What HIPAA actually requires from a healthcare chatbot (2026)

Healthcare organisations get pitched “HIPAA compliant chatbots” constantly. The phrase is doing a lot of work, and most of it isn’t accurate. Here’s what HIPAA actually requires and how to design a chatbot that meets it — without pretending to legal certainty this article can’t provide.

This isn’t legal advice. Talk to a lawyer if you handle PHI at any scale.

What HIPAA covers

HIPAA regulates the handling of Protected Health Information (PHI) by Covered Entities (providers, plans, clearinghouses) and their Business Associates. If your chatbot handles PHI on behalf of a covered entity, you’re a business associate.

PHI is any information that (a) relates to a person’s health, treatment, or payment for health services, AND (b) can be linked to them. Names, addresses, medical record numbers, dates, biometric identifiers — anything from the 18 HIPAA identifiers list.

A chatbot conversation where someone says “I have a persistent cough” is not PHI on its own. Add an email address, and it is.

What compliance actually means

HIPAA is behavioural, not technical. Its requirements:

• Business Associate Agreements (BAAs) with any vendor that touches PHI on your behalf. Every vendor. No BAA = you’re not compliant.
• Access controls — role-based, auditable, revocable.
• Encryption — in transit (TLS 1.2+) and at rest.
• Breach notification — 60 days from discovery.
• Minimum necessary — you may only collect and share the minimum PHI needed for the purpose.
• Audit logs — of who accessed what, when.

A chatbot vendor claiming “HIPAA compliance” without offering a BAA is bluffing.

The design patterns that work

Pattern 1: Route away from PHI. If a visitor starts sharing PHI (“my medication is X and I’m seeing Dr. Y for Z”), the chatbot’s first job is to route them somewhere that can handle it — a secure portal, a phone number, a callback request — not to try to answer inline.

This isn’t restrictive. Most chatbot value in healthcare is helping people navigate: “how do I book an appointment,” “what should I bring,” “where is my nearest clinic,” “is my insurance accepted.” None of these require PHI.

Pattern 2: Explicit PHI form, not free text. If you do need to collect PHI, use a structured form that’s separate from the chat transcript. The transcript stays PHI-free; the form goes to your secured backend.

Pattern 3: Do not send PHI to a general LLM without a BAA. Even OpenAI, Anthropic and Google are careful about their HIPAA posture — some offer BAAs at higher tiers, some don’t. Your chatbot vendor needs to be transparent about which models are used, whether prompts are logged, and whether a BAA is in place.

Pattern 4: Zero data retention where possible. Configure the chatbot to not persist transcripts, or to hash them, or to delete after N days. HIPAA has a “minimum necessary” principle; if you don’t need the transcript, don’t keep it.

Where Anserra sits

Anserra is not offered under a BAA at time of writing. That means you should not deploy it on surfaces where visitors will submit PHI. It’s suitable for:

• Public marketing sites — “book an appointment” flows that route to your secure system.
• Support for non-PHI questions — hours, locations, billing categories, insurance FAQ.
• Internal-only tools where you control who accesses the widget.

It is not suitable for:

• Patient portals inside the walls where PHI is expected.
• Symptom triage that a patient would answer with medical detail.
• Anything that touches a medical record.

If you need HIPAA-covered deployment, we can discuss a single-tenant setup with a BAA. Contact us before you build.

Legal, ethical, defensive

Beyond HIPAA:

• If your chatbot dispenses medical advice, you’ve likely crossed into practising medicine. Don’t. The system prompt should refuse anything that reads as diagnostic or prescriptive.
• Log every escalation to a human clinician with a timestamp. If a patient later claims the bot advised something dangerous, this record is your defence.
• Have a lawyer review your system prompt.

The short version

• A HIPAA-compliant chatbot requires a BAA, encryption, access controls, minimum necessary collection, and audit logs.
• Design for routing, not for handling PHI inline.
• Vendors that say “we’re HIPAA compliant” without offering a BAA are bluffing.
• Anserra is well-suited to non-PHI healthcare use cases; it is not currently offered under a BAA.

If you’re building a routing-focused patient help chatbot, Anserra fits. If you’re building anything that touches medical records, talk to us first.