---
title: "Map HIPAA duties across the client's record systems"
url: "https://ailawframework.com/practice/health-and-medical-law/map-health-privacy-duties-across-the-records-systems/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A32-T1-R8-US"
practice_area: "Health & Medical Law"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Map HIPAA duties across the client's record systems

> For each system the lawyer names, record whether the lawyer has marked the operator as a covered entity or a business associate, what protected health information it holds, and which § 164.502 pathway the lawyer is…

Canonical page: https://ailawframework.com/practice/health-and-medical-law/map-health-privacy-duties-across-the-records-systems/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Health & Medical Law](https://ailawframework.com/practice/health-and-medical-law.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | For each system the lawyer names, record whether the lawyer has marked the operator as a covered entity or a business associate, what protected health information it holds, and which § 164.502 pathway the lawyer is considering. Do not decide that a use is permitted. |
| What the lawyer must review | The HHS page says the HIPAA Rules apply to covered entities and business associates, and that an entity which is neither does not have to comply. Definitions are at 45 CFR § 160.103. Section 164.502(a) prohibits a covered entity or business associate from using or disclosing protected health information except as the subpart or subpart C of part 160 permits or requires. Required disclosures in § 164.502(a)(2) include disclosure to the individual when § 164.524 requires it, and disclosure to the Secretary for a compliance investigation. A business associate may use or disclose protected health information only as its contract under § 164.504(e) permits or as law requires. You apply that text to the systems. |
| Written for | United States |
| Applies to | [Map health-privacy duties across the records systems](https://ailawframework.com/practice/health-and-medical-law/map-health-privacy-duties-across-the-records-systems.md) |

## Checking plan

- What the AI does: For each system the lawyer names, record whether the lawyer has marked the operator as a covered entity or a business associate, what protected health information it holds, and which § 164.502 pathway the lawyer is considering. Do not decide that a use is permitted.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- This check did not open 45 CFR § 160.103. Do not label a vendor a business associate until you have read the definition.
- State health-privacy statutes can be stricter. Open the state where the records sit.

## Sources

- [HHS: HIPAA covered entities and business associates](https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html) (checked 2026-10-22)
- [45 CFR § 164.502 (uses and disclosures of protected health information)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502) (checked 2026-10-22)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-10-22)

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [HIPAA business associate agreement checklist](https://ailawframework.com/precedents/health-and-medical-law/us-baa-checklist.md) | Checklist | Yellow | Checklist for the written terms in a HIPAA business associate contract under 45 CFR 164.504(e) and 164.502(e). It is a review list. It is not the contract. |
| [Notice of privacy practices review](https://ailawframework.com/precedents/health-and-medical-law/us-npp-review.md) | Checklist | Yellow | Review list for the required elements of a HIPAA notice of privacy practices under 45 CFR 164.520(b). It checks a draft. It is not the notice that is distributed. |
| [HIPAA use and disclosure limits checklist](https://ailawframework.com/precedents/health-and-medical-law/us-phi-use-limits.md) | Checklist | Yellow | Checklist of the use and disclosure limits in 45 CFR 164.502 that a reviewer applies to a business associate contract and a privacy notice. It does not authorise a use. |

Signed-in accounts can read the full text of each one.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*