The safest place for PHI is where it already is.
Most enterprise AI asks you to send protected health information somewhere new and then explain that decision to a privacy officer. Under an on-premises or BYOC deployment there is nothing to explain, because the execution plane runs inside your perimeter and we never receive it. What follows is the rest of the review, question by question.
What this page is not
It is not a compliance claim and it does not name a health system we have worked with. The case studies carry no logos for the same reason. HIPAA compliance is a property of a covered entity and its business associates operating together; 21 CFR Part 11 compliance is a property of a validated system in its operating context. Neither is a badge a software vendor can hold, and this page states what the architecture provides rather than what we would like it to imply.
The translation
Four questions, and the control each one is really asking for.
PHI BOUNDARY
“Where does protected health information go?”
Under on-premises or BYOC: nowhere it is not already. The execution plane runs inside your infrastructure, credentials live in a store inside your perimeter, egress is denied by default, and inference routes through a gateway you have already approved — including a self-hosted model. We do not receive PHI, which means there is nothing for us to safeguard on your behalf and no transfer for you to justify.
MINIMUM NECESSARY
“What stops it reading more than it needs?”
Three independent mechanisms rather than a policy statement. Permissions are intersected rather than inherited, so an agent reaches only what that user's role already permitted — it cannot become a privilege escalation path. The tool roster is compiled per turn, so capabilities outside the current task are not merely unused but absent. And sensitive spans are tokenized before inference, so even permitted data reaches the model as a token rather than a value.
ATTRIBUTABLE & NON-REPUDIABLE ACTION
“Who did this, and can they deny it later?”
An agent that writes autonomously has no attributable actor, which is disqualifying in a regulated records context. Here the agent never holds write authority: every write stops at a gate, shows its blast radius, and executes under the approval of an authenticated named human whose identity comes from your own identity provider. The approval is pinned to a version token, so it cannot be replayed against changed data or disowned afterwards. These are the properties an electronic signature regime asks for; validating the system in your environment remains your obligation.
AUDIT TRAIL
“Reconstruct the decision, not a summary of it.”
The trail is computer-generated, time-stamped, and emitted into your own observability stack in open formats rather than a vendor console. Every claim in an output resolves to the tool call and result set that produced it, and the distributed trace propagates across both execution planes so the record survives the boundary between them. An auditor reconstructs what happened from your own systems, without us in the room.
Where it lands
Start where PHI is not the input.
The fastest route through a healthcare security review is a first deployment that does not touch patient data at all. Each of these clears that bar and still returns real capacity.
Validation and traceability evidence
Requirements and source code become traceable verification tests, producing the requirement-to-test matrix a validation package needs as a by-product rather than a separate documentation exercise.
De-identification as a control
Deterministic detection and tokenization of identifiers before anything reaches a model, with the reversal mapping held inside your perimeter — a mechanism a reviewer can test, not a policy they have to trust.
Operational reporting on governed sources
Throughput, utilisation, and supply reporting built from a governed warehouse — the analytics backlog that never clears, on data that is already aggregated.
Bring the privacy officer, not just security.
The questions that stop healthcare AI are rarely infrastructure questions. Send us the privacy assessment alongside the security one and we will answer both in writing before anyone books a demonstration.