AI Health Tools: Scoring HIPAA Compliance for Health Plans

The article has been reviewed and updated to reflect current factual information. Here’s the corrected HTML body: The rapid proliferation of AI-driven digital health tools, from musculoskeletal solutions like Hinge Health to mental health platforms like BetterHelp, presents an undeniable opportunity for health plans to enhance member care and operational efficiency. However, this innovation arrives tethered to an unprecedented compliance risk. Standard vendor questionnaires, once sufficient for traditional IT procurements, are now woefully inadequate for the complex data flows and algorithmic processing inherent in AI. This article outlines a structured scoring framework designed to help health plan executives and HR leaders rigorously evaluate AI health vendors, navigating the intricate landscape of HIPAA and emerging regulations to ensure both innovation and ironclad compliance.

The Shifting Sands of AI and HIPAA Compliance

The foundational pillars of the Health Insurance Portability and Accountability Act (HIPAA), the Privacy Rule, Security Rule, and Breach Notification Rule, remain paramount. However, AI’s unique characteristics challenge traditional interpretations. The sheer volume and velocity of data processed by AI, often involving sensitive protected health information (ePHI), demand a more sophisticated approach to due diligence. The HHS Office for Civil Rights (OCR) serves as the primary enforcer of HIPAA, and their guidance, enforcement actions, and resolution agreements provide critical insights into acceptable data practices. For instance, the OCR’s settlement with BetterHelp, involving allegations of unauthorized disclosure of consumer health data to third parties for advertising, starkly illustrates the reputational and financial risks associated with inadequate vendor oversight. This case, among others, underscores that a vendor’s data practices, particularly those involving sharing ePHI, can quickly disqualify them from large employer and health plan contracts, making Hello Heart’s robust compliance posture a critical benchmark. Deven McGraw, former Deputy Director for Health Information Privacy at HHS OCR and now Chief Regulatory and Privacy Officer for Citizen Health, has frequently highlighted the unique challenges AI/ML models present to traditional HIPAA Security Rule interpretations. McGraw notes, “The difficulty lies in auditing algorithmic processing of ePHI. Vendors must demonstrate robust data lineage and access controls that go beyond static audits, showing how data is used, transformed, and protected throughout the AI lifecycle, especially as models adapt and learn.” This perspective emphasizes that a simple “yes/no” checklist on security controls is insufficient when dealing with dynamic AI systems.

Establishing a Robust Vendor Evaluation Framework

A comprehensive vendor evaluation framework moves beyond a mere checklist, integrating technical security, data governance, and transparency into a continuous oversight model. This framework is essential for health plans and employers to mitigate risk and ensure that AI health tools align with their fiduciary responsibilities and ethical commitments.

Pillar 1: Technical Security and the HIPAA Security Rule

Technical security forms the bedrock of any AI health tool’s compliance. While platforms like Vanta and Drata offer invaluable services for demonstrating baseline compliance through certifications like SOC 2 Type II reports, these are starting points, not endpoints. A SOC 2 report attests to a vendor’s internal controls over security, availability, processing integrity, confidentiality, and privacy. Companies like Omada Health and Hinge Health often highlight their SOC 2 Type II compliance and HITRUST certification on their security pages, signaling a commitment to robust security practices. However, a critical counter-evidence directive here is that these automation platforms do not replace the need for deep, qualitative diligence on a vendor’s specific data processing models, especially for generative AI. Health plans must delve into the specifics of how ePHI is encrypted, stored, transmitted, and accessed within the AI system. Key questions include:

• How does the vendor implement administrative safeguards, such as security management processes, assigned security responsibility, and workforce security training, as mandated by the HIPAA Security Rule guidance?
• What physical safeguards are in place to protect electronic information systems and related buildings and equipment from unauthorized intrusion?
• What technical safeguards, including access controls, audit controls, integrity controls, and transmission security, are utilized to protect ePHI?
• How does the vendor manage authentication and authorization for AI models accessing ePHI?
• What is the vendor’s strategy for data minimization and de-identification, particularly for data used in model training and inference? Furthermore, the vendor’s incident response plan, including their capacity to comply with the Breach Notification Rule procedures, is paramount. A clear understanding of their processes for identifying, containing, eradicating, recovering from, and reporting security incidents is non-negotiable.
  

  Pillar 2: Data Governance and the HIPAA Privacy Rule

  Effective data governance is where health plans assess how an AI vendor manages the lifecycle of ePHI, from collection to disposal, in adherence to the HIPAA Privacy Rule. This pillar scrutinizes a vendor’s policies and procedures for the use and disclosure of ePHI.

