The Health Insurance Portability and Accountability Act is a US federal law enacted in 1996 that establishes privacy and security requirements for protected health information. The Privacy Rule (2003) and Security Rule (2005) are the two portions most relevant to software systems handling health data.
HIPAA compliance is a baseline requirement for any software system that stores, processes, or transmits US patient health information. Cloud providers offer HIPAA-eligible services under Business Associate Agreements (BAAs) that contractually incorporate HIPAA requirements. Every major cloud — AWS, Azure, GCP — supports HIPAA workloads for customers with signed BAAs.
For AI deployment in healthcare, HIPAA adds complexity on top of the standard deployment challenges. Fine-tuning on patient data requires a BAA with the model provider. Inference with patient data cannot pass through non-compliant services. The list of HIPAA-compliant LLM endpoints is shorter than the general list — notably including Azure OpenAI, AWS Bedrock, and Google Cloud Vertex AI with specific configurations, but not consumer-facing Anthropic or OpenAI APIs by default.