoping work described above.