steve sparks
27 of 42
ContentsPart IV · Chapter 12

Chapter 12Where do my words go?

Health and student records

Some information, like patient records, is covered by specific laws. Using it needs more than an organization account: a specific contract and a deliberately configured workspace.12

HIPAA in four sentences

  1. PHI, protected health information, is identifiable health information held or sent by a health plan, a health care provider or a clearinghouse (a "covered entity"), or by its business associate, in any form: electronic, paper or spoken.3
  2. A company that handles PHI on a covered entity's behalf is a business associate. HHS says a cloud provider counts even if it only stores encrypted data it has no key for.1
  3. The two sign a Business Associate Agreement (BAA), which limits how the data may be used, requires safeguards and breach reporting, passes the same duties to subcontractors, and requires the data be returned or destroyed at the end.4
  4. Use the minimum necessary,5 and when you can, de-identify: properly de-identified data is no longer PHI, though HHS notes the risk of re-identifying someone is very small, not zero.6
Go deeper: inside a regulated, HIPAA-ready workspace

A regulated workspace, room by room

Illustration
A building. Its foundation is the Business Associate Agreement. Its front door is a one-way switch an administrator turns on. Inside are four kinds of rooms: covered features, features that are open but outside the agreement, connections to other companies under their own terms, and features not available. A security desk holds the admin controls, and two signs remind people to use the minimum necessary and to de-identify.Coveredfeatures✓3Open, butoutside theagreement4Connectionsto other companies5Notavailable6Security desk72Minimum necessaryDe-identify8Business Associate Agreement1
  1. Foundation: the BAA. Nothing above it counts without the signed agreement.41
  2. Front door: a one-way switch. Anthropic, for example, makes turning on its HIPAA-ready setup a deliberate step an administrator takes, and says it can't be reversed from organization settings.2
  3. Covered rooms. Features the agreement covers. Vendors publish the current list.1110
  4. Open, but outside the agreement. Some features stay usable in the workspace but aren't covered for PHI. Keep patient information out of them.1110
  5. Connections to other companies. A connector that sends data to another company's service is under that company's terms, not the AI vendor's BAA.11
  6. Not available. Some features are switched off entirely in a regulated workspace.11
  7. Security desk: admin controls. Sign-in through the organization, an automatic roster of who has access, activity logs, retention settings and roles.1213141516
  8. People: the habits. Use the minimum necessary,5 and de-identify when you can.6

A general picture, not any one vendor's product. Which features are covered differs by vendor and plan and changes often; the vendor's current documentation and your signed agreement are the reference.

Student records have their own federal law, FERPA. Schools can share them with an outside service only under conditions, such as the service acting as a "school official" under the school's direct control.1718

Notes (18)
  1. 1U.S. Department of Health & Human Services, “Guidance on HIPAA & Cloud Computing,” HHS.gov, last reviewed December 23, 2022, https://www.hhs.gov/hipaa/for-professionals/special-topics/cloud-computing (accessed October 26, 2026).
  2. 2Anthropic, “HIPAA-ready Enterprise plans,” Claude Help Center, https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans (accessed October 26, 2026).
  3. 3U.S. Department of Health & Human Services, “Summary of the HIPAA Privacy Rule,” HHS.gov, last reviewed March 14, 2025, https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations (accessed October 26, 2026).
  4. 4HHS Office for Civil Rights, “Sample Business Associate Agreement Provisions,” HHS.gov, January 25, 2013, https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html (accessed October 26, 2026).
  5. 5U.S. Department of Health & Human Services, “Minimum Necessary Requirement,” HHS.gov, last reviewed July 26, 2013, https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement (accessed October 26, 2026).
  6. 6U.S. Department of Health & Human Services, “Guidance Regarding Methods for De-identification of Protected Health Information,” HHS.gov, last reviewed February 3, 2025, https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification (accessed October 26, 2026).
  7. 7U.S. Department of Health & Human Services, “Summary of the HIPAA Security Rule,” HHS.gov, last reviewed August 7, 2026, https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations (accessed October 26, 2026).
  8. 8Anthropic, “What Certifications has Anthropic obtained?” Anthropic Privacy Center, March 16, 2026, https://privacy.claude.com/en/articles/10015870-what-certifications-has-anthropic-obtained (accessed October 26, 2026).
  9. 9OpenAI, “Getting a Business Associate Agreement for the OpenAI API,” OpenAI Help Center, https://help.openai.com/en/articles/8660679-getting-a-business-associate-agreement-for-the-openai-api (accessed October 26, 2026).
  10. 10OpenAI, “HIPAA eligible products and functionality,” OpenAI Help Center, https://help.openai.com/en/articles/20001069-hipaa-eligible-products-and-functionality (accessed October 26, 2026).
  11. 11Anthropic, “Business Associate Agreements (BAA) for Commercial Customers,” Anthropic Privacy Center, https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers (accessed October 26, 2026).
  12. 12Anthropic, “Set up single sign-on (SSO),” Claude Help Center, https://support.claude.com/en/articles/13132885-set-up-single-sign-on-sso (accessed October 26, 2026).
  13. 13Anthropic, “Access audit logs,” Claude Help Center, June 15, 2026, https://support.claude.com/en/articles/9970975-access-audit-logs (accessed October 26, 2026).
  14. 14Anthropic, “Configure custom data retention controls for Enterprise plans,” Claude Help Center, https://support.claude.com/en/articles/10440198 (accessed October 26, 2026).
  15. 15Anthropic, “Set up role-based permissions on Enterprise plans,” Claude Help Center, https://support.claude.com/en/articles/13930458-set-up-role-based-permissions-on-enterprise-plans (accessed October 26, 2026).
  16. 16OpenAI, “Introducing OpenAI for Healthcare,” January 8, 2026, https://openai.com/index/openai-for-healthcare/ (accessed October 26, 2026).
  17. 17U.S. Department of Education, “What is an education record?” studentprivacy.ed.gov, n.d., https://studentprivacy.ed.gov/faq/what-education-record (accessed October 26, 2026).
  18. 18U.S. Department of Education, “Who is a 'school official' under FERPA?” studentprivacy.ed.gov, n.d., https://studentprivacy.ed.gov/faq/who-school-official-under-ferpa (accessed October 26, 2026).

Chapter 12 · page 3 of 3

Turn pages with the ← and → keys.

Cite this page

https://aifromthepartsup.com/where-do-my-words-go/3/

Using this book

© 2026 Steve Sparks. All rights reserved. You're welcome to quote short passages and cite any page, with a link back. To reuse diagrams or larger parts, ask through GitHub.

Quoted material and figures from other sources remain their owners'.