Using AI for Caregiver Notes: What's Allowed Under HIPAA
AI can draft caregiver visit notes under HIPAA if the vendor signs a business associate agreement, you limit what goes in, and the caregiver reviews and signs every note.
By Caregiver Scheduling Team ·
Yes, an agency can use AI to draft caregiver notes under HIPAA, on three conditions. The vendor that processes the dictation must be your business associate under a signed agreement. What goes into the tool must be limited to what the note needs. And the caregiver must review and sign the draft, because the caregiver, not the software, is responsible for the record. A consumer chatbot on a personal account fails the first condition, so client information never belongs there.
Does HIPAA even apply to my agency?
It applies if you are a covered entity or a business associate of one. A health care provider is a covered entity when it transmits health information electronically in connection with a HIPAA transaction, such as billing Medicaid or a managed care plan electronically (45 CFR 160.103). A private-pay-only agency often is not, but state privacy laws and client contracts still apply. See HIPAA for non-medical home care and the HIPAA checklist.
Is an AI note vendor a business associate?
Yes, if it creates, receives, maintains or transmits protected health information on your behalf. That is the regulatory definition, and it includes the vendor’s subcontractors (45 CFR 160.103). A dictation about a named client’s bathing, mobility and mood is PHI, and the company that turns it into a note is handling it for you.
Under 45 CFR 164.502(e), you may disclose PHI to a business associate only with satisfactory assurance that it will safeguard the information, documented in a written contract that contains the terms in 45 CFR 164.504(e).
| A business associate agreement must | Why it matters for AI notes |
|---|---|
| State the permitted uses and disclosures of PHI | Rules out using your clients’ notes for anything but your service |
| Require appropriate safeguards and Security Rule compliance | Encryption, access controls, logging |
| Require reports of unauthorized use, including breaches | You cannot notify clients of a breach you never hear about |
| Flow the same terms down to subcontractors | The AI model provider behind the app is covered too |
| Return or destroy PHI when the contract ends | Dictation audio and drafts do not linger after you leave |
If a vendor will not sign a BAA, or its terms say client data may be used to train general models, do not send it client information.
What does “minimum necessary” mean for dictated notes?
It means the caregiver dictates what the visit record needs and nothing more. HIPAA requires covered entities and business associates to make reasonable efforts to limit PHI to the minimum necessary for the purpose (45 CFR 164.502(b)). For a visit note, that is the tasks done, the assistance level, refusals, observations and anything reported to the office. It is not the client’s full diagnosis history or a family member’s medical details. See visit notes examples and ADL documentation for what belongs in the note.
What should I check before turning on an AI note tool?
The Security Rule requires an accurate and thorough risk analysis (45 CFR 164.308(a)(1)(ii)(A)), and a new AI tool means updating it.
| Question | What a good answer looks like |
|---|---|
| Will the vendor sign a BAA? | Yes, before any client data is entered |
| Is client data used to train models? | No, or only under terms you have approved in writing |
| Where is audio and text stored, and for how long? | Named locations, encrypted, with a stated retention period |
| Who can see the draft? | Only the caregiver and authorized office staff, with access logs |
| Does the caregiver review and sign? | Required before the note is final |
| Is it built into the visit record? | Yes, so nothing is copied between apps |
Workforce training is also a Security Rule requirement (45 CFR 164.308(a)(5)). Add the tool to annual HIPAA training and the onboarding checklist.
What rules should caregivers follow?
- Use only the agency-approved tool, signed in with their own login.
- Review every draft before signing and correct anything the tool got wrong.
- Record facts, not opinions, and say when the client refused care.
- Never paste or dictate client information into a personal app, text thread or public chatbot.
- Report mistakes right away.
What happens if client data ends up in a consumer chatbot?
Treat it as a potential breach. A disclosure to a company that is not your business associate is not permitted, and a breach of unsecured PHI must be reported to affected individuals without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.404).
How Caregiver Scheduling handles this
AI visit notes are built into the caregiver app. The caregiver talks through the visit, the app drafts a short note from the dictation, and the caregiver reviews, corrects and signs it before it becomes part of the record. Notes stay with the GPS-verified visit inside the HIPAA-compliant platform. $199/month for up to 10 caregivers or $299/month for up to 50, free for 30 days.
FAQ
Is an AI-drafted note accurate? It is a draft of what the caregiver said. The caregiver must read it, fix errors and sign it.
Can I use ChatGPT or a similar chatbot for caregiver notes? Not with client information on a consumer account. Use a tool covered by a business associate agreement that is designed for health data.
Do I need a BAA if my agency is private-pay only? If you are not a covered entity, HIPAA does not require one. Many agencies sign one anyway because payers and state law expect the same protections.
Does the caregiver still have to sign the note? Yes. The signature is what makes it the caregiver’s record, and surveyors and payers look for it.
This article is general information, not legal advice. Check your state’s privacy rules and your payer contracts.