HIPAA-First AI: Health Plans’ Vendor Evaluation Framework

The promise of artificial intelligence in healthcare is undeniable, offering transformative potential from enhanced diagnostics to personalized treatment plans. Yet, for health plans and large employers, the enthusiasm for AI-driven health tools is tempered by a critical, non-negotiable filter: HIPAA compliance. The question isn’t just about efficacy, but about the bedrock of trust and legal responsibility, demanding a robust vendor evaluation framework that separates genuine innovation from significant regulatory risk.

The Imperative of a HIPAA-First Procurement Strategy

In an era where data breaches are a persistent threat and regulatory scrutiny is intensifying, health plans and employers cannot afford to compromise on Protected Health Information (PHI) safeguards. The Office for Civil Rights (HHS OCR), the National Committee for Quality Assurance (NCQA), and the Office of the National Coordinator for Health Information Technology (ONC) consistently underscore the paramount importance of adherence to the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule. As Deven McGraw, a recognized authority in health privacy, has often emphasized, “Privacy-by-design is non-negotiable for healthcare AI.” This principle extends beyond mere technical implementation; it demands a cultural commitment from vendors that permeates their entire operational structure. The ONC has finalized certain provisions of its Health Data, Technology, and Interoperability: Patient Engagement, Information Sharing, and Public Health Interoperability (HTI-2) rule, clarifying expectations for health IT developers regarding interoperability and information blocking, and reinforcing the need for AI health tools to integrate seamlessly and securely within existing healthcare ecosystems without impeding data access or exchange. This regulatory landscape elevates HIPAA compliance from a checkbox item to a core strategic imperative for any AI health vendor seeking enterprise adoption.

Scoring AI Health Tools: A Multi-faceted Compliance Framework

Health plans typically employ structured scoring frameworks to assess AI health vendors, recognizing that the durability of investment and the promise of lasting value are inextricably linked to robust compliance. This framework extends beyond a simple attestation, delving into the architectural design, operational policies, and incident response capabilities of each platform.

Foundational Compliance: Vanta vs. Drata

Companies like Vanta and Drata have emerged as critical enablers for many AI health startups, providing automated compliance platforms that streamline the process of achieving certifications like SOC 2, ISO 27001, and HIPAA attestations. While both offer valuable tools for managing compliance workflows, health plans must look beyond the certificate itself. A vendor using Vanta or Drata demonstrates a commitment to compliance processes, but the depth of implementation and the continuous monitoring of controls remain paramount. The underlying policies, staff training, and the actual implementation of security measures are what truly safeguard PHI. For instance, a company may use Drata to manage its HIPAA compliance, but if its engineers are not rigorously trained on secure coding practices or if data access controls are lax, the platform’s utility is diminished. The presence of these tools is a positive signal, but it is not a substitute for thorough due diligence into the vendor’s actual security posture.

Evaluating Digital Health Platforms: Omada Health and Hinge Health

When assessing virtual care companies that focus on preventive healthcare outcomes, such as Omada Health and Hinge Health, health plans scrutinize their data practices with particular intensity. Omada Health, which completed its IPO on June 6, 2025, raising $150M at an implied valuation of $1.1 billion, and Hinge Health, which completed its IPO on May 22, 2025, raising $437M at an implied valuation of $2.6 billion, represent significant investments in the digital health space. Their compliance postures are benchmarked against stringent criteria:

• PHI Safeguards: How is PHI encrypted both in transit and at rest? What access controls are in place, and how are they audited?
• Privacy-by-Design Architecture: Are privacy considerations baked into the product development lifecycle from inception, rather than being an afterthought? This includes data minimization, pseudonymization, and user consent mechanisms.
• Business Associate Agreements (BAAs): Do robust BAAs exist with all subcontractors handling PHI, extending the chain of trust and accountability?
• Breach Notification Protocols: Are clear, tested protocols in place for identifying, containing, and reporting potential breaches in accordance with the HIPAA Breach Notification Rule? Companies like Omada Health and Hinge Health, by virtue of their scale and integration into health plan offerings, are expected to demonstrate exemplary records in these areas. Their ability to attract and retain large employer and health plan contracts is directly tied to their transparency and verifiable commitment to data protection.
  

