PHI-safe architecture per feature
For each AI feature, the right path: a BAA-covered inference route — the major model providers offer them — or genuine de-identification before data flows. Chosen deliberately, documented, and defensible.
Services AI & HIPAA
AI & HIPAA
AI and PHI can work beautifully together. We engineer it that way.
AI features and HIPAA can coexist — if the data flows are engineered for it. We design HIPAA-compliant AI: BAAs with the right providers, de-identification that holds up, and Security Rule controls over every pipeline — so you ship AI features healthcare buyers can approve.
Got it — we're on it.
Check your email.
Something went wrong. Try again, or email hello@ysecurity.io.
What does HIPAA mean for AI?
HIPAA doesn't prohibit using AI on protected health information — it constrains how. PHI that reaches a model provider must be covered by a business associate agreement, or be properly de-identified before it flows. Security Rule safeguards — access controls, audit logging, encryption — apply to AI pipelines like any other system, the minimum-necessary standard limits what each feature may touch, and model inputs, outputs, and logs can themselves be PHI. Done right, it's careful plumbing: BAA-covered paths, engineered de-identification, and safeguards that follow the data everywhere it flows.
What you get
De-identification that holds up
Safe Harbor's identifier removal or expert-determination logic applied to training data, eval sets, and prompt logs — treated as engineering with QA, not a checkbox, because clinical free text re-identifies easily.
Security Rule controls across the pipeline
Access controls, audit trails, encryption, and retention over prompts, outputs, embeddings, and logs — mapped to the Security Rule and reflected in your risk analysis, in language your auditor recognizes.
Answers your buyers accept
Hospital security reviews and AI governance committees ask hard questions. We write the documentation and join the calls — the same way we run sales support for our compliance clients.
How it works
- 1
Map
Typically 1–2 weeks.We trace every place PHI touches AI today — features, vendors, logs, training sets — and classify each flow: BAA-covered, de-identified, or exposed. The exposed list is your real to-do list.
- 2
Engineer
Sized to the findings.BAAs put in place with model providers, de-identification pipelines built and QA'd, Security Rule controls wired into the AI path, and your risk analysis updated to cover it all.
- 3
Prove
Ongoing.Documentation your buyers and auditors accept, question-ready answers for hospital security reviews, and periodic re-checks as models and features change.
AI & HIPAA questions, answered
Can we use OpenAI, Anthropic, or Google models with PHI?
Yes — the major providers offer BAA-eligible services, but eligibility isn't automatic: it takes the right product tier, a signed BAA, and configurations (retention, training, logging) that match it. We set those up and verify the paths your PHI actually takes, which is where surprises usually live.
Is de-identified data really outside HIPAA?
Properly de-identified data is — via Safe Harbor's removal of the 18 identifier types or a documented expert determination. The trap is 'properly': clinical notes are dense with quasi-identifiers, and a regex pass doesn't meet the bar. We build de-identification as an engineered, QA'd pipeline, so the claim survives scrutiny.
Do prompt logs and model outputs count as PHI?
If they contain PHI, yes — full stop. Logs, traces, embeddings, and cached outputs inherit every HIPAA obligation: access controls, encryption, retention, and inclusion in your risk analysis. This is the most common opportunity we find in otherwise careful teams — and one of the quickest to close.
We're not HIPAA compliant yet at all. Where do we start?
Then we start one layer down — our HIPAA Compliance service builds the foundation (policies, BAAs, risk analysis, Security Rule controls) and this work rides on top of it. Done together, the AI features and the compliance program land in the same motion.
Will hospitals actually approve AI features?
Yes — with the right paper trail. What wins deals is specificity: a clear BAA chain, a solid de-identification story, a crisp answer for 'where do prompts go?'. Buyers say yes to documented architectures. We build the documents and sit in the review meetings until they do.
What does this cost?
Billed in 15-minute increments with an optional monthly cap. The flow review is free and tells you how much exposed surface you actually have — for many teams the list is short and very achievable.
Healthcare buyers reward teams who can show exactly where patient data goes. We make you that team.
AI features hospitals can say yes to
Send your company email and we'll come back with your PHI-and-AI flow review.