US context
Artificial intelligence in medicine in the United States
In the United States, clinical artificial intelligence operates within a patchwork of federal and state rules. HIPAA is central for covered entities and their business associates, but it does not protect all health data in all contexts.
🇺🇸
United States
- Federal privacy: HIPAA when it applies.
- Interoperability: ONC and Cures Act Rules.
- Legal environment: federal and state regulations.
CLINICAL AND DIGITAL FRAMEWORK
Medical records and artificial intelligence in the United States
HIPAA and its scope
The HIPAA Privacy Rule establishes protections for health information in covered entities. Not every health app or company automatically falls under HIPAA. HHS: HIPAA Privacy Rule ↗
Suppliers and business partners
When a vendor handles protected information for a covered entity, a business associate agreement and specific contractual safeguards may be necessary. HHS: Business Associates ↗
Interoperability and access
The ONC rules derived from the Cures Act promote access and exchange of electronic health information and limit information blocking. States can add obligations. HealthIT.gov: Cures Act Final Rule ↗
Clinical documentation challenges in the United States
- Determine if the organization and the vendor are covered entities or business associates.
- Coordinate HIPAA with state privacy, consent, licensing, and internal policies.
- Evaluate EHR integration, traceability, human review, and model governance.
These challenges are not solved with more text. They require useful information, defined owners, and a review process that corresponds to actual practice.
Reference hospitals and institutions in the United States
These institutions help understand the scale, specialization, and care models of the country. The selection is informative; it is not a ranking nor does it imply affiliation with Itaca.
Mayo Clinic
Minnesota and other states. Academic reference system with care, research, and education.
Cleveland Clinic
Ohio and other states. High-complexity academic system with international reach.
Mass General Brigham ↗
Massachusetts. Integrated academic network of hospitals and clinical services.
HIPAA is the starting point, not the whole framework
The use of AI changes depending on the function of the tool. An assistant that prepares documentation for review raises different issues than software that formulates autonomous clinical recommendations or a product regulated as a device. In addition to HIPAA, state rules, professional policies, consent requirements, interoperability standards, and, depending on the case, FDA oversight may come into play.
For clinical documentation, the organization must determine whether it is a covered entity, whether the provider acts as a business associate, and which agreement protects the information. For health data that falls outside of HIPAA, other federal or state obligations may exist. The assessment must classify the specific use before applying a general compliance label.
A documentation pilot must measure corrections, omissions, review time, and integration into the EHR. If use shifts toward diagnostic or therapeutic recommendations, regulatory and clinical evaluation must be reopened.
What to evaluate before adopting clinical AI
The review must start with the data flow: what information comes in, which provider processes it, where it is stored, whether it is used for training, what contractual agreement applies, and how the clinician's approval is recorded.
- Determine if the organization and the vendor are covered entities or business associates.
- Coordinate HIPAA with state privacy, consent, licensing, and internal policies.
- Evaluate EHR integration, traceability, human review, and model governance.
Assisted clinical notes, with the professional in charge
Itaca helps professionals and teams prepare clinical documentation, query information using sources, and organize cases. The professional reviews the results and retains control over clinical decisions.
To compare this framework, see Medical AI by country, AI for Doctors, Clinic software, security and privacy, and the contexts of Canada and mexico.
Public sources for further reading
Informative content prepared on September 12, 2026. Use this page as initial guidance. Before deciding, confirm the current regulations and policies of your organization.
Frequently asked questions about medical AI
Does HIPAA cover any app that uses health data?
No. HIPAA applies to covered entities and certain business associates. Other products may be subject to different rules.
Is a documentation tool the same as a medical device?
Not necessarily. The classification depends on the function, product claims, and intended use; the specific case must be evaluated.
What should a vendor evaluation contain?
The flow of PHI, the BAA when applicable, sub-processors, storage, retention, incidents, use for training, and access controls.
How can Itaca help?
Itaca prepares clinical drafts that the professional can review and correct. The institution retains clinical decision-making and determines how to incorporate the result into its EHR.