HIPAA in 2026: what to ask before AI touches patient data

Ask for the BAA first

A Business Associate Agreement is the starting point. Ace signs one with every clinic, and holds BAAs with AWS, OpenAI and the other vendors that touch patient data.

Ask where the data lives

Patient data in Ace is encrypted in transit with TLS and at rest with AES-256, and it is hosted on AWS in the United States only. Regular backups and a recovery plan keep the service running.

Every staff member only sees what their role allows, and every view and change is logged.

Ask who can see it

Role-based permissions, two-factor sign-in, automatic sign-out and audit logs decide and record who sees patient data. Our team takes part in HIPAA refresher sessions, and we keep a written incident response plan.