Short answerAI can be used in medical billing in a HIPAA-compliant way if every vendor that processes PHI signs a Business Associate Agreement, access follows the minimum-necessary standard, data is protected in transit and at rest, PHI isn't used to train public models, and activity is logged. Human review of outputs protects coding accuracy.
AI tools see a lot of protected health information: notes, diagnoses, insurance details. HIPAA applies to all of it.
Six questions to ask any billing partner using AI
- Is there a BAA with every AI vendor that touches PHI? If a tool processes PHI on someone's behalf, it is a business associate.
- What data does the tool see? Only the fields the task needs, under the minimum-necessary standard.
- Is PHI used to train models? It shouldn't be used to train public or shared models.
- Where is data stored and how is it encrypted? In transit and at rest.
- Is there an audit log? Who accessed what, and which AI outputs were accepted or rejected.
- Who reviews outputs? A credentialed person, before any submission to a payer.
Why human review is a compliance issue
Billing a code the record doesn't support is a false-claims risk regardless of whether software suggested it. Human review is how a practice shows that coding decisions follow documentation and rules.
Our approach
- BAAs in place before any PHI is accessed, including with AI vendors
- role-based, audited access inside the practice's own systems
- no use of practice data to train public models
- every AI suggestion reviewed by our credentialed coding or AR team
See HIPAA and data security for our full safeguards.
This article is general billing information, not legal or coding-compliance advice. Payer rules, CPT descriptors and federal guidance change; check the current versions for your claims.