Industries · Healthcare
AI in healthcare starts with knowing where PHI goes.
Find AI tools touching protected health information, confirm Business Associate Agreements, and govern clinical documentation AI.
The landscape
How AI is changing risk in healthcare
Clinicians and staff are adopting AI quickly — ambient scribes that draft visit notes, assistants that summarize charts, and general chat tools used to write patient letters or appeal denials. Each of these can create, receive, or transmit protected health information. Under the HIPAA Privacy and Security Rules, a vendor that handles PHI on your behalf is generally a business associate and must sign a Business Associate Agreement, and your risk analysis should account for the systems where ePHI lives.
What to do first
Include AI in your HIPAA risk analysis
List AI systems that touch ePHI in your security risk analysis and document safeguards for each.
Confirm BAA coverage by plan tier
Many AI vendors sign BAAs only for specific products or plans. Record which product and tier the BAA covers.
Require clinician review
AI-drafted clinical content should be reviewed and attested by the responsible clinician before it enters the record or reaches a patient.
Free readiness check
AI readiness check for healthcare
A short, industry-specific check. You get the gaps your answers reveal, why each matters, and what to do next — not a score. Runs in your browser; no signup.
Six questions about how AI touches protected health information in your organization. Answer for how things work today. Your answers stay in your browser; FlashTower records only anonymous usage events.
Readiness summary
0 of 6 answered
Your summary lists each gap your answers reveal, why it matters in healthcare, what to do next, and the public frameworks it maps to. It is not a score.
Based only on your answers, using fixed rules. Frameworks are listed for orientation; this summary does not determine whether you meet any law or standard and is not legal advice.
FlashTower findings are informational. No security system detects or prevents every threat, and FlashTower does not certify compliance or provide legal advice.
Common exposures
Where AI risk concentrates
PHI in tools without a BAA
Staff paste patient details into consumer or business AI tools whose vendor has not signed a BAA — or offers one only on an enterprise tier you have not purchased.
Ambient and clinical documentation AI
Ambient scribes record and transcribe encounters. You need clarity on retention, whether audio or transcripts train models, who can access them, and how clinicians review AI-drafted notes before signing.
Unlogged access to ePHI
AI systems with access to the EHR, shared drives, or patient messaging often lack audit logs, making it hard to meet audit-control expectations or investigate a possible disclosure.
Agents that message patients
AI that can send portal messages, texts, or email to patients without review can disclose PHI to the wrong person or give clinical guidance no one approved.
FlashTower rules
Rules most relevant to healthcare
These are real rules from the FlashTower Risk Engine. Each fires only when your answers meet its stated condition.
FT-DAT-010 · Sensitive Data
AI system accesses health information without a BAA
The AI system accesses PHI, is vendor-hosted, and no Business Associate Agreement is in place.
Mapped to: HIPAA Security Rule 164.308(b)(1) · HIPAA Security Rule 164.314(a) · NIST AI RMF GOVERN 6.1 · OWASP LLM Top 10 LLM02
CriticalFT-DAT-011 · Sensitive Data
Highly sensitive data in a consumer AI account
A free or personal consumer AI plan is used with health data, payment card data, privileged legal material, or credentials.
Mapped to: OWASP LLM Top 10 LLM02 · NIST CSF 2.0 PR.DS-01 · ISO 27001 A.8.12 · SOC 2 TSC C1.1
CriticalFT-COM-001 · External Communications
AI sends or publishes externally without review
The AI system can send email/messages or publish content without per-action human approval.
Mapped to: OWASP LLM Top 10 LLM06 · NIST AI RMF GOVERN 1.4 · ISO 27001 A.5.14
HighFT-VEN-001 · Vendor Risk
AI vendors are not reviewed before handling regulated data
The organization handles regulated data and does not review AI vendors before adoption.
Mapped to: NIST AI RMF GOVERN 6.1 · NIST CSF 2.0 GV.SC-06 · ISO 27001 A.5.19 · SOC 2 TSC CC9.2
HighFT-DAT-001 · Data Exposure
AI data retention not configured for regulated data
The organization handles regulated data and has not configured AI data-retention settings.
Mapped to: NIST CSF 2.0 PR.DS-01 · ISO 27001 A.8.10 · SOC 2 TSC C1.2
MediumFT-LOG-010 · Logging
AI system with sensitive data is not logged
The AI system accesses sensitive data and its activity is not logged or logging is unknown.
Mapped to: NIST CSF 2.0 PR.PS-04 · ISO 27001 A.8.15 · HIPAA Security Rule 164.312(b) · SOC 2 TSC CC7.2
Medium
This page provides general information, not legal advice. FlashTower does not certify compliance with HIPAA, GLBA, NYDFS Part 500, professional-conduct rules, SOC 2, FedRAMP, or any other law or standard; findings and gaps are mapped to frameworks for orientation only. Consult qualified counsel and your compliance advisors about your obligations.
See what AI can access in your healthcare organization.
Run the free FlashTower Scan. Get your AI risk score and every finding in about 10 minutes — no account or system access required.