Share with your CISO
Healthcare providers deploying AI for diagnostics, documentation, and operational efficiency are doing so without a federal AI-specific rulebook, which means HIPAA’s existing Privacy and Security rules are the governing framework by default. HHS has proposed updates scheduled for July 2027, but that runway doesn’t create a compliance holiday. A Norton Rose Fulbright analysis of HIPAA obligations for AI-enabled tools warns that state-level rules, including new Texas requirements, are layering additional complexity on top of the federal baseline right now.
What this means for your business
The providers most exposed here aren’t necessarily the ones running the riskiest AI tools. They’re the ones that signed business associate agreements (contracts between a healthcare provider and a vendor who handles patient data on their behalf) with large AI platforms before those platforms started marketing directly to healthcare organizations at scale. The compliance posture that worked for a single EHR vendor doesn’t automatically extend to a multi-model AI stack where protected health information can travel across several systems before a diagnosis is surfaced.
The July 2027 date for proposed HIPAA updates is already shaping vendor behavior in a specific and somewhat distorting way. Platforms are pitching “HIPAA-ready” AI products against a future regulatory standard that hasn’t been finalized, which means procurement teams are evaluating compliance claims that don’t yet have a fixed target to be compliant with. Norton Rose Fulbright’s authors practice in this space, which gives their reading of current obligations real weight, though it also means the framing tilts toward comprehensive legal review as the response rather than lighter-touch operational fixes.
The state-level variable is the one that breaks the “wait for federal clarity” strategy. Texas isn’t the last state that will move. A CISO whose organization operates across multiple states is already holding a patchwork compliance problem, and every quarter that passes without a federal AI standard is a quarter where that patchwork gets more complicated. The renewal decision that matters most right now isn’t a new AI contract; it’s whether the existing vendor agreements governing patient data were written with enough flexibility to accommodate the AI capabilities those vendors are now activating by default.
Based on reporting from Navigating AI compliance with HIPAA essentials | Global law firm, originally published 2026-09-22 06:20:00.
