Loading…
Compliance
Under the HIPAA Security Rule (45 CFR Part 164), any system that stores, transmits, or processes Protected Health Information must implement specific technical safeguards. Most general-purpose AI vendors (OpenAI, Anthropic, Google) offer BAA agreements on their enterprise tiers, but signing a BAA is necessary but not sufficient. The architecture must also isolate PHI from training pipelines and maintain a tamper-evident audit trail of every access.
We design and build AI systems specifically for HIPAA-covered entities and their business associates. Every system we deliver includes the technical safeguards required under 45 CFR §164.312, PHI-compliant vendor selection with BAA confirmation, and a documented data flow your compliance officer can review before go-live.
Tell us what you're building.
These are the technical safeguards under the Security Rule that every AI system touching PHI must implement. They are not optional. They are the floor, not the ceiling.
Every user of the system must have a unique identifier. The system must enforce automatic logoff after inactivity and provide mechanisms to encrypt and decrypt PHI. We implement role-based access with audit-logged permission grants and revocations.
Hardware and software activity logs must capture who accessed PHI, when, and what action was taken. Logs must be tamper-evident, stored separately from the application layer and write-only from the app's perspective.
The system must implement mechanisms to verify that PHI has not been altered or destroyed in an unauthorised way. For AI pipelines this means checksumming data at ingestion, in transit, and at the point of LLM call.
TLS 1.2 or higher on all network paths that carry PHI, including calls to LLM provider APIs. Encryption at rest for all PHI storage using AES-256 or equivalent. No PHI may travel over unencrypted channels.
Any vendor who receives or processes PHI as a business associate must sign a Business Associate Agreement with you. This includes your LLM provider. A BAA does not, by itself, make a system compliant, the architecture must also isolate PHI from the vendor's training pipelines.
These are the specific systems we scope and deliver for healthcare clients. Each one is designed from the ground up with PHI isolation and audit logging built in.
Patient record Q&A, clinical knowledge bases, and prior authorisation lookup, built with PHI-isolated vector stores and audit logging on every retrieval.
Appointment scheduling and pre-visit intake flows over voice or chat, with call recordings and transcripts handled under HIPAA-eligible infrastructure.
Structured data extraction from lab reports, referrals, EOBs, and clinical notes, with PHI masking applied before any LLM call leaves your network perimeter.
A preprocessing layer that strips or tokenises the 18 HIPAA identifiers before forwarding to an LLM endpoint. Reversible tokenisation lets you reconstruct results post-inference.
Every AI interaction that touches PHI (prompt, completion, user identity, timestamp, accessed records) written to an append-only audit log with cryptographic integrity.
We review your vendor DPA and BAA documents for obvious gaps, confirm which endpoints are HIPAA-eligible, and document the PHI data flow for your compliance officer.
Each vendor below offers a HIPAA BAA, but only on specific tiers. Standard consumer accounts are not covered. Confirm current BAA availability directly with each vendor before finalising your stack.
Important: Standard consumer tiers of ChatGPT, Claude.ai, and Gemini do NOT offer BAAs and must not receive PHI.
Enterprise tier only. The standard API and ChatGPT.com are not covered.
Enterprise tier only. Claude.ai consumer accounts are not covered.
Healthcare API and Vertex AI. Standard Gemini consumer products are not covered.
HIPAA-eligible services list. Not all AWS services are HIPAA-eligible by default.
HIPAA-eligible services list. Signing a Microsoft BAA is required.
We turn down projects that are outside our scope. Saying no early saves everyone time.
Companies not covered under HIPAA
HIPAA applies to covered entities (health plans, healthcare clearinghouses, providers) and their business associates. If your product does not handle PHI (or if you operate entirely outside the US) HIPAA does not apply and this engagement is not the right fit.
Teams who want consumer-tier APIs without enterprise agreements
We will not help you route PHI through the standard OpenAI, Anthropic, or Google APIs without a BAA in place. The architecture either includes HIPAA-eligible endpoints or it does not get built.
Anyone expecting a guaranteed compliance sign-off
We implement the technical safeguards required under 45 CFR Part 164. Your compliance officer and legal counsel must review and approve the full HIPAA compliance programme (including administrative and physical safeguards) before you treat the system as compliant.