What Changes When PHI Is Involved

Most AI implementations assume you can send data to a model provider and get a response back. With protected health information that assumption breaks immediately. You need a Business Associate Agreement with the provider, controls over what leaves your boundary, a record of every access, and a defensible answer when someone asks where the data went.

Controls We Build In

Designed against the HIPAA Security Rule safeguards rather than bolted on before launch

Encryption & Access

TLS 1.2 or higher in transit, AES-256 at rest, role-based access on least privilege, and multi-factor authentication on every administrative path.

Audit & Minimisation

Immutable logging on every PHI read and write, with de-identification and field-level redaction before model calls wherever clinically viable.

Isolation & Retention

Separate environments with synthetic data only outside production, and configurable retention and deletion aligned to your policy.

How We Engage

BAA

Signed First

A Business Associate Agreement is in place before any protected health information moves.

Step 1

Risk Assessment

We run a HIPAA Security Rule risk assessment at the start of every engagement that touches PHI — before architecture, not after launch.

Scope

Where We Stop

We do not build clinical decision support that diagnoses or recommends treatment. That is regulated as a medical device and needs a different compliance path. We build the operational layer around clinical work.