HIPAA’s Security Rule is about to get its biggest update in years – and it’s coming at a time when medical and dental practices are adopting AI faster than ever. For Florida practices, that means two realities collide: new federal cybersecurity requirements and the growing risks of shadow AI.
Here’s how to get ahead of both – without slowing your practice down.
1. Understand the New HIPAA Security Updates
The proposed changes from HHS include:
Stronger vendor oversight (especially third-party tech partners)
Mandatory security inventories for all systems handling patient data
Multi-factor authentication for all users accessing ePHI
Formal incident response planning
If you’re already using AI tools, these updates mean you’ll need documented policies showing how you secure and govern them.
2. Audit Your AI Use - Before Regulators Do
Start by identifying all the AI tools in your workflow.
This isn’t just obvious apps like ChatGPT. It includes:
EHR “smart” features
Imaging software with automated analysis
Scheduling or billing tools with predictive features
Ask your vendors:
“Do you process or store PHI?”
“Do you train your AI on our data?”
“Do you sign a HIPAA-compliant BAA?”
3. Put an AI Usage Policy in Writing
Without clear guardrails, staff will test AI however they see fit – which can easily lead to HIPAA violations.
Your policy should cover:
Approved AI tools and vendors
Prohibited uses (e.g., uploading PHI into non-compliant tools)
Required clinical review of any AI-generated notes or recommendations
4. Strengthen Authentication and Encryption
Under the proposed rules, multi-factor authentication (MFA) won’t be optional – it will be standard.
Also confirm:
All AI-enabled tools encrypt data in transit and at rest
You can track who accessed what data, and when
5. Update Your Incident Response Plan
AI-related breaches are rising – from phishing emails that look like trusted AI tools to manipulated AI outputs.
Your plan should outline:
How you’ll detect, isolate, and investigate a breach
How to notify patients and regulators within required timelines
The role your MSP or IT partner will play in recovery
6. Train Staff on Shadow AI
Even the best policy fails if your team doesn’t understand it.
Training should:
Explain what “shadow AI” is and why it’s risky
Give real-world examples of unsafe AI use
Teach how to spot phishing attempts pretending to be AI platforms
Final Word: Compliance Is Easier With the Right Partner
The new HIPAA security updates are about more than passing an audit – they’re about protecting the trust you’ve built with patients.
With the right MSP, you can:
Keep AI tools compliant and secure
Build policies that meet the new rules
Train your team without slowing your day-to-day workflow
Bottom line: AI can help your practice do more with less – but only if it’s backed by strong cybersecurity and a compliance strategy built for healthcare.
