HIPAA is often treated as the finish line for healthcare technology compliance. Increasingly, it's better understood as the starting point.

As states introduce their own privacy, consumer protection, and AI-related requirements, practices may have additional obligations depending on where they operate, what the technology does, and how patient information is handled.

That makes location an important part of the AI evaluation process.

State Requirements Can Add New Obligations

Some states are introducing requirements that specifically address the use of AI in healthcare and other high-impact settings.

Depending on the jurisdiction and use case, organizations may face requirements around transparency, patient notification, documentation, human oversight, or how automated systems are used in decision-making.

The important point is that there isn't one universal rulebook beyond HIPAA. A workflow that is appropriate in one state may require additional safeguards somewhere else.

Don't Assume Your Vendor's Hosting Setup Works Everywhere

Where data is stored and processed can also become relevant.

A vendor may describe its infrastructure as secure and HIPAA-ready, but that doesn't automatically answer every question about state-specific privacy or data-handling requirements.

Before implementation, ask where information is stored, where it is processed, which subprocessors are involved, and whether the vendor can support the requirements that apply to your organization.

The answer should be specific enough for your compliance team to evaluate — not simply "it's in the cloud."

Regulation Is a Moving Target

AI regulation is changing quickly.

New legislation, regulatory guidance, and enforcement priorities can change the requirements that apply to a particular technology or workflow. That means compliance shouldn't be treated as a one-time checkbox completed during implementation.

A periodic review — particularly when expanding an AI system into a new workflow or jurisdiction — can help identify changes before they become operational problems.

Compliance Shouldn't Stop Innovation

None of this means practices should avoid AI.

It means that "HIPAA-compliant" shouldn't be the only question asked during an evaluation.

Start with HIPAA, then look at the specific states you operate in, the type of data involved, the role AI plays in the workflow, and the vendor's ability to support your obligations.

HIPAA may set the floor, but responsible AI adoption means understanding what exists above it.

This article is intended for general informational purposes and should not be considered legal or compliance advice. Requirements vary by jurisdiction and use case; practices should consult qualified legal or compliance professionals regarding their specific obligations.