This guide is not legal advice.
What it is
The HIPAA Security Rule requires covered entities and their business associates to protect ePHI with administrative, physical and technical safeguards. The technical safeguards in 45 CFR 164.312 cover access control, audit controls, integrity, person or entity authentication, and transmission security.
HHS published a Security Rule notice of proposed rulemaking on January 6, 2025 (RIN 0945-AA22; 90 FR 898). As checked on October 5, 2026, the Federal Register record still identifies it as a proposed rule with no effective date, so it is not described here as adopted or in force.
What it asks for, for AI and data
| Safeguard | What it requires |
|---|---|
| Access control | Allow access to ePHI only to authorized people and software, including unique user identification. |
| Audit controls | Record and examine activity in systems that contain or use ePHI. |
| Integrity | Protect ePHI from improper alteration or destruction. |
| Person or entity authentication | Verify that a person seeking access is who they claim to be. |
| Transmission security | Guard against unauthorized access to ePHI sent over a network. |
When an AI tool processes ePHI, it becomes part of the systems these safeguards apply to. The 2025 NPRM may be relevant to planning, but it remains a proposal until HHS finalizes it.
How Matrix helps
| Safeguard | How Matrix helps |
|---|---|
| Access control | Unique user accounts, role-based access and private-by-default files. Your team holds every administrator account. |
| Audit controls | Local audit logs can be reviewed and exported; event scope and retention are agreed for your requirements. |
| Integrity | Source references and workflow approval gates support review; intended-use integrity controls are agreed with you. |
| Person or entity authentication | Individual sign-in with MFA; directory integration is confirmed for your environment. |
| Transmission security | In the standard setup Matrix has no internet connection, so it does not send ePHI outside your network. Any outside service you approve follows your own policies. |
Because Synexas does not receive your data, the vendor relationship differs from a hosted AI service. A proof on your task, if you ask for one, uses data you authorize, under an NDA, deleted afterwards. Before it would include ePHI, your counsel decides whether it may be shared and which agreement, such as a business associate agreement, is needed. Whether a business associate agreement is needed otherwise depends on your situation, including on-site maintenance arrangements. Ask your counsel. Local deployment does not create HIPAA compliance or certification by itself.
What stays with you
- Your risk analysis and risk management plan
- Policies, workforce training and sanctions
- Emergency access procedures
- Reviewing audit records against your required event scope and retention
- Physical security of the device
- Protection of your internal network
- Deciding whether AI outputs become part of the designated record set
Questions to ask any AI vendor
- Will ePHI leave our network? If so, where does it go and who can access it?
- Will you sign a business associate agreement, and is one needed for this deployment?
- Is our data used to train or improve models?
- What activity is logged, where, and who can read the logs?
- How are vendor staff prevented from accessing ePHI during support?