Industries
Clinical AI that reaches production and holds up under HIPAA.
We have built a clinical scribe with wound measurement, a rehabilitation EMR with clinical intelligence, and patient-facing conversational AI, each keeping PHI inside a BAA-covered boundary, meeting the HIPAA Security Rule, with every AI output auditable. The same engineers run the infrastructure and security assessment.
The Challenge
What slows Healthcare teams down
Documentation load and clinician burnout
Manual notes, subjective wound measurement, and fragmented systems take time away from patients and produce inconsistent records with inter-rater variability. Automation only helps if it fits inside the care workflow without adding steps or screens.
PHI inside LLM pipelines
When patient records flow through LLM inference, de-identification gaps, prompt logging, embedding storage, and third-party model APIs create exposure points that traditional HIPAA controls were not written for.
HIPAA technical safeguards on the infrastructure
Encryption in transit and at rest, access controls, audit logging, backups, and retention apply to the whole environment the AI runs in, not just the application. Cloud accounts are rarely configured with these as requirements from day one.
Clinical AI that has to be trusted
AI agents in clinical workflows, from triage bots to documentation assistants, carry risks that do not exist elsewhere. Prompt injection could alter a recommendation, session data could leak between patients, and every output needs a trail a clinician can review.
How We Help
Use cases we have shipped in Healthcare
Clinical documentation AI
FastCare converts clinician-patient conversations into structured, coded notes using domain-tuned NLP, and measures wound dimensions from calibrated mobile images with computer vision. Hands-free documentation embedded in the care workflow, with EHR-friendly integration.
Rehabilitation EMR with clinical intelligence
Curengo unifies patient records, treatment plans, therapy sessions, and discharge management in one EMR. AI generates assessments, progress notes, and discharge summaries, and bedside IoT devices feed vitals directly into the record.
Patient-facing conversational AI
Hello Kidney answers patient questions about kidney health through natural language understanding and retrieval over a curated medical knowledge base, returning clear, structured responses instead of raw medical terminology.
HIPAA-compliant cloud operations
Cloud environments on AWS or Azure configured for the HIPAA Security Rule: encryption, least-privilege access, audit logging, backups with defined RPO and RTO, and 24/7 monitoring, then run as a managed service.
AI security audit of clinical systems
Testing of LLM pipelines for PHI leakage, prompt injection testing of clinical AI agents, BAA coverage review for third-party AI APIs, and a HIPAA gap analysis mapped to OWASP LLM Top 10 and NIST AI RMF, with audit-ready documentation.
Case Studies
Healthcare work we can talk about
Healthcare FAQ
Yes. If your AI system processes, stores, or transmits protected health information (PHI), it falls under HIPAA. This includes LLMs used for clinical documentation, AI chatbots that interact with patients, and any ML model trained on patient data. The Security Rule's technical safeguards apply to the AI pipeline just as they would to any other system handling PHI, which is why we treat the infrastructure and the model as one scope.
Yes, but it requires specific controls. You need a Business Associate Agreement (BAA) with the API provider (both OpenAI and Anthropic offer BAA-eligible tiers), encryption for all data in transit and at rest, access controls on who can send PHI to the model, audit logging of all prompts and completions containing PHI, and a data retention policy aligned with HIPAA requirements. We build these controls into the architecture from the first sprint.
The top risks are PHI leakage through model outputs (where an LLM inadvertently includes patient data in responses), prompt injection attacks on clinical AI agents (where malicious inputs alter medical recommendations), inadequate de-identification in training data, and uncontrolled data flows to third-party AI providers without proper BAