Health data subject to HIPAA in the U.S.—any AI system that ingests, stores, or outputs PHI inherits HIPAA Business Associate obligations.
PHI is broader than medical records: it includes identifiers tied to health data (names, dates, addresses). Using a hosted LLM with PHI usually requires a Business Associate Agreement (BAA). Related: PII, GDPR special categories.