AI Health at Work: HR’s HIPAA Checklist for Compliance

As employers increasingly integrate artificial intelligence (AI) powered health solutions into their benefits packages, the critical question for HR teams and health plan executives is not merely about efficacy, but about compliance. Employer-sponsored AI health programs, while promising significant improvements in employee well-being and cost management, introduce complex data privacy and security challenges. Navigating this landscape demands a rigorous procurement filter, one deeply rooted in the foundational principles of HIPAA, ERISA, and the ADA.

The Imperative of HIPAA Compliance in Employer-Sponsored AI Health

The adoption of AI health apps by employers and health plans creates direct obligations under various regulatory frameworks. As Deven McGraw, a prominent voice in health privacy, has consistently highlighted, the collection, processing, and storage of health data, even in wellness programs, must adhere to stringent privacy and security standards. The relationship between an employer, its health plan, and the AI health vendor often triggers HIPAA obligations, particularly when the employer acts as a plan sponsor. This means that AI health apps like Omada Health, Hinge Health, Spring Health, Noom, Hims & Hers, and BetterHelp, when offered through employer benefits, must demonstrate robust compliance.

The core issue revolves around protected health information (PHI). If these platforms handle PHI on behalf of a covered entity (the health plan or, in certain circumstances, the employer), they become business associates under HIPAA. This necessitates a Business Associate Agreement (BAA) and adherence to the HIPAA Privacy Rule and the evolving HIPAA Security Rule. Recent and proposed updates to the Security Rule, for instance, emphasize mandatory multi-factor authentication and encryption of all electronic protected health information (ePHI), moving beyond previous ‘addressable’ flexibilities. Additionally, compliance with new requirements related to Substance Use Disorder (SUD) records became mandatory on February 16, 2026. Proposed changes to the HIPAA Privacy Rule also aim to shorten patient record access timelines. Without this foundational agreement and demonstrated compliance, an employer risks significant penalties from the HHS Office for Civil Rights (HHS OCR) HHS OCR HIPAA enforcement actions.

Consider the data flows: an employee enrolls in Omada Health for chronic disease management, or uses Hinge Health for musculoskeletal care, or engages with Spring Health for mental health support. Information about their health conditions, treatments, and progress is shared with these platforms. If this information is identifiable and linked to the health plan, it constitutes PHI. The same applies to more consumer-facing apps like Noom, Hims & Hers, and BetterHelp when they are integrated into an employer’s benefits ecosystem. The expectation is that these vendors, regardless of their primary consumer market, operate with the same level of data protection as a traditional healthcare provider.

Evaluating AI Health Vendors: Beyond the Marketing Hype

For HR teams and health plan executives, a rigorous vendor evaluation framework is non-negotiable. It begins with a comprehensive HIPAA compliance checklist. This checklist should go beyond a simple “yes/no” on a BAA. It must delve into the vendor’s internal data governance policies, security architecture, employee training, incident response plans, and audit capabilities. Karen DeSalvo, a former National Coordinator for Health IT, has often emphasized the importance of transparent data practices and robust security measures in digital health tools. Employers must scrutinize how these AI platforms collect, use, and disclose employee health data. Are they selling or sharing aggregated, de-identified data for purposes beyond the scope of the employer’s health program? Are they using AI models trained on sensitive employee data without explicit, informed consent for that specific use?

For example, a platform like BetterHelp, while offering valuable mental health services, must be assessed on how it segregates and protects employer-sponsored data from its general consumer data pools, and whether its data use policies align with employer expectations under HIPAA. Similarly, Hims & Hers, which provides telehealth and prescription services, must demonstrate clear boundaries regarding the use of employee data. The risk tracker for major AI health apps that HIPAA AI Health provides is designed precisely for this purpose: to highlight potential compliance gaps that could disqualify a vendor from large employer or health plan contracts.

A critical dimension is the “enterprise procurement filter” for AI health tools. It’s not enough for an app to claim HIPAA compliance; they must prove it through independent audits (e.g., SOC 2 Type II, HITRUST certification) and detailed documentation of their security controls HITRUST certification requirements. Without this, the employer is exposed. CW5-DP-17, for instance, highlights that a significant percentage of digital health vendors lack adequate transparency in their data sharing practices, which is a red flag for any employer considering integration.

Regulatory Context: ERISA, ADA, and Oversight Bodies

Beyond HIPAA, employer-sponsored health programs are also governed by the Employee Retirement Income Security Act (ERISA) and the Americans with Disabilities Act (ADA). ERISA mandates fiduciary duties for plan sponsors, requiring them to act solely in the interest of plan participants and beneficiaries. This extends to selecting and monitoring vendors for health benefits, including AI health apps. The Department of Labor (DOL) has recently updated its cybersecurity guidance for all ERISA plans and finalized its Retirement Security Rule in April 2024, which updated the definition of an investment advice fiduciary. A failure to perform due diligence on a vendor’s HIPAA compliance could be seen as a breach of fiduciary duty by the Department of Labor (DOL).

The ADA, enforced by the Equal Employment Employment Opportunity Commission (EEOC), prohibits discrimination based on disability. While AI health apps can support employee health, employers must ensure that their implementation does not inadvertently lead to discriminatory practices or create barriers to access for employees with disabilities. For example, if an AI health app is the primary gateway to a benefit, but its interface is not accessible, it could raise ADA concerns. The Department of Justice, in April 2024, issued a final rule under Title II of the ADA establishing explicit technical requirements for digital accessibility for state and local governments, requiring web content and mobile applications to conform to WCAG 2.1 Level AA standards. While initial compliance dates for larger public entities were set for April 24, 2026, an Interim Final Rule extended this to April 26, 2027. This trend underscores the increasing importance of digital accessibility across all platforms. Furthermore, the data collected by these apps must not be used to inform employment decisions in a way that violates the ADA.

The regulatory landscape is not static. The HHS OCR, DOL, and EEOC continuously provide guidance and enforcement actions that shape how employers must manage health data and benefits. Employers must therefore ensure that their chosen AI health platforms are not only compliant today but are also committed to adapting to evolving regulatory interpretations and technological advancements in data security and privacy.

The Path Forward: A Call to Vigilance

For employers and health plan executives, the deployment of AI health programs like those offered by Omada Health, Hinge Health, Spring Health, Noom, Hims & Hers, and BetterHelp presents a dual opportunity: to enhance employee well-being and to navigate a complex regulatory environment. The key takeaway is that due diligence on data privacy and security is paramount. A superficial review of vendor claims is insufficient. Instead, a deep dive into their compliance posture, guided by a robust HIPAA compliance checklist and vendor evaluation frameworks, is essential. Failure to do so not only risks regulatory penalties but also erodes employee trust, undermining the very benefits these innovative AI tools aim to deliver. Proactive verification is not just good practice; it is a fundamental requirement for responsible AI integration in employer-sponsored health programs Best practices for vendor risk management in healthcare.