Why Cloud AI BAAs Don't Cover What HIPAA Officers Think They Do — And What Healthcare Executives Buy Instead

OpenAI, Anthropic, Microsoft Azure OpenAI Service, Google Cloud Vertex AI, and AWS Bedrock all offer HIPAA Business Associate Agreements for qualifying enterprise customers — and none of them cover what most healthcare executives assume they cover. The BAA scope is narrow: the AI provider’s named service infrastructure, in the specific configuration agreed at contract, used for the specific purposes disclosed during negotiation. PHI processed outside that scope — through unintended prompts, third-party plugins, model outputs that reproduce identifiers, or workflows the customer didn’t disclose — typically isn’t covered. HHS OCR enforcement totaled approximately $13.5M in HIPAA settlements during 2024, the 2024 Change Healthcare breach affected an estimated 100M+ individuals per HHS reporting, and the December 2024 HIPAA Security Rule NPRM proposed tightened technical safeguards that affect AI-driven workflows. This article walks through what cloud AI BAAs actually cover, what they don’t, the enforcement signals healthcare executives should be tracking, and the on-premises deployment pattern that eliminates the BAA scope question for clinical reasoning workflows.

Do major cloud AI providers offer HIPAA BAAs?

Yes, all major cloud AI providers offer BAAs for qualifying enterprise customers, but the coverage scope of each BAA is narrower than most healthcare executives assume. OpenAI offers a BAA for ChatGPT Enterprise, ChatGPT Edu (with limitations), and direct API access through the OpenAI Platform under an enterprise agreement. Anthropic offers a BAA for Claude through the API and Claude for Work enterprise tier. Microsoft Azure OpenAI Service is covered under the standard Microsoft BAA for Azure services. Google Cloud Vertex AI and AWS Bedrock both offer BAAs through their respective enterprise agreements.

Each BAA is specific to the named services and configurations. Coverage doesn’t automatically extend to all features, plugins, integrations, or use patterns the AI service supports — and the differences between what’s in scope and what’s not are where most healthcare AI risk lives. I’ve reviewed BAAs from all five major cloud AI providers between 2024 and 2026, and the pattern is consistent: the BAA covers the named service used as configured, and the covered entity bears the risk for everything else. Our agent compliance overview covers the broader regulated-industry compliance framework.

What does a typical cloud AI BAA actually cover?

A typical cloud AI BAA covers the AI provider’s service infrastructure for the explicitly named service tier. Concretely, that includes:

• Service infrastructure — compute, storage, network transmission, and provider-controlled access to PHI
• HIPAA Security Rule safeguards — administrative, physical, and technical safeguards required under 45 CFR Part 164 Subpart C
• Breach notification obligations — notification to the covered entity within timeframes required under 45 CFR §164.410, typically within 60 days of discovery
• Compliance assistance — reasonable assistance with the covered entity’s compliance obligations
• Use restrictions on PHI — prohibitions on using PHI for purposes other than providing the contracted service
• Training data prohibitions — explicit prohibitions on using customer PHI to train the provider’s general-purpose foundation models

The training data prohibition is the most-publicized BAA commitment, and it’s a meaningful one. None of the major cloud AI providers train their general-purpose models on PHI processed through their HIPAA-covered enterprise services. That distinguishes the enterprise tiers from the consumer-facing equivalents (ChatGPT free or ChatGPT Plus, Claude.ai consumer, Gemini consumer) where training-on-input is part of the service unless the user opts out.

What does a cloud AI BAA typically NOT cover?

This is where most healthcare AI risk sits. Cloud AI BAAs generally don’t cover the following categories, even when the customer has a valid BAA in place:

PHI processed through unintended channels. A clinician pasting a patient note into a free-tier consumer chatbot rather than the BAA-covered enterprise tier creates an unauthorized disclosure. The BAA covers ChatGPT Enterprise; it doesn’t cover ChatGPT Plus that the clinician has on their personal account. This is the #1 documented HIPAA AI incident category through 2024-2025 — staff using non-covered tools because they’re more accessible than the covered enterprise tools.

Third-party plugins or extensions. Cloud AI services increasingly support plugin ecosystems where the AI calls third-party APIs to extend functionality. The BAA covers the AI provider’s infrastructure; it doesn’t typically cover what happens when the AI invokes a third-party plugin that processes PHI. The plugin provider is a separate party that may or may not have its own BAA with the covered entity.

Model outputs that reproduce or incorporate PHI. AI models can reproduce information from prompts in unexpected ways — generating a summary that includes patient identifiers the prompter didn’t intend to include, or surfacing information from one patient’s record while processing another. The BAA addresses input data handling more clearly than it addresses output content, and several state attorney general opinions in 2024-2025 have questioned whether model output reproduction creates separate disclosure events.

