Map HIPAA duties across the client's record systems
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- For each system the lawyer names, record whether the lawyer has marked the operator as a covered entity or a business associate, what protected health information it holds, and which § 164.502 pathway the lawyer is considering. Do not decide that a use is permitted.
- What the lawyer must review
- The HHS page says the HIPAA Rules apply to covered entities and business associates, and that an entity which is neither does not have to comply. Definitions are at 45 CFR § 160.103. Section 164.502(a) prohibits a covered entity or business associate from using or disclosing protected health information except as the subpart or subpart C of part 160 permits or requires. Required disclosures in § 164.502(a)(2) include disclosure to the individual when § 164.524 requires it, and disclosure to the Secretary for a compliance investigation. A business associate may use or disclose protected health information only as its contract under § 164.504(e) permits or as law requires. You apply that text to the systems.
- Written for / version
- United States versionUSAU
Who does what
| Role | What they do |
|---|---|
| Assistance | Do not begin AI assistance until the responsible lawyer has defined and confirmed its permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Review operative clauses in the complete document, including definitions, cross-references, schedules and inconsistencies with the instructions.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.
Forms and precedents for this task
| Form or precedent | Kind | AI use | Summary |
|---|---|---|---|
| HIPAA business associate agreement checklist | Checklist | AI use Yellow | Checklist for the written terms in a HIPAA business associate contract under 45 CFR 164.504(e) and 164.502(e). |
| Notice of privacy practices review | Checklist | AI use Yellow | Review list for the required elements of a HIPAA notice of privacy practices under 45 CFR 164.520(b). |
| HIPAA use and disclosure limits checklist | Checklist | AI use Yellow | Checklist of the use and disclosure limits in 45 CFR 164.502 that a reviewer applies to a business associate contract and a privacy notice. |
Signed-in accounts can read the full text of each one. All precedents.