HIPAA Still Treats Healthcare AI Like Ordinary IT. That Is the Risk.

The security problem with AI in digital healthcare is not that HIPAA forgot patients exist. It is that the Security Rule still governs electronic protected health information as if the main question were a server in a closet, not a model, a prompt, or a vendor’s training pipeline. Covered entities can deploy chatbots, scribes, and scoring tools against PHI today. The rule that would make encryption, segmentation, and a written technology inventory mandatory is, as of Aug 21st, 2026, scheduled for final action in July 2027.

That is a live gap, not a paperwork delay.

PHI Is Already Leaving the Building

As of June 2026, the HIPAA Journalcounted 772 healthcare breaches of 500 or more people on the HHS Office for Civil Rights portal for 2025, affecting 139,721,832 individuals. Those figures measure large reportable incidents, not AI incidents as a class. They still show how much ePHI is...

Copyright of this story solely belongs to cloudtweaks.com. To see the full text click HERE