Fine-tuning on PHI data outside the BAA-covered service. Several covered entities have explored fine-tuning models on their own PHI to create specialized healthcare assistants. The BAA-covered foundation model service may not cover the fine-tuning workflow, which often runs through separate compute services with their own contractual arrangements.

Use cases not disclosed during BAA negotiation. BAAs are negotiated based on the customer’s disclosed intended use. A customer who negotiates a BAA for administrative use cases and then expands to clinical decision support may have stepped outside the disclosed scope, which can affect coverage in a breach scenario.

The Cloud Security Alliance’s 2024 Healthcare AI Working Group white paper documented that 76% of healthcare AI incidents reviewed involved PHI processing outside the contractually defined BAA scope — overwhelmingly driven by staff use of non-covered tools rather than provider failures.

What were the major HHS OCR enforcement actions in 2024-2025?

HHS Office for Civil Rights enforcement actions totaled approximately $13.5M in HIPAA settlements during 2024, per HHS published enforcement data, with continued enforcement activity into 2025. The major themes:

Ransomware-driven breach settlements. OCR launched the Risk Analysis Initiative in October 2024, focused on covered entities’ compliance with the risk analysis requirements of the Security Rule. Several settlements in late 2024 and early 2025 involved covered entities that had experienced ransomware incidents and were found to have inadequate risk analyses covering AI tools and other cloud services.

Third-party processor settlements. Multiple smaller settlements addressed unauthorized disclosure to third-party processors that the covered entity hadn’t properly vetted under HIPAA business associate requirements. The pattern: covered entity uses a SaaS tool that processes PHI, the SaaS tool turns out to subprocess data through providers that don’t have downstream BAAs, and a breach in the subprocessor chain becomes the covered entity’s enforcement matter.

The December 2024 Security Rule NPRM. HHS published a Notice of Proposed Rulemaking on December 27, 2024 (89 Fed. Reg. 105662) proposing the most significant HIPAA Security Rule update since 2003. The proposed amendments would tighten technical safeguards for electronic PHI, mandate specific encryption standards (transitioning from “addressable” to “required” for many controls), require regular risk analyses on a defined cadence, and address AI-driven processing more directly than the existing rule. The NPRM remains in proposed form as of April 2026, but covered entities are widely preparing for finalization in late 2026 or 2027.

For executives tracking the regulatory environment, the trajectory is clear: OCR is increasing enforcement, the Security Rule is tightening, and AI-specific obligations are coming. Cloud AI procurement decisions made in 2026 should anticipate the proposed rule, not just the current rule.

How did the Change Healthcare breach change healthcare AI procurement?

The Change Healthcare breach in February 2024, affecting an estimated 100M+ individuals per HHS reporting, was the largest healthcare data breach in HHS records. The operational impact lasted months — claims processing, prior authorization, and pharmacy operations were disrupted across the US healthcare system. The procurement impact has lasted longer.

Many covered entities paused or reduced expansion of cloud-based PHI processing, including AI tools, to reassess third-party processor risk. The Healthcare Information and Management Systems Society (HIMSS) 2025 Cybersecurity Survey found that 62% of surveyed covered entities had restricted new cloud SaaS adoption in the 12 months following Change Healthcare, and 41% had specifically restricted cloud AI tool adoption pending updated risk assessments.

The breach also prompted HHS to accelerate the Security Rule update timeline and to launch the Risk Analysis Initiative. For healthcare executives evaluating AI tools in 2026, the operational lesson is that even valid BAAs don’t eliminate third-party processor risk — they shift it. Every additional cloud processor expands the attack surface and adds another supply chain link that can fail. The Change Healthcare attackers reportedly entered through a single compromised credential at the parent company, and the cascade affected hundreds of downstream covered entities that had legitimate BAAs in place.

What’s the on-premises alternative for healthcare AI workflows?

The on-premises alternative deploys AI tools on hardware physically located inside the covered entity’s facilities, with no transmission of PHI to third-party cloud AI providers. A Mac Mini OpenClaw deployment with private on-device LLM processes PHI entirely within the covered entity’s network. The covered entity’s existing risk analysis under 45 CFR §164.308(a)(1)(ii)(A) covers the local hardware the same way it covers desktop computers, EHR servers, or any other on-premises asset.

