HIPAA：AI-FW 控制与组织责任
了解框架义务、AI-FW 技术控制和组织责任。
HIPAA：AI-FW 控制与组织责任 · 已生效
本页说明框架与 AI-FW 的关系。产品支持部分运行时控制，但不替代组织的合规或审计责任。
AI-FW 的定位
- 说明：The gateway can inspect prompts/responses, apply configured health-data rules, associate calls with identities and restrict model destinations. It does not make an organisation compliant by itself.
产品不负责的事项
- 说明：Determining covered-entity or business-associate status.
- 说明：Signing a Business Associate Agreement.
- 说明：Defining all administrative, physical and technical safeguards.
- 说明：Classifying all health information or replacing risk analysis.
- 说明：Guaranteeing each workflow complies with HIPAA.
控制映射
- 说明：Access: 说明：Limit access to authorised users and systems. AI-FW: 说明：Agent/user authentication and identity/role policies.
- 说明：Audit: 说明：Record and review activity in systems containing ePHI. AI-FW: 说明：Transaction and administrative logs, exportable by configuration.
- 说明：Integrity: 说明：Protect ePHI against unauthorised changes. AI-FW: 说明：Inspection policies and auditable configuration changes.
- 说明：Transmission: 说明：Protect ePHI over electronic networks. AI-FW: 说明：TLS on configured connections and gateway inspection.
证据预期
- 说明：Identity configuration: 说明：Authentication methods and policies in use.
- 说明：Audit logs: 说明：Transactions, events and export destinations.
- 说明：Health-data rules: 说明：Enabled rules and actions.
组织责任
- 说明：Determine applicability and ePHI use.
- 说明：Maintain risk analysis, policies and agreements.
- 说明：Approve providers and execute BAAs where required.
- 说明：Operate workforce, physical and technical safeguards.
- 说明：Validate detection for each workflow.
常见问题
说明：Does AI-FW make a model provider HIPAA compliant?
说明：No. The organisation evaluates provider authorisation for ePHI and required agreements.
说明：Is Health Data Risk a compliance certification?
说明：No. It is a heuristic signal for review.
说明：Can audit evidence avoid full prompt storage?
说明：Yes, depending on logging configuration and policy.
一般信息，不构成法律或审计建议。