Why Did Our Hospital's AI Vendor Fail a HIPAA Security Risk Assessment?

The most common failure is the simplest one: the AI tool was purchased through a clinical or operations budget, not security review, and nobody flagged that it touches electronic protected health information. If the system ingests patient notes, images, claims data, or de-identifies records on the hospital's behalf, it is a business associate under HIPAA regardless of how the vendor markets itself as 'just a workflow tool' or 'just an API.' A 2026 update to HIPAA risk analysis guidance makes the scoping expectation explicit: an assessment must cover all electronic PHI regardless of the medium or system on which it resides, including cloud systems, third-party applications, and mobile devices, not just the primary EHR platform.

When the AI vendor sits outside that scope, there is no signed business associate agreement naming the AI system specifically, no documented data flow showing what the vendor receives and retains, and no way for an assessor to test controls that were never identified as in-scope in the first place. The failure shows up at audit time as a scope gap, not a technical defect in the AI itself.

Modern clinical AI tools are rarely a single self-contained model. A vendor's product often calls out to one or more underlying model providers, uses a separate vector database or transcription service, and updates its model version on a release cycle the hospital never sees. The Health Sector Coordinating Council's Cybersecurity Working Group addressed this directly in its April 2026 Third-Party AI Risk and Supply Chain Transparency guide, which sets out data lineage tracking, model auditability, and visibility into embedded third-party dependencies as baseline practices because AI supply chains create exactly this kind of hidden vendor layer.

Without that visibility, a risk assessment cannot answer the question an examiner actually asks: every subprocessor the AI vendor uses, what each one does with the hospital's data, and whether each one is covered by an agreement that flows the same protections down the chain. An inventory that stops at the vendor's own name, and does not reach the subprocessors behind it, is incomplete by construction.

Controls that used to be 'addressable' under the HIPAA Security Rule, meaning an organization could document an alternative and move on, have been tightened. Encryption for ePHI at rest and in transit and multi-factor authentication for ePHI access are now mandatory rather than optional, alongside more prescriptive audit log retention standards. An AI vendor's environment gets assessed against that same bar, and a vendor that was cleared on functionality and price alone, without a security review of its own encryption and access logging, frequently cannot produce evidence it meets it.

This is not a hypothetical gap. Four HIPAA resolution agreements announced by OCR in April 2026, totaling $1,165,000 across roughly 427,000 affected individuals, each cited an inadequate risk analysis as the core failure, with remediation plans that specifically required current asset inventories, vulnerability scans, and penetration testing going forward. None of the four cases were AI vendors specifically, but the pattern, a documented risk analysis that did not actually reach every system touching ePHI, is the identical failure mode an AI vendor introduces when it is never brought inside the assessment boundary.

OCR's Risk Analysis Initiative, launched in fall 2024, produced seven settlement actions in its first six months, each one citing a failure to conduct an accurate and thorough assessment of the risks and vulnerabilities to the confidentiality, integrity, and availability of all electronic PHI, not just a subset of systems reviewed once at go-live. Current guidance treats risk analysis as a living programmatic activity requiring annual updates and a fresh review any time a significant system change occurs, which an AI vendor's frequent model and feature updates trigger far more often than a static EHR module ever did.

An AI vendor evaluated once, at procurement, and never revisited as its models and subprocessors change, is being held to a 2023 assessment standard against a 2026 enforcement bar. That mismatch, not a single missing control, is usually the real reason the assessment fails on review.