HIPAA compliant translation of PHI for US covered entities: BAA, safeguards, AI use and vendor duties
HIPAA compliant translation means that a language vendor handling protected health information (PHI) for a covered entity signs a business associate agreement (BAA), applies Security Rule safeguards, and follows Privacy Rule limits on use and disclosure. A vendor that creates, receives, maintains, or transmits PHI on a covered entity’s behalf is a business associate under HIPAA. Business associates are directly liable for compliance.
Table of Contents
What does HIPAA compliant translation mean for documents that contain PHI?
HIPAA is a US federal law. It governs covered entities, such as health plans and health care providers, and their business associates. PHI is individually identifiable health information held or transmitted by these parties.
Translation is in scope when the source text contains PHI. Examples are clinical records, discharge summaries, lab reports, consent forms with patient names, claims files and clinical trial documents that carry patient identifiers.
There is no federal certificate called “HIPAA certified translation.” Compliance is shown through a signed BAA, documented safeguards and evidence that the vendor follows them. Vendor claims of compliance are not a substitute for these.
Scope of this page. It addresses localization, compliance and security leads at organizations that commission translation of PHI-bearing content. It does not address interpreters at the point of care.
Which translation workflows involve PHI and who is responsible?
PHI can enter a translation workflow at several points:
File transfer from the client to the vendor.
Storage in a translation management system.
Processing by machine or AI tools.
Review by linguists and subject-matter experts.
Desktop publishing and layout.
Archiving of translation memories and term bases.
Each point is a place where the vendor creates, receives, maintains, or transmits PHI. HHS states that cloud service providers handling electronic PHI are business associates, even when they store only encrypted data and hold no decryption key. A translation platform that hosts files falls under the same logic.
The covered entity remains responsible for obtaining satisfactory assurances before disclosure. The business associate is responsible for its own compliance and for its subcontractors. HHS guidance on business associates states that these assurances are typically given in a BAA.
A narrow exception exists for relay services. HHS states that a covered entity’s use of a certified Telecommunications Relay Service to reach patients with hearing or speech impairments does not require a business associate contract. Document translation vendors do not fall under this exception.
What are the HIPAA translation requirements, step by step?
The steps below name the owner of each step and the control that evidences it.
Classify the content. Owner: compliance or privacy officer with the localization lead. Control: a documented list of document types that contain PHI, and a rule for de-identifying content where the translation does not need identifiers.
Execute a BAA. Owner: legal and privacy. Control: a signed agreement that defines permitted uses and disclosures, requires safeguards and covers subcontractors such as freelance linguists.
Verify Security Rule safeguards. Owner: CISO. Control: review of the vendor’s administrative, physical and technical safeguards, including access control, encryption in transit and at rest, and audit trail.
Restrict access by role. Owner: vendor project manager, approved by the client. Control: named linguists only, least-privilege accounts, and removal of access at project close.
Run the translation inside a controlled environment. Owner: vendor. Control: no PHI in public machine translation tools, and no use of PHI to train third-party models.
Apply quality assurance. Owner: vendor linguists and reviewers. Control: independent second review, terminology checks against client term bases and a documented QA record.
Deliver and retain. Owner: both parties. Control: secure delivery channel, a retention schedule and verified deletion or return of files at termination.
Monitor and audit. Owner: compliance. Control: periodic review of access logs, incident reporting terms and BAA renewal.
The Privacy Rule limits disclosures without authorization to narrow permissions. OCR describes these permissions as intentionally narrow. The vendor must use PHI only as the BAA allows.
How should a covered entity choose a translation vendor?
Use criteria that can be verified with documents.
Criterion | Evidence to request | Control it tests |
BAA | Signed agreement, subcontractor flow-down | Contractual liability |
Information security | ISO 27001 certificate, scope statement, penetration test summary | Security Rule safeguards |
AI governance | ISO 42001 certificate, data flow diagram | Model and data handling |
Hosting | Named location and ownership of infrastructure | Data custody |
Linguist qualification | Credentials in medical, legal or technical fields | Accuracy |
Quality process | ISO 17100 and, for post-edited output, ISO 18587 | QA |
Terminology | Use of client translation memories and term bases | Consistency |
Incident response | Notification timelines in the BAA | Breach handling |
Quality criteria should be explicit as well. The GSA ordering guide of December 2025 says a provider should be willing to guarantee the quality of its services. It lists quality control measures such as checking each project with multiple translators, maintaining the customer’s glossary, identifying every translator who approves a translation, and addressing poor services.
The ISO standards above are voluntary. They do not replace a BAA. They give an auditor an independent reference point.
Can machine translation or AI be used on PHI?
Only in a controlled environment. Public translation apps and open web interfaces are not suitable for PHI because the data leaves the organization’s control and no BAA covers it.
A 2025 peer-reviewed article on machine-assisted translation in healthcare states that closed-source large language models should not be used in ways that expose PHI through unprotected application programming interfaces. The authors recommend zero-data-retention endpoints or private instances, and cite a dedicated Stanford Health Care pathway under institutional control. They also name risks to manage: hallucinations, context loss and weaker human accountability. They recommend training reviewers on common pitfalls.
