HIPAA, CMMC, and Privilege: Compliance When Your Industry Meets AI
If your business handles protected health information, controlled unclassified information, or privileged client communications, the question is not whether you can use AI — it’s which AI, under what agreement, with what data. The regulatory obligations you already carry do not pause because a tool is new, and in most cases the compliance answer hinges on a contract you either have or don’t.
This is the piece most AI adoption conversations skip. Teams evaluate features, pricing, and accuracy, then discover after rollout that the tool was never covered by the agreements their industry requires. Below is a practical walk-through of what changes by vertical, where the hard lines sit, and how to tell the difference between a tool you can use today and one that needs paperwork first.
The Core Distinction: Consumer AI vs. Covered AI
Nearly every compliance question about AI for small business reduces to one thing: is the data you’re typing into this tool covered by a contract that makes the vendor legally accountable for it?
Free and consumer-tier AI tools generally are not. Their terms of service typically allow the provider to retain prompts, use them to improve models, and have human reviewers look at conversations for quality purposes. That’s a reasonable arrangement for drafting a birthday message. It is a disclosure for anything regulated.
Paid enterprise and business tiers usually work differently. Microsoft 365 Copilot, when licensed through a business or enterprise agreement, operates inside your Microsoft 365 tenant boundary. Your prompts and the organizational data Copilot retrieves are not used to train the underlying foundation models, and the data stays governed by the same commercial terms covering your Exchange and SharePoint content. Microsoft includes Copilot within the scope of its HIPAA Business Associate Agreement for eligible plans. Those are contractual commitments, not marketing claims, and you can ask for them in writing.
The practical rule for every vertical below: regulated data goes only into tools where a signed agreement covers it. Everything else is a policy violation waiting to be discovered during an audit.
Healthcare and Dental: PHI in Prompts
For a medical or dental practice, the controlling question is whether the AI vendor is a business associate. If PHI touches the tool, a Business Associate Agreement is mandatory under HIPAA. Not recommended. Mandatory.
Where practices get into trouble is rarely a deliberate decision. It’s a front-desk coordinator pasting a patient’s chart note into a free chatbot to rewrite it in plain language for a referral letter. It’s a billing manager asking a public AI tool to explain a denial by pasting the entire EOB, member ID and all. Each of those is a disclosure of PHI to a non-covered party, and each is reportable under the Breach Notification Rule depending on your risk assessment.
What works instead:
- License a covered tool and make it the easy path. If Copilot is available inside Word and Outlook where staff already work, the temptation to open a browser tab drops sharply.
- De-identify by default for anything outside the covered perimeter. Train staff that if the prompt contains a name, date of birth, MRN, account number, or anything from the 18 HIPAA identifiers, it goes in the covered tool or nowhere.
- Keep AI out of clinical judgment. Summarizing a long intake form is a documentation task. Suggesting a diagnosis or a dosage is not, and no AI output should stand in for a clinician’s assessment.
- Update your risk analysis. HIPAA’s Security Rule requires you to assess new systems that touch ePHI. Adding an AI tool is a change to your environment and belongs in the documentation.
Our work with practices across metro Atlanta is detailed on our healthcare IT page, and the underlying safeguards sit in cybersecurity services.
Defense Manufacturing: CUI and CMMC Scope
For manufacturers in the defense supply chain, the stakes are different but the structure is similar. If you handle Controlled Unclassified Information, CMMC Level 2 requires alignment to NIST SP 800-171, and that framework governs where CUI may be stored and processed — including cloud services.
The scoping question is the one to get right early. Any AI service that processes CUI is in scope for your assessment, which means it needs to meet the same requirements as the rest of your CUI environment. In practice this pushes toward government community cloud environments rather than commercial tenants, and toward FedRAMP-authorized services at the moderate baseline or equivalent.
The commercial version of a tool and the government version of the same tool are not interchangeable for CMMC purposes, even when the interface looks identical. A manufacturer running Microsoft 365 Commercial cannot assume Copilot behaves as a CUI-eligible service simply because Microsoft offers a GCC High variant to someone else.
Practical guardrails for manufacturers:
- Draw an explicit boundary. Which systems hold CUI, and which AI tools are authorized to touch that boundary?
- Use AI freely on the non-CUI side — proposal formatting for public solicitations, HR documents, general scheduling, internal meeting notes that contain no technical data.
- Treat engineering drawings, technical data packages, and anything marked under the DoD CUI registry as off-limits to any tool not inside your assessed boundary.
- Document the decision. Assessors want evidence of a deliberate control, not an assurance that nobody would do that.
More on how we support manufacturing clients is on our manufacturing page.
Law Firms: Privilege and Confidentiality
Attorney-client privilege is not a regulation with a penalty schedule. It’s a protection that can be waived, and waiver is far worse than a fine because it is often irreversible.
The analysis turns on confidentiality expectations. Disclosing client information to a third party outside the privilege umbrella risks waiver. A consumer AI tool whose terms permit retention and human review is a third party. State bar guidance across several jurisdictions has converged on a consistent set of duties: competence in understanding the technology, confidentiality in protecting client information, and in some cases informed client consent before using AI on their matter.
For firms, the concrete steps:
- Use enterprise-tier tools with no-training commitments, inside your own tenant. Copilot summarizing a deposition transcript stored in your SharePoint is a very different act than pasting that transcript into a public chatbot.
- Review engagement letters. Some firms now include an AI-use provision that sets expectations with clients up front.
- Never rely on AI output as legal analysis. Research assistants hallucinate citations. Courts have sanctioned attorneys for filings containing fabricated case law. Verify everything that leaves the building.
- Watch matter segregation. Ethical walls built in your document management system need to extend to AI tools that index those documents, or an AI assistant will cheerfully surface a conflicted matter to the wrong attorney.
See our work with law firms for how this fits into broader firm IT.
Everyone Else: The Baseline Still Applies
Construction, hospitality, and professional services firms rarely face HIPAA or CMMC, but they hold employee records, financial data, customer payment information, and contract terms that carry real obligations under state privacy laws and client agreements. A subcontractor agreement may well contain confidentiality language that a public AI tool would violate.
The baseline is the same everywhere: a written AI policy that names approved tools, defines what data may never leave the covered perimeter, and tells people what to do when they are unsure. One page is enough to start. Pair it with shadow-AI discovery so you know what your team is already using, because most organizations find more tools in use than they expected.
Where to Start
Pick your highest-risk data category. Confirm in writing whether your current AI tools are covered for it. If they are not, either license a covered tier or draw a hard line in policy and enforce it technically. Then document the decision so it survives staff turnover and shows up correctly in your next audit.
Century Solutions Group works with Atlanta-area practices, firms, and manufacturers to map AI data privacy and AI security requirements against what their regulators and clients actually demand. If you’d like a straightforward read on where your organization stands, start a conversation with us. A short discovery call is usually enough to tell you whether your current setup is defensible or whether you need an agreement in place before the next prompt gets typed.