HIPAA-Compliant AI for Dermatology Clinics: A Buyer's Checklist

A dermatology clinic should not evaluate an AI vendor based only on a "HIPAA-compliant" badge. The clinic should verify the vendor's role, business associate agreement, data flows, security controls, access model, retention policy, incident process and use of patient data.

HIPAA compliance is a shared operational responsibility, not a single software feature.

1. Will the vendor sign a BAA?

When a vendor creates, receives, maintains or transmits electronic protected health information on behalf of a covered entity, a business associate relationship may exist. The contract should define permitted use, safeguards, breach obligations, subcontractors, data return and termination.

Ask for the BAA early in procurement.

2. What patient data enters the system?

Request a data-flow diagram covering:

Source systems
Data elements
Message content
Attachments and images
Model providers
Storage locations
Logs
Analytics tools
Human support access
Subprocessors
Data returned to the EHR

Apply the minimum-necessary principle. The system should not receive full records when the workflow requires only appointment and service context.

3. Is patient data used to train models?

Ask:

Is customer data used for model training by default?
Can training be contractually disabled?
Do third-party model providers retain prompts or outputs?
Is data de-identified?
How is de-identification validated?
Can the vendor explain all secondary uses?

Do not accept vague answers such as "industry-standard AI."

4. How is access controlled?

Review:

Unique user accounts
Role-based access
Multifactor authentication
Joiner, mover and leaver process
Admin permissions
Support access
Session controls
Patient identity verification
Audit logs

Ask whether the clinic can export logs during an investigation.

5. How is data protected?

Evaluate encryption in transit and at rest, key management, vulnerability management, backups, disaster recovery, endpoint controls and secure software development.

Certifications may provide evidence, but they do not replace the clinic's risk analysis.

6. What happens when AI is uncertain?

A healthcare AI system should have:

Defined scope
Human escalation
Confidence or policy thresholds
Restricted topics
Approved knowledge
Conversation monitoring
Error reporting
Version control
Regression testing
Ability to pause the system

For patient-facing workflows, ask to see examples of failure handling.

7. How are clinical concerns handled?

Verify:

Red-flag definitions
Escalation owner
Time targets
After-hours behavior
Emergency language
Conversation summary
Documentation back to the clinic
Process when no staff member responds

The AI should not imply continuous clinical monitoring unless the practice truly provides it.

8. What are the retention and deletion rules?

Ask how long the vendor keeps:

Messages
Attachments
Model logs
Backups
Support records
Audit logs

Confirm the process for data return, deletion and termination.

9. What happens after an incident?

Review the vendor's:

Incident response plan
Notification process
Forensic capability
Breach cooperation
Business continuity
Recovery objectives
Prior material incidents
Cyber insurance

10. Can the clinic configure consent and communication rules?

The system should support message type, channel, opt-out, quiet hours, sender identity and patient preference. Legal requirements may differ for treatment and marketing communications.

Questions to put in the contract

Approved purposes for PHI
Prohibition or limits on model training
Subprocessor disclosure
Security obligations
Audit support
Incident notification
Data portability
Deletion
Service levels
Human oversight
Change notification for models or material features

Final checklist

Do not buy until the clinic understands:

What the AI does
What it cannot do
What data it uses
Where that data goes
Who can see it
How errors are handled
How patients reach a person
How the clinic monitors performance

KolAI should be evaluated using the same standard. A trustworthy AI care coordinator must combine privacy safeguards with tightly defined workflows and visible human escalation.