News for hackers. Stuff that matters.

A comment on Open models by OpenAI. Parent comment

Re:Open models by OpenAI by fineIllregister on Wednesday August 06, 2025 @04:10AM (#44809170)
In the US, HIPAA requires that health care providers complete a Business Associate Agreement for any other orgs that receive PHI in the course of doing business [1]. It basically says they understand HIPAA privacy protections and will work to fulfill the contracting provider's obligations regarding notification of breaches and deletion. Obviously any EMR service will include this by default.

Most orgs charge a huge premium for this. OpenAI offers it directly [2].

1: https://www.hhs.gov/hipaa/for-professionals/covered-entities...

2: https://help.openai.com/en/articles/8660679-how-can-i-get-a-...

[ Parent | on HN ]
Re:Open models by OpenAI by dragonwriter on Wednesday August 06, 2025 @04:15AM (#44809208)
> Most LLM companies might not even offer it.

I'm pretty sure the LLM services of the big general-purpose cloud providers do (I know for sure that Amazon Bedrock is a HIPAA Eligible Service, meaning it is covered within their standard Business Associate Addendum [their name for the Business Associate Agreeement as part of an AWS contract].)

https://aws.amazon.com/compliance/hipaa-eligible-services-re...

[ Parent | on HN ]
Re:Open models by OpenAI by fineIllregister on Wednesday August 06, 2025 @04:40AM (#44809414)
Sorry to edit snipe you; I realized I hadn't checked in a while so I did a search and updated my comment. It appears OpenAI, Google, and Anthropic also offer BAAs for certain LLM services.
[ Parent | on HN ]
Re:Open models by OpenAI by linuxftw on Wednesday August 06, 2025 @08:04AM (#44810862)
I worked a big health care company recently. We were using Azure's private instances of the GPT models. Fully industry compliant.
[ Parent | on HN ]