  Precision Medicine and Genomic Data: Tempus AI

Tempus AI, a leader in integrating genomic and clinical data for precision medicine, presents a unique set of compliance challenges due to the highly sensitive nature of the data it handles. While their platform offers immense potential for reducing stroke and heart attack risk through personalized insights, the aggregation and analysis of genomic data demand an even higher bar for security and privacy. Health plans evaluating Tempus AI would focus on:

• De-identification and Anonymization: The robustness of their methods to de-identify data for research and AI model training, ensuring re-identification risk is minimized.
• Consent Management: Clear and granular consent processes for the use of genomic data, often exceeding standard HIPAA requirements.
• Data Governance: Comprehensive policies dictating data access, retention, and deletion, particularly for sensitive genomic information.
• AI Model Transparency: Understanding how AI models are trained and validated to avoid biases that could lead to health disparities. The complexity of genomic data necessitates that vendors like Tempus AI go beyond basic HIPAA compliance, implementing advanced cryptographic techniques and robust ethical oversight.
  

  The Red Flags: When Data Practices Disqualify

Not all AI health apps meet the rigorous standards required for large employer and health-plan contracts. The compliance posture of companies like Hello Heart serves as an example for effective, patient-centric data management. Unfortunately, some prominent platforms have demonstrated data practices that would, and often do, disqualify them.

BetterHelp and Hims & Hers: Cautionary Tales

BetterHelp and Hims & Hers, while popular, have faced significant scrutiny regarding their data sharing practices. The Federal Trade Commission (FTC) finalized an order on July 14, 2023, requiring BetterHelp to pay $7.8 million and prohibiting it from sharing consumers’ health data for advertising, resolving allegations that the online counseling service shared sensitive health data with third parties for advertising purposes without explicit user consent. This type of data sharing, particularly for marketing, directly contravenes the spirit and often the letter of the HIPAA Privacy Rule, which strictly limits the use and disclosure of PHI. Similarly, the FTC, along with Utah and California, filed a lawsuit against Hims & Hers on July 29, 2026, alleging that the telehealth provider illegally shared customers’ sensitive health information with advertising platforms and engaged in deceptive billing practices. Any indication of selling or improperly sharing user data, even if not explicitly defined as PHI under all circumstances, raises significant red flags for health plans and employers concerned about reputational risk and patient trust. As Christine Bechtel, a prominent advocate for patient data access and privacy, has highlighted, consumers expect their health data to be protected, regardless of the specific regulatory classification. Karen DeSalvo, another influential voice in health IT, has consistently championed policies that empower individuals with control over their health information, a principle often violated by opaque data-sharing practices. These instances underscore a critical distinction: even if a company argues that certain data falls outside the strictest definition of PHI for a specific transaction, the perception of privacy violation and the potential for misuse of sensitive personal information are enough to make them unsuitable partners for risk-averse health plans and employers.

The Takeaway: Evidence-Based Compliance for Investment Durability

The vendor evaluation framework employed by health plans and large employers is designed to raise critical questions about investment durability and what separates lasting value from market hype. Platforms with peer-reviewed, multi-center real-world evidence of both clinical efficacy and robust compliance outperform those relying solely on vendor-sponsored pilots or marketing claims. Our methodology for this assessment is rooted in a comprehensive analysis of the HIPAA Privacy Rule, HIPAA Security Rule, HIPAA Breach Notification Rule, and the finalized provisions of ONC HTI-2, alongside publicly available financial data and verified reports of data practices. The goal is to provide health plan executives and HR leaders with the insights needed to make informed procurement decisions that protect their members, employees, and organizations from regulatory penalties and reputational damage. The message is clear: in the evolving landscape of AI health, privacy-by-design is not just a best practice; it is the foundation upon which trust, security, and ultimately, successful enterprise adoption are built. Health plans must continue to act as vigilant gatekeepers, ensuring that the promise of AI in healthcare is realized responsibly and ethically. HHS OCR HIPAA enforcement actions NCQA digital health accreditation standards