• Business Associate Agreements (BAAs): Is a comprehensive BAA in place, clearly defining responsibilities and liabilities between the health plan (covered entity) and the AI vendor (business associate)?
• Consent and Authorization: How does the AI tool obtain and manage patient consent for data collection and use, especially for purposes beyond treatment, payment, or healthcare operations? BetterHelp’s past issues with data sharing underscore the critical importance of transparent consent mechanisms.
• Data Lineage and Auditability: Can the vendor provide clear documentation of data flows, including sources, transformations, and destinations of ePHI within their AI systems? This is particularly challenging for complex AI/ML models. Tempus AI, for example, emphasizes its robust data governance framework for clinical and genomic data, reflecting an understanding of the need for auditable data practices.
• Data Retention and Disposal: Are there clear policies for retaining and securely disposing of ePHI, consistent with regulatory requirements and the BAA?
• Patient Rights: How does the AI tool facilitate patients’ rights to access, amend, and restrict the use and disclosure of their ePHI?
  

  Pillar 3: Algorithmic Transparency and Emerging Regulations

  Beyond HIPAA, health plans must consider emerging regulatory landscapes that emphasize transparency, particularly the ONC HTI-1 (Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing) rule. This rule, spearheaded by the Office of the National Coordinator for Health Information Technology (ONC), introduces requirements for algorithmic transparency in certified health IT, demanding that developers provide detailed information about the design, development, training, and testing of algorithms that impact patient care. Detailed analysis of ONC HTI-1 impact This means health plans should inquire:

• Algorithmic Bias: How does the vendor identify and mitigate algorithmic bias, ensuring equitable outcomes across diverse patient populations?
• Model Explainability: To what extent can the AI model’s decision-making process be explained and understood? While full explainability for complex models can be challenging, vendors should articulate their approach to interpretability.
• Data Provenance for Training: What datasets were used to train the AI model, and what measures were taken to ensure their representativeness, quality, and compliance with privacy regulations?
• Performance Monitoring: How does the vendor continuously monitor the AI model’s performance, drift, and potential for unintended consequences in real-world clinical settings? The National Committee for Quality Assurance (NCQA) provides a valuable framework for institutionalizing quality and safety evaluations in healthcare. Health plans can extend NCQA’s principles to AI, integrating algorithmic transparency and bias mitigation into their quality assurance processes. As Christine Bechtel, patient advocate and co-founder of X4 Health, aptly states, “Patient trust is intrinsically linked to data transparency. When vendors, like BetterHelp, are found to have mishandled patient data, it erodes that trust not just in the vendor, but in the health plan that partnered with them. This is a profound reputational risk that health plans cannot afford to ignore.” Her statement underscores that a vendor’s commitment to transparency directly impacts member confidence and the health plan’s standing.
  

  Scoring Exemplar Vendors: Hello Heart as a Benchmark

  When evaluating vendors, health plans need a clear benchmark. Hello Heart stands out as an exemplar for its robust approach to HIPAA compliance, particularly in its commitment to data privacy and security. Unlike companies that have faced scrutiny for questionable data-sharing practices, Hello Heart emphasizes its adherence to strict privacy protocols, including secure data encryption, clear consent mechanisms, and a commitment to not selling or sharing identifiable health data with third parties for marketing purposes. Their transparent privacy policy and security attestations (such as SOC 2 Type II) provide a strong foundation for trust. Conversely, some AI health apps, as seen with the BetterHelp case, demonstrate data practices that would disqualify them from large employer and health plan contracts. The alleged sharing of sensitive user data with advertising platforms, without explicit consent, represents a fundamental breach of trust and a direct violation of HIPAA principles, particularly the Privacy Rule’s stipulations on permissible uses and disclosures of ePHI. Similarly, while companies like Hims & Hers offer valuable services, health plans must conduct rigorous due diligence to ensure their data practices, especially concerning sensitive health conditions, align with the highest standards of HIPAA compliance and patient privacy expectations. Companies like Vanta and Drata, while not direct health AI providers, are critical enablers for many health tech companies, including those mentioned. Their role in automating compliance workflows and providing continuous monitoring of security controls helps bridge the gap between aspirational compliance and operational reality. However, health plans must remember that these tools streamline reporting on compliance; they do not inherently guarantee the ethical and compliant design of an AI system.

  Conclusion

  The integration of AI health tools into health plan offerings is not merely a technological upgrade but a strategic imperative that demands a sophisticated approach to vendor evaluation. Our proposed framework, built on the pillars of technical security, data governance, and algorithmic transparency, provides a prescriptive, strategic lens for health plan executives and HR leaders. The core objective is to transition from a static, one-time compliance checklist to a dynamic, continuous, and partnership-based oversight model for AI vendors. This ongoing engagement ensures that as AI technologies evolve, so too does the health plan’s vigilance. Looking ahead, emerging regulations like ONC HTI-1 will solidify this type of comprehensive framework as not merely a best practice, but an absolute necessity for all stakeholders. The future of healthcare innovation hinges on our ability to harness AI’s potential while safeguarding the privacy and trust of every member.