The architectural advantages for HIPAA compliance:

• No third-party processor in the data flow — eliminates the BAA scope question entirely for the covered workflows
• Existing risk analysis applies — the covered entity’s existing infrastructure risk analysis covers the on-premises hardware
• No cross-vendor breach exposure — a breach at OpenAI, Anthropic, Microsoft, or any cloud AI provider doesn’t affect the on-premises deployment
• Subpoena path simplifies — third-party data processors can be subpoenaed directly; on-premises requires service on the covered entity
• Audit trail under covered entity control — the audit log lives on the covered entity’s hardware, not in a vendor’s audit system

The deployment that fits most covered entities for clinical reasoning workflows is the Mac Mini OpenClaw system with the private on-device LLM add-on. The full deployment is on the Mac Mini OpenClaw system page — $5,000 hardware tier plus $1,000 private LLM add-on for $6,000 total, fully deductible under Section 179 in the year placed in service. See our Section 179 tax analysis for the after-tax cost calculation.

What healthcare workflows fit on-premises best?

Not every healthcare AI workflow needs on-premises deployment. The framework we use with covered entities sorts workflows into three buckets:

Clearly on-premises (PHI processing):

• Clinical note summarization with full identifiers
• Patient communication drafting referencing the patient’s specific record
• Prior authorization document preparation with PHI
• Internal quality improvement analytics on identified PHI
• Research workflows on PHI under IRB authorization
• Patient triage documentation for ED or urgent care

Probably cloud (no PHI or properly de-identified):

• General administrative correspondence
• Public-facing content drafting
• Non-clinical research synthesis
• Vendor management and procurement assistance
• Internal training material development
• Marketing and patient education content

Case-by-case (depends on configuration):

• Scheduling coordination that touches PHI tangentially
• Billing inquiry triage
• Population health analytics on de-identified data
• Clinical decision support on de-identified data

The framework is straightforward: anything that involves PHI as input or might generate PHI as output goes on-premises. Anything that’s clearly de-identified or never touches PHI can use cloud AI under standard BAAs without the same architectural concern. The split typically works out to 30-50% on-premises and 50-70% cloud for most covered entities, depending on practice mix.

For executives ready to scope a deployment, the practical procurement path is: assess current AI tool inventory, sort workflows into the three buckets, deploy on-premises infrastructure for the clearly on-premises bucket, retain or expand cloud AI for the clearly cloud bucket, and revisit the case-by-case workflows quarterly. The Mac Mini OpenClaw system ships within 7 business days of order, fully configured with the private LLM and audit logging the on-premises bucket requires.

Why does this matter more in 2026 than it did in 2024?

Three trends are converging that make the on-premises question more urgent in 2026 than it was when many covered entities first adopted cloud AI:

1. OCR enforcement is accelerating. The 2024 enforcement totals ($13.5M) were higher than 2023, the Risk Analysis Initiative launched in October 2024 is producing settlements, and the proposed Security Rule amendments will create new compliance obligations once finalized.

2. The breach landscape has shifted. Change Healthcare was the largest healthcare breach in HHS records, but it was one of dozens of significant cloud-related incidents in 2024-2025. Each one expanded the perceived risk of expanding cloud PHI processing.

3. AI capability has caught up to make on-premises practical. As recently as 2023, on-premises AI required compromise on capability versus frontier cloud models. By 2026, open-source models like Mistral 7B, Llama 3.1 8B, and Google Gemma 4 deliver capability sufficient for clinical reasoning, summarization, and patient communication workflows on Mac Mini-class hardware. The capability gap that justified accepting the BAA scope risk has closed for many use cases.

For healthcare executives evaluating AI procurement in 2026, the question isn’t “cloud AI or on-premises” — it’s “which workflows go where.” The on-premises path is appropriate for the workflows that involve PHI; the cloud path remains appropriate for the workflows that don’t. The architecture question is no longer “are we ready for on-premises capability?” — it’s “have we sorted our workflows into the right buckets?”

For covered entities ready to deploy the on-premises bucket, the Mac Mini OpenClaw system with private LLM is the deployment most healthcare clients select. The full deployment is $6,000 one-time, fully Section 179 deductible in the year placed in service, and ships within 7 business days of order.

Last updated: April 28, 2026. This article cites HHS Office for Civil Rights published enforcement data for 2024, the December 2024 HIPAA Security Rule NPRM (89 Fed. Reg. 105662), HHS Change Healthcare breach reporting, the HIMSS 2025 Cybersecurity Survey, and the Cloud Security Alliance Healthcare AI Working Group 2024 white paper. This is general information for executive readers, not specific legal or compliance advice. Consult the covered entity’s privacy officer, security officer, and outside HIPAA counsel for guidance specific to your organization.