Artificial intelligence tools have entered home health operations at a pace that has significantly outrun the compliance frameworks most agencies have in place to govern their use. Care coordinators use ChatGPT to draft care plan language. Billing staff use AI writing assistants to generate prior authorisation documentation. Clinical supervisors use AI scheduling tools to optimise visit routing. Some EHR platforms have begun incorporating AI-generated documentation suggestions into clinical workflows. Each of these uses creates HIPAA documentation obligations that most home health HIPAA programmes have not yet addressed — not because administrators are negligent, but because the guidance has lagged the technology.
The HIPAA obligations that attach to AI tool use in home health are not new regulations created specifically for AI. They are the application of existing HIPAA Security Rule and Privacy Rule requirements to a new category of technology. Understanding how those existing requirements apply to AI tools — and what documentation they generate — allows home health agencies to use AI productivity tools compliantly rather than being forced to choose between productivity and compliance.
The Core HIPAA Obligation: If AI Touches PHI, It Must Be Managed Like Any Other System
The first and most important principle: any AI tool that creates, receives, maintains, or transmits PHI is a covered system under the HIPAA Security Rule and requires a Business Associate Agreement with the vendor. This principle applies regardless of how the tool is marketed, what its primary purpose is, or how incidentally it touches patient information. A care coordinator who pastes a patient's name, diagnosis, and care plan goals into ChatGPT to generate a draft care coordination letter has introduced that patient's PHI into a system operated by OpenAI — a system that does not have a BAA with the agency because the agency has not pursued one.
This is not a hypothetical compliance gap. It is the most common AI-related HIPAA gap I identify when assessing home health agencies in 2026. The administrative convenience of general-purpose AI tools — which are available immediately, require no procurement process, and deliver immediate productivity value — has consistently outpaced the compliance process of establishing BAA coverage for those tools before patient information is introduced into them.
Healthcare AI Tools With BAA Programmes vs. Consumer AI Tools
The AI tool landscape in 2026 has bifurcated into healthcare-specific tools with BAA programmes and consumer tools without them. Microsoft Copilot for Microsoft 365, when deployed through Microsoft 365 Business Premium or Enterprise agreements with a Microsoft HIPAA BAA in place, can process PHI within the Microsoft 365 environment with BAA coverage. Google Workspace AI features, when deployed through Google Workspace for Healthcare with the Google BAA, carry BAA coverage. Purpose-built healthcare AI tools — AI scribing tools, clinical documentation assistants, AI-powered coding support — typically provide BAAs as a standard feature.