HIPAA-compliant AI for Montana clinics.

HIPAA-compliant AI means an AI service whose vendor has signed a Business Associate Agreement (BAA) with you, configured the service so your inputs and outputs aren't used to train their models, kept logs, and accepted liability for breaches. The tool itself is just software — compliance is the contract and configuration around it.

If a vendor won't sign a BAA, the tool is not compliant for PHI no matter what their marketing says. End of discussion.

Short, current list. Versions and BAA availability change — confirm before signing.

• Microsoft 365 Copilot — Microsoft signs a BAA; covered when used with an M365 tenant under your existing HIPAA agreement.
• ChatGPT Enterprise (and ChatGPT Edu) — OpenAI signs a BAA; data is not used to train models.
• Claude for Work (Team or Enterprise) — Anthropic offers a BAA on Enterprise.
• Google Workspace + Gemini — covered under Google's HIPAA Implementation Guide once you accept the BAA addendum.
• Nuance DAX Copilot — Microsoft-owned ambient scribe, BAA included, EHR integrations.
• Abridge — ambient clinical documentation, BAA included, growing EHR integrations.
• AWS Bedrock / Azure OpenAI — for custom builds, both covered under their respective BAAs.

For most Montana primary care, behavioral health, and dental practices the first move is ambient scribing — Nuance DAX, Abridge, or DeepScribe — because it returns 1–2 hours per provider per day with the cleanest compliance story. The pilot is one provider for 30 days; budget is roughly $200–$400/provider/month.

Critical-access hospitals usually pair scribing with a Microsoft 365 Copilot rollout for the admin side — prior auth letters, discharge summaries, meeting notes. That's where the office hours go.

• Ambient scribing — 1–2 hrs/day per provider returned, ROI usually inside 60 days.
• Prior authorization drafting — Copilot or Claude over a redacted template library.
• Patient FAQ chat on the public website — never PHI, no BAA needed since no patient data flows in.
• Schedule and intake optimization — done in your EHR vendor's AI features, which already sit under your existing BA chain.

These will get you fined or sued. We've seen every one of them at Montana clinics in the last two years.

• Paste a patient note into ChatGPT Free, Plus, or Team. None are covered.
• Use a personal Gmail or @gmail Claude account for clinical work.
• Sign up for a transcription service without a BAA because it's free.
• Build a public chatbot that asks for date of birth, insurance, or symptoms before triage.
• Skip the security risk analysis required under the HIPAA Security Rule.

Week 1: BAA in place, single provider or single admin workflow chosen, written AI use policy signed. Week 2: training session and first live use under supervision. Week 3: full use, daily check-ins. Week 4: measure hours saved, error rate, and provider satisfaction; decide whether to expand.