Three controls follow from this:
Private processing. The model runs in an environment covered by the BAA, with no retention for third-party training.
Human accountability. A qualified linguist reviews every segment, and the review is recorded.
Terminology governance. Approved term bases constrain output.
For background on why generic engines create exposure, see this note on machine translation security and compliance risks. A related overview of localization and translation processes covers workflow terms.
What recent HIPAA changes affect translation vendors?
Two developments matter for planning.
Reproductive health privacy rule. HHS announced the HIPAA Privacy Rule to Support Reproductive Health Care Privacy on April 26, 2024. On June 18, 2025, the US District Court for the Northern District of Texas declared most of it unlawful and vacated it. Only specific Notice of Privacy Practices provisions, 45 CFR 164.520(b)(1)(ii)(F), (G) and (H), were vacated within that section. Other modifications remain, with a compliance date of February 16, 2026. Source: HHS OCR. Translated privacy notices should reflect the current text.
Proposed Security Rule update. OCR issued a proposed rule on health care cybersecurity on December 27, 2024. The Federal Register published it on January 6, 2025 as a proposal to modify the Security Rule for ePHI. A proposal is not binding law. Check the HHS regulatory initiatives page for its status. Software teams can read a HIPAA compliance checklist for software development when mapping system controls.
What examples show the controls in practice?
Clinical trial documents. A sponsor sends adverse event narratives with patient identifiers for translation. The sponsor classifies them as PHI-bearing, signs a BAA, restricts access to named medical linguists and requires deletion at close.
Hospital discharge instructions. A provider translates templates without patient data. Classification shows no PHI, so a lighter workflow is documented. Filled-in instructions with patient names follow the full workflow.
Health plan member letters. A plan sends claims correspondence in bulk. The vendor processes it on private infrastructure, logs every access and returns files through an encrypted channel.
Device complaint files. A manufacturer translates complaint records containing patient details. The manufacturer’s privacy lead confirms whether HIPAA applies to the record and applies the same access and retention controls.
What are the failure modes and mitigations?
Failure mode | Mitigation |
Staff paste PHI into a public translation tool | Written policy, blocked tools, approved private workflow |
No BAA with a subcontracting linguist | BAA flow-down clause and subcontractor list |
Files left on vendor systems after delivery | Retention schedule and deletion confirmation |
Shared accounts with no audit trail | Named accounts and log review |
AI output accepted without review | Mandatory expert review and QA record |
Terminology drift across documents | Governed translation memories and term bases |
Outdated translated privacy notice | Version control tied to regulatory updates |
Where AD VERBUM fits
AD VERBUM provides AI+HUMAN hybrid translation and localization for regulated sectors on a proprietary LangOps System hosted on EU servers. Its stated certifications include ISO 27001, ISO 42001, ISO 17100, ISO 18587, ISO 13485 and ISO 9001, independently audited by Bureau Veritas. It aligns to HIPAA and GDPR, uses a network of 3,500+ subject-matter expert linguists and supports 150+ languages. It integrates client translation memories and term bases. See the AD VERBUM services.
Perspective
HIPAA compliance in translation is a workflow question before it is a technology question. The agreement, the access model and the review record decide whether PHI stays protected. We design for that. Our approach combines a private AI environment with qualified subject-matter experts who review the output. The AI+HUMAN hybrid model keeps accountability with named people, which the research on machine-assisted translation identifies as a point of risk. Regulated buyers should expect to see each control on paper: who has access, where data sits, how quality is checked and how files are removed. Eric Brown
FAQ
Is Google Translate HIPAA compliant?
A public translation tool is not a safe place for PHI unless a BAA covers it and the provider offers the required safeguards. HHS treats providers that handle ePHI for a covered entity as business associates. Organizations should use a controlled environment under a signed BAA.
Does a translation vendor always need a BAA?
Yes, when it creates, receives, maintains, or transmits PHI for a covered entity. HHS guidance says the covered entity typically obtains satisfactory assurances through a BAA before disclosure.
Who can certify a translation in the US?
There is no single federal certifying authority for translations. Certification statements are usually issued by the translator or the vendor, and the receiving body sets its own requirements. Confirm those requirements with the receiving agency.
Can AI be used to translate PHI?
Yes, in a private, access-controlled environment with no data retention by third parties and qualified human review. Public interfaces should not receive PHI.
Key points
HIPAA applies to translation when source text contains PHI.
A vendor handling PHI for a covered entity is a business associate and needs a BAA.
Business associates are directly liable for compliance.
Required controls include access control, encryption, audit trail and retention rules.
AI may process PHI only in a private environment with human review.
Quality assurance needs a documented second review and governed terminology.
The 2024 reproductive health rule was largely vacated in June 2025.
The 2025 Security Rule proposal is not binding law.
Sources
