🧠 Food for thought

Implications, context, and why it matters.

Claude HIPAA coverage hinges on deployment

• Consumer Claude.ai, including Pro and Max, is excluded from HIPAA coverage under Anthropic’s BAA 1.
• Anthropic signs BAAs only for HIPAA-ready services such as its first-party API with zero data retention or some Enterprise plans 1. These deals require review, specific configuration, and may limit features 1.
• Healthcare groups can use Claude via AWS Bedrock, Google Vertex AI, or Microsoft Azure with BAAs and safeguards when configured properly 2.
• Using Claude with Protected Health Information (PHI) without a BAA is not HIPAA compliant 3.
• New health record integrations target individual users 1. They include HealthEx, Function, Apple Health, and Android Health Connect 1. These ship through consumer products that are not covered, so covered entities should not use them for PHI 1. HealthEx and Function aggregate third-party health data, while Apple Health on iOS plus Android Health Connect on Android are consumer health data frameworks 1.

CMS sets a 2027 FHIR prior authorization deadline

• By Jan 1, 2027, payers must deploy HL7 FHIR Prior Authorization APIs 4. Scope covers Medicare Advantage organizations, Medicaid FFS/managed care, CHIP FFS/managed care. It also includes Qualified Health Plan (QHP) issuers on the Federally Facilitated Exchanges (FFEs).
• In 2026, payers must decide in 72 hours for expedited and seven days for standard, except QHP issuers on FFEs 4.
• CMS allows FHIR-only APIs without X12 278 5.
• Claude FHIR skills help platforms build compliant systems faster. Public reporting of prior authorization metrics begins in 2026, boosting demand for analytics on approval rates with timelines 4.