HIPAA is the US law under which HHS’s Privacy, Security and Breach Notification Rules govern protected health information (PHI) held by covered entities (health plans, health care clearinghouses, and health care providers that conduct standard transactions, such as claims, electronically) and by their business associates, the vendors that handle PHI for them (HHS, HIPAA for professionals). PHI is individually identifiable health information that a covered entity or business associate holds or transmits, a narrower category than personal data: the same health data in a consumer app outside that chain is not PHI. A business associate signs a business associate agreement and is directly liable for meeting the Security Rule. HHS does not certify vendors as HIPAA compliant.
In an FDE interview
OpenAI’s healthcare postings (San Francisco, New York and Seattle), as of September 2026, list building with safeguards for PHI and HIPAA among the role’s responsibilities. Source 1Forward Deployed Engineer (FDE), Healthcare - SF (Ashby)PublisherOpenAI (Ashby job board)Source typecompany job postingSource 2Forward Deployed Engineer (FDE), Healthcare - NYC (Ashby)PublisherOpenAI (Ashby job board)Source typecompany job posting In a design, the question that matters is where PHI flows: a strong candidate confirms a business associate agreement covers every vendor that touches it, including the hosted model, the logging service and the support tool, sends each of them only the minimum necessary, and keeps PHI out of logs, traces and evaluation sets unless it is de-identified. The weak answer says “we are HIPAA compliant” and stops.
A BAA with a cloud or model vendor covers only the services and settings it names, so check each new managed service against the vendor’s HIPAA-eligible list before PHI reaches it. And de-identified has a legal meaning: the Safe Harbor method or an expert determination (HHS de-identification guidance), not “we dropped the name column”.
The lesson Data, PII and compliance covers what HIPAA changes in the design.