Healthcare
A HIPAA-aligned path to AI, without a BAA gap
Healthcare teams can use modern language models on protected health information when three things hold: the processing is covered by a business associate agreement, the payload is limited to the minimum necessary, and every access is attributable and logged. Shield enforces all three at the wire — minimizing PHI before dispatch, routing only to models under covered terms with Zero Data Retention, and producing the audit record a compliance officer can hand to an assessor.
The three failure modes we see
- Coverage gap — a model is called under terms that no business associate agreement covers, often because a newer, faster endpoint appeared.
- Over-disclosure — the whole chart or the whole document is sent when a single field would have answered the question.
- No attribution — the application can show that a call happened, but not which clinician or workflow made it, which fails audit controls.
What Shield enforces
- PHI detection and minimization before any request leaves your perimeter.
- Model allow-listing restricted to services under covered agreements with retention disabled.
- Identity-bound access, so every request maps to a person, role, and purpose.
- Immutable per-request logging mapped to HIPAA Security Rule access, audit, and transmission safeguards.
- Residency-aware routing, so data stays in the jurisdictions you have approved.
Where this fits alongside SOC 2 and ISO 27001
The same evidence stream satisfies more than one framework. Access and audit controls answer HIPAA; the same records support SOC 2 logical access and monitoring criteria, ISO 27001 Annex A controls, and the transparency and record-keeping expectations arriving with the EU AI Act. Building the log once, at the gateway, is what makes that reuse possible.
Request an AI Readiness Review — free
A 20-minute review of how your teams use AI today, which models are in play, and the controls a board would expect. No obligation.
Frequently asked questions
Can we use ChatGPT or Claude with PHI?
Only under a signed business associate agreement covering the specific service, with retention disabled and access controls in place. Consumer tiers and personal accounts never qualify, regardless of how careful the user is.
Does de-identification remove HIPAA obligations?
Properly de-identified data falls outside HIPAA, but de-identification is a high bar — 18 identifier categories under Safe Harbor, or expert determination. Automated stripping helps; it does not by itself make data de-identified.
What does HIPAA require that a gateway provides?
Access controls tied to real identities, audit controls that record who accessed what, transmission security, and the ability to demonstrate minimum necessary use. A gateway produces all four as a by-product of routing.
What about clinicians pasting notes into a browser assistant?
That is the most common real breach path in healthcare AI. The fix is a sanctioned assistant that is easier to reach than the unsanctioned one, backed by a gateway that minimizes payloads before dispatch.