HIPAA Cloud Computing Guidance — relevance to shared AI hosting

AI-use reference. Current official guidance. Applies to: Covered entities/business associates and separate cloud providers maintaining or processing ePHI on their behalf. Requirements or purpose: Appropriate BAA, risk analysis/risk management, safeguards, permitted uses and incident/breach responsibilities. Provider maintaining encrypted ePHI can still be a business associate even without the decryption key. Limits: Not a general ban on cloud/AI or a statement all vendors are HIPAA-covered. Application depends on actual PHI relationship and permitted purpose; customer/provider control allocation matters.