HIPAA: the technical safeguards for AI that touches ePHI
An LLM gateway is in scope the moment a prompt, a document or a response can contain ePHI. That hour arrives faster than most health organisations expect, usually through a pilot nobody classified as clinical.
- The instrument
- HIPAA Privacy, Security and Breach Notification Rules (45 CFR Part 164)
- Status
- In force
- Who it applies to
- Covered entities and business associates whose AI use cases can reach electronic protected health information.
Where AI-FW fits
AI-FW is a technical safeguard and a minimum-necessary enforcement point. It does not make an organisation compliant on its own, and it does not sign a business associate agreement. It decides what clinical content is allowed to leave toward a model, and it records what happened, which is the part auditors ask about first.
What stays with you
Read this list first. It is the boundary of what a product can do for you, and it is where the remaining work sits.
- Business associate agreements with every model provider and processor, though the model inventory is the checklist to work from
- The security management process, workforce training and contingency planning
- Facility access controls and physical safeguards
- The breach risk assessment and the notification decision, which carry their own statutory clock
- Deciding between Safe Harbor and Expert Determination for de-identification
What the framework asks, and what the product does
The obligations that touch the AI path, paired with the capability that answers each one. Everything else in this framework is organisational work, listed above.
An accurate, current assessment of risks to ePHI
Per-agent and per-user risk scoring with violation history and a view of which data categories are actually in play, feeding the assessment rather than replacing it
Record and examine activity in systems containing ePHI
Transaction and access records with actor, model, outcome and latency, plus a separate audit event for every administrative change
Limit access to the minimum necessary
Per-agent identity, a key registry with hashed and revocable keys, role policies, and views scoped to an owner
Verify the person or entity before granting access
Hashed API keys, client certificates validated against the anchors you upload, and Kerberos with user and subnet allowlists
Guard ePHI in transit
TLS on every listener endpoint and on upstream model calls
Use and disclose only the minimum required
A health-data rule pack that masks or blocks identifiers, plus a per-model guard so only approved models can receive clinical content
Remove the identifier classes that make data identifiable
Detection of the Safe-Harbor identifier classes at the boundary, with masking before anything leaves toward a provider
Keep the documentation that demonstrates compliance for six years
Evidence retention is a setting, and it can be set to the six-year horizon rather than being fixed by the product
Protect ePHI from improper alteration or destruction
A tamper-evident usage ledger and audit events for configuration change, so rule edits cannot happen silently
Periodically reassess safeguards
Scheduled assessment of the framework, with drift findings raised when a safeguard is switched off
A rule pack to start from
The enforcement that makes the controls real. Severity runs 1 to 5, and a rule that is switched off reports as a gap, so these are meant to be live from day one.
Minimum necessary, applied before the data crosses
Clinical context is identifying even without a name attached
The classic ePHI exfiltration pattern
A provider without a business associate agreement is the whole problem
Prevents the guard itself from being talked around
What the evidence pack contains
Per period, and without prompt or response content, which is what makes it safe to hand over.
- Control statusesIncluding safeguards currently switched off
- Health-data rule state and actionsEnabled, with masking rather than observe-only where policy requires
- Authentication configurationOnly the methods you actually use are enabled
- Retention valuesAt least six years for documentation
- Processor inventoryEvery downstream provider that requires an agreement
Customer responsibilities and sources
- Execute business associate agreements with every downstream model and processor: the model inventory is your checklist.
- Run the security management process, workforce training, contingency planning and facility controls.
- Set the policies for minimum necessary and de-identification, and choose between Safe Harbor and Expert Determination.
- Make the breach risk assessment and the notification decision within your statutory window.
- Retain documentation for six years and evaluate safeguards periodically.
Common questions
If ePHI reaches it, the ordinary analysis applies and that is a question for your counsel. What we can tell you is what the product does: self-hosted deployment means the data path stays inside your environment, and the evidence packs exclude clinical content by design. Those two facts are usually what the conversation turns on.
It converts the principle into a rule. Clinical identifiers are detected and masked before the request leaves toward a model, sensitive payloads are blocked on the way out, and only approved models can receive clinical content at all. Each of those decisions is recorded, so the answer to an auditor is a log line, not a description of intent.
Retention is a setting rather than a fixed window. Set it to at least six years and the control reports as satisfied; leave it shorter and it reports as a gap. The point is that the gap is visible before an auditor finds it.
Validate it yourself with our Technical Plan
Ask us to run this framework against your own environment: the rules that would be created, what the assessment reports, and what the evidence pack contains for a real period.
This page maps product capabilities to published expectations. It is not legal, audit or certification advice, and it creates no compliance representation. Applicability and sufficiency are judgements for your counsel and, where relevant, your auditor, assessor or certification body. Framework details are current as reviewed; check the primary sources above, and the page itself, before relying on a date or a threshold.