Separate the clinical or administrative task from the information it handles. Then assess the organisation's role under each applicable regime; health data, a model subscription or a vendor certificate does not settle that assessment.
The Regulatory Landscape for Healthcare AI
Assess HIPAA according to covered-entity or business-associate status and the actual handling of protected health information. Serving a US patient does not by itself settle that status. Assess GDPR and the AI Act independently. Using a foundation model does not automatically make the organisation both a HIPAA covered entity and an AI Act high-risk provider; contracts and certifications do not replace this role assessment.
Does Your Agent Qualify as High-Risk Under the EU AI Act?
Health data alone does not establish high-risk status. Relevant Annex III uses include public-authority assessment of eligibility for healthcare benefits and emergency healthcare triage. A medical-device system can follow the separate Article 6(1)/Annex I route when the statutory product and conformity-assessment conditions are met. Routine scheduling, intake or administrative support requires an intended-purpose assessment; it is not automatically high-risk.
Where HIPAA and EU AI Act Overlap
Map each obligation to its own scope, then identify controls that can serve both regimes. Shared access or logging mechanisms may help, but evidence that satisfies one regime does not automatically satisfy another.
GDPR Article 22 concerns decisions based solely on automated processing that produce legal or similarly significant effects. Its exceptions and safeguards require a separate assessment; legitimate interest alone is not an Article 22(2) exception. Where Article 22(3) applies, safeguards include human intervention, expressing a view and contesting the decision. A nominal human approval does not resolve a workflow that is effectively automated.
Audit logging
Track relevant access and actions without copying entire patient records into ordinary logs. Keep protected references and access restrictions, and test whether the necessary events can be reconstructed.
Access controls
Give users and service accounts only the access needed for their task. Test access across patient or customer records, role changes and revoked accounts, including direct API calls and exported files.
Human oversight
Define when a person must review an action, what they may inspect and whether they can stop or override it. Test unavailable-reviewer and incomplete-evidence cases instead of relying on a nominal approval button.
Risk assessment
Assess patient impact, privacy exposure and failure modes separately. Use the workflow's actual purpose and operating environment, then connect each identified risk to a mitigation and an owner.
Where HIPAA and EU AI Act Diverge
Maintain separate applicability and response checklists for HIPAA, GDPR and the AI Act. Differences in roles, covered information and reporting duties cannot be resolved by one universal compliance label.
Breach notification
Have the responsible privacy and legal owners establish incident triggers, reporting routes and applicable deadlines. Preserve the evidence needed to assess an incident; do not reuse one regime's deadline as a rule for all others.
De-identification
Evaluate the chosen de-identification method under the relevant regime and intended use. Check whether remaining fields or linked datasets can identify a person; removing names alone does not establish that the data is anonymous.
Business Associate Agreements
Determine whether the vendor relationship requires a Business Associate Agreement under HIPAA and what the agreement covers. Check permitted handling, subcontractors and incident responsibilities; a signed contract does not verify the technical safeguards.
Practical Joint Compliance Architecture
Map data flows from source records through the model and any downstream tools. Attach access checks, review points and incident ownership to that map, then test a denied action and a failed integration before wider use.
FAQ
Does a vendor's certification settle the organisation's obligations? No. Verify the service, contract, data flows and your own role. Keep the evidence for that assessment rather than describing the entire workflow as compliant by inheritance.
Review updated 1 October 2026: the AI Omnibus entered into force on 27 July 2026. The high-risk requirements in Chapter III Sections 1-3 apply from 2 December 2027 for Article 6(2)/Annex III systems and 2 August 2028 for Article 6(1)/Annex I systems, subject to the Act's transitional provisions. Other obligations have separate application dates.
EU AI Act: consolidated text, 27 July 2026 | European Commission: AI Omnibus entry into force | GDPR: Regulation (EU) 2016/679 | HHS: Covered Entities and Business Associates