HLTH 2026 AI Guide: 10 BAA Questions for Every Vendor
Going to HLTH 2026 in Las Vegas? Ask every AI vendor these 10 BAA questions on PHI, models, logging and fees before you sign. A HIPAA AI checklist.
Concentrate.ai
On this page
HLTH 2026 runs November 15 to 18 in Las Vegas, and nearly every booth will pitch AI. Before you send patient data to any of it, ask each vendor the 10 questions below. They separate an AI product that can take PHI under a BAA from one that only says "HIPAA" on the banner.
Why ask AI vendors about BAAs at HLTH?
Because the BAA is what makes PHI use allowed, and many AI products sit on top of model providers you never see. Under HHS guidance, a cloud or AI service that handles ePHI for you must sign a BAA. If the vendor's BAA doesn't reach the company actually running the model, the gap is yours. AI is all over the HLTH 2026 agenda, with sessions such as The Missing Ingredient in Healthcare AI and Building Clinical AI for Enterprise Scale, so expect a lot of these conversations.
What are the 10 BAA questions to ask every AI vendor?
Who signs the BAA, and does it cover the model inference? A BAA for the vendor's app doesn't help if the model provider behind it has none with them.
Ask for the written list. "We support HIPAA" is not a list.
LLM Gateway
Instant access to every model
Change models, providers, add fallbacks, and more by running all AI usage through one platform.
Which providers actually run the models? The same model can be covered on one provider and not on another.
What happens when a provider fails? If requests fall back to an uncovered provider, PHI leaves your BAA during an outage.
Is zero data retention on? Ask whether prompts and outputs are stored, and for how long.
Is request content logged? Debug logs, traces and caches are where PHI tends to leak.
Do you use your own provider keys or mine? If it's your account, you need your own BAA with that provider.
Which features are excluded from the BAA? Model makers exclude some features; Anthropic's BAA, for example, excludes features such as Claude Console (Anthropic).
Can I switch models without a new contract? Models change monthly; you shouldn't need a new BAA each time.
What does the BAA cost, and do you mark up tokens? Separate the subscription from the inference bill.
How does Concentrate answer these questions?
Question
Concentrate's answer
Who signs the BAA
Concentrate, covering inference on BAA-eligible providers
OpenAI, Anthropic, Azure, Google Vertex AI, Fireworks AI, Azure Fireworks and Baseten
Failover
Only to covered routes; if none is left, the request is rejected
Data retention
Zero data retention locked on
Request logging
Request-content logging locked off
Your own keys
Off in HIPAA mode, because the BAAs don't cover customers' own provider accounts
Switching models
GPT-6.1, Claude 5.5, Gemini 4 Argon, DeepSeek V4.1, GLM-5.3, Kimi K3 and more under the same BAA
Cost
$499/month with a BAA (no subscription fee without one); no per-request fees or token markup
Which AI models can healthcare teams use with PHI today?
On Concentrate, BAA-covered models today include GPT-6.1 Sol on OpenAI and Azure, Claude Opus, Sonnet and Haiku 5.5 on Anthropic and Azure, Gemini 4 Argon on Google Vertex AI, and DeepSeek V4.1 Flash on four providers. See Model Fortress for the live list; we keep adding BAA-eligible providers.
Can I meet Concentrate at HLTH 2026?
Yes. Our team will be in Las Vegas for HLTH. If you're building healthcare AI and need GPT, Claude and open models under one BAA, reach out through concentrate.ai/compliance and we'll find a time to meet.
FAQ: HLTH 2026 and HIPAA AI
When and where is HLTH 2026?
HLTH 2026 is November 15 to 18, 2026, in Las Vegas. Details are on hlth.com.
Is an AI tool HIPAA compliant if the vendor says so?
Not by itself. Compliance depends on the deployment: a signed BAA that covers the inference, covered providers only, and safeguards like zero data retention and no request-content logging.
What is the most important question to ask an AI vendor about PHI?
Who signs the BAA that covers the model inference, and which models and providers it lists.
Does Concentrate sign a BAA?
Yes. BAA use is $499/month, with no per-request fees and no markup on tokens. Without a BAA there is no subscription fee. Start at concentrate.ai/compliance.
Blog