In November 2024, a company called Serviceaide discovered that patient data from six western New York hospitals had been publicly exposed on the web for seven weeks. The breach affected 483,000 patients. The data included names, Social Security numbers, medical record numbers, diagnoses, and treatment information.
Serviceaide isn't a household name. They make "agentic AI-based IT management and workflow software." One of their healthcare clients, Catholic Health, had trusted them to handle PHI. By the time the exposure was discovered, class action lawyers were already circling.
This breach wasn't caused by sophisticated hackers or zero-day exploits. It was a configuration error at an AI vendor. The kind of mistake that happens when healthcare organizations adopt AI tools faster than their security processes can keep up.
Meanwhile, 71% of healthcare workers are still using personal AI accounts for work. One in five general practitioners uses AI to draft clinical letters. And 81% of data policy violations in healthcare organizations involve protected health information.
So when you ask "Is Claude safe for healthcare?" the honest answer is: it depends entirely on how you deploy it.
The short version: If you need to redact sensitive documents before they reach AI systems, PaperVeil handles that layer. The rest of this article explains where it fits in the broader governance architecture.
What "Safe" Actually Means in Healthcare
Let's be precise about what we're evaluating. "Safe" for healthcare AI means:
HIPAA compliance: The tool must support the privacy and security requirements of the Health Insurance Portability and Accountability Act. This includes having appropriate safeguards for PHI, signing a Business Associate Agreement (BAA) with covered entities, and meeting minimum necessary standards for data access.
Data isolation: PHI should not be used to train models, should not be accessible to unauthorized parties, and should not persist longer than necessary for the specified use.
Audit capability: Healthcare organizations need the ability to demonstrate who accessed what data, when, and why. This is essential for compliance documentation and breach response.
Clinical accuracy guardrails: AI used in clinical contexts needs mechanisms to prevent automation bias (clinicians blindly trusting AI output) and ensure qualified professional review of healthcare decisions.
Claude's consumer tiers fail on multiple criteria. Claude's enterprise and healthcare-specific offerings address most of them, but with important caveats.
Healthcare Data at Risk
Protected Health Information under HIPAA includes 18 specific identifiers:
- Names
- Geographic data smaller than a state
- Dates (except year) related to an individual
- Phone numbers
- Fax numbers
- Email addresses
- Social Security numbers
- Medical record numbers
- Health plan beneficiary numbers
- Account numbers
- Certificate/license numbers
- Vehicle identifiers and serial numbers
- Device identifiers and serial numbers
- Web URLs
- IP addresses
- Biometric identifiers
- Full-face photographs
- Any other unique identifying number or code
In practice, healthcare documents are dense with this information. A single patient intake form might contain a dozen identifiers. A clinical note references the patient by name, documents their diagnosis, lists their medications, and notes their treatment plan.
Process that document through an AI that isn't HIPAA-compliant, and you've likely committed a violation. The fact that you were trying to improve efficiency or reduce administrative burden doesn't matter to regulators.
HIPAA penalties in 2025 range from $141 to $71,162 per violation, with annual caps up to $2,134,831. But those caps are under pressure. After the Change Healthcare breach (which affected 192.7 million patients and cost an estimated $2.87 billion), senators have proposed eliminating limits on HIPAA fines entirely.
The average healthcare data breach now costs $9.48 million, according to IBM's 2024 analysis. That's more than double the cross-industry average.
How Claude Actually Handles Healthcare Data
Anthropic just launched Claude for Healthcare at JPM26 in January 2026. Here's what the different tiers actually offer:
Consumer Tiers (Free, Pro, Max)
These are explicitly not HIPAA-compliant. No BAA is available. Data may be used for model training if the user has data sharing enabled. These tiers should never be used with PHI.
Yet healthcare workers continue using them. The convenience is irresistible. Summarize this discharge note. Draft a letter to this patient. Help me code this diagnosis. Each use with real patient data creates liability.
Claude for Work (Team and Enterprise)
Better, but still not automatically HIPAA-ready. The general Team and Enterprise plans do not include BAA coverage. They offer improved security controls, audit logs, and SSO, but that's not sufficient for PHI processing.
Claude for Healthcare (New)
This is Anthropic's healthcare-specific offering with HIPAA-ready infrastructure. It includes:
- Native integrations to CMS Coverage Database, ICD-10 codes, NPI Registry, and PubMed
- BAA availability for customers with zero data retention agreements
- Explicit commitment that health data is not used for model training
- Requirement for qualified professional review of healthcare decisions
Existing customers include Banner Health, Stanford Health Care, Novo Nordisk, and Sanofi.
API Access via Cloud Providers
Claude is available through AWS Bedrock, Google Cloud Vertex AI, and Microsoft Azure. These deployments can inherit your existing cloud compliance controls, which may be the cleanest path for organizations already running HIPAA-compliant cloud infrastructure.
Where the Gaps Remain
Even with Claude for Healthcare or compliant API access, implementation gaps create risk:
BAA coverage is limited. Anthropic's BAA only covers services with zero data retention agreements. It explicitly excludes Workbench, Console, and general Claude for Work plans. If your team is using those interfaces with patient data, you're not covered.
Transmission is still transmission. When you send PHI to Anthropic's servers (or any external AI), that data crosses network boundaries you don't control. Even with contractual protections, you're trusting a third party with your patients' most sensitive information.
Workflow integration is hard. Healthcare organizations run complex EHR systems, document management platforms, and communication tools. Connecting Claude to these systems in a compliant way requires careful architecture, not just signing an agreement.
Human factors persist. The 71% of healthcare workers using personal AI accounts won't stop just because you deploy an enterprise solution. Shadow AI is a governance problem that requires training, monitoring, and technical controls.
Making Claude Safe for Your Healthcare Organization
There are three viable paths, each with different tradeoffs:
Path 1: Claude for Healthcare with Full Compliance Stack
This is the direct route if you're willing to commit to Anthropic's healthcare ecosystem:
- Engage with Anthropic's enterprise team to assess your use cases
- Negotiate appropriate data processing terms and execute the BAA
- Implement with zero data retention requirements
- Deploy through Anthropic's supported interfaces or cloud provider integrations
- Update your privacy notices and BAA registry
- Train staff on approved usage patterns
- Monitor and audit AI interactions
Cost: Significant. Claude for Healthcare is enterprise-priced, and you'll need implementation resources. Timeline: Months, not weeks.
Path 2: Cloud Provider Deployment with Existing Compliance
If you're already running HIPAA-compliant workloads in AWS, Azure, or GCP, you can access Claude through those providers' AI services:
- Use AWS Bedrock, Google Cloud Vertex AI, or Azure integration
- Configure within your existing compliance boundary
- Apply your existing access controls, audit logging, and data handling policies
- Claude processes data within your cloud environment
- No data leaves your compliance perimeter
This approach works well for organizations with mature cloud security programs. The AI becomes another workload within your existing framework.
Path 3: Redact Before Processing
The most flexible approach, and the only one that works across any AI tool:
- Build a preprocessing layer that identifies and redacts PHI before any data reaches the AI
- Process the redacted content with Claude (or any other AI)
- Re-associate outputs with original identifiers in your secure environment
- The AI never sees actual PHI
This approach decouples AI capability from PHI exposure. You can use consumer-tier AI for appropriate tasks because you've already removed the sensitive data. You get flexibility to use multiple AI tools without renegotiating compliance for each one.
Practical Implementation: The Redaction Pipeline
Here's what a healthcare-safe AI workflow looks like:
Step 1: Document ingestion Clinical notes, intake forms, or other documents enter your system through your existing EHR integration or document management platform.
Step 2: PHI detection Automated detection scans for all 18 HIPAA identifiers plus healthcare-specific patterns (MRN formats, diagnosis codes, medication names that might reveal conditions).
Step 3: Redaction with consistent placeholders
Replace each identifier with a unique placeholder: [PATIENT-1], [MRN-1], [DOB-1]. Consistency matters. The same patient name throughout a document should map to the same placeholder.
Step 4: AI processing Send the redacted document to Claude with instructions that reference the placeholders:
Summarize this clinical note for the care coordination team.
Note: Patient identifiers have been replaced with placeholders.
Maintain these placeholders in your output.
[Redacted clinical note content]
Step 5: Output handling Claude's response contains placeholders, not PHI. If you need to reconstitute the output (for a patient letter, for example), your secure system maps placeholders back to original values.
Step 6: Audit trail Log what was processed, when, by whom, what was redacted, and what AI service was used. This documentation is essential for HIPAA compliance and breach response.
The Cost of Getting This Wrong
Healthcare data breaches aren't abstract compliance concerns. They're operational catastrophes.
The Change Healthcare breach disrupted claims processing across the entire US healthcare system. Hospitals couldn't verify insurance coverage. Pharmacies couldn't confirm prescription benefits. The operational cost was separate from the data exposure itself.
Beyond the average $9.48 million breach cost, consider:
- Class action lawsuits (already being filed against Serviceaide)
- OCR enforcement actions (22 in 2024 alone, collecting $9.9 million)
- Reputational damage with patients who trusted you with their health information
- Operational disruption during incident response
- Increased insurance premiums and security requirements
The 483,000-patient Serviceaide breach happened because an AI vendor made a configuration error. Your organization's breach could happen because a staff member pasted a patient's note into a personal ChatGPT account.
Both are preventable with the right architecture.
Moving Forward
Claude can be safe for healthcare. Anthropic is actively building for this market, and their healthcare-specific offerings address many compliance requirements. But "safe" isn't a product you purchase. It's an architecture you implement.
The organizations getting this right share common characteristics:
- They've defined approved AI use cases with clear boundaries
- They've deployed technical controls (DLP, redaction, access management) alongside policy
- They've trained staff on both approved tools and the risks of shadow AI
- They've built audit capability into their AI workflows from the start
- They treat AI compliance as continuous, not one-time
The organizations at risk are the ones assuming that enterprise licensing equals compliance. It doesn't. The gap between "HIPAA-ready" and "HIPAA-compliant" is where breaches happen.
If you're using AI in healthcare today, audit your current state. Who's using what tools with what data? Then build the architecture that makes safe usage the default, not the exception.
PaperVeil lets you redact all your sensitive information from PDFs in a simple drag and drop flow. Detect and remove PII, match custom patterns, strip metadata, and generate audit trails. The redaction layer that makes AI document processing actually safe.