---
title: "Review a clinical-tool contract for privacy limits"
url: "https://ailawframework.com/practice/health-and-medical-law/review-an-ai-clinical-tool-vendor-contract-for-privacy-and-tga-issues/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A32-B7-2-US"
practice_area: "Health & Medical Law"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Review a clinical-tool contract for privacy limits

> Extract the clauses on what information the vendor receives, whether it trains on inputs, who else can see them, and any clause that calls the vendor a business associate. Quote the page. Do not approve the contract.

Canonical page: https://ailawframework.com/practice/health-and-medical-law/review-an-ai-clinical-tool-vendor-contract-for-privacy-and-tga-issues/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Health & Medical Law](https://ailawframework.com/practice/health-and-medical-law.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | Extract the clauses on what information the vendor receives, whether it trains on inputs, who else can see them, and any clause that calls the vendor a business associate. Quote the page. Do not approve the contract. |
| What the lawyer must review | You decide whether the contract may be signed. 45 CFR § 164.502 provides that a covered entity or business associate may not use or disclose protected health information except as that subpart, or subpart C of part 160, permits or requires. The section refers to business-associate arrangements. The required contract terms in § 164.504(e) were not opened, so do not recite them. The HHS covered-entity page is the guide to who is a covered entity or a business associate. Formal Opinion 512 requires informed consent before information relating to a representation goes into a self-learning tool. No device regulator's advertising or classification rule was opened. |
| Written for | United States |
| Applies to | [Review an AI clinical-tool vendor contract for privacy and TGA issues](https://ailawframework.com/practice/health-and-medical-law/review-an-ai-clinical-tool-vendor-contract-for-privacy-and-tga-issues.md) |

## Checking plan

- What the AI does: Extract the clauses on what information the vendor receives, whether it trains on inputs, who else can see them, and any clause that calls the vendor a business associate. Quote the page. Do not approve the contract.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- Do not fill in the elements of a business-associate agreement from memory. Section 164.504(e) was not opened.
- A contract clause that uses the words business associate does not, by itself, meet § 164.502.

## Sources

- [45 CFR § 164.502 (uses and disclosures of protected health information)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502) (checked 2026-10-22)
- [HHS: HIPAA covered entities and business associates](https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html) (checked 2026-10-22)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-10-22)

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [HIPAA business associate agreement checklist](https://ailawframework.com/precedents/health-and-medical-law/us-baa-checklist.md) | Checklist | Yellow | Checklist for the written terms in a HIPAA business associate contract under 45 CFR 164.504(e) and 164.502(e). It is a review list. It is not the contract. |
| [HIPAA use and disclosure limits checklist](https://ailawframework.com/precedents/health-and-medical-law/us-phi-use-limits.md) | Checklist | Yellow | Checklist of the use and disclosure limits in 45 CFR 164.502 that a reviewer applies to a business associate contract and a privacy notice. It does not authorise a use. |
| [Business associate subcontractor assurance checklist](https://ailawframework.com/precedents/health-and-medical-law/us-subcontractor-assurance.md) | Checklist | Yellow | Checklist for satisfactory assurances when a business associate uses a subcontractor, and for the other arrangements in 45 CFR 164.504(e)(3). It is not the subcontract. |

Signed-in accounts can read the full text of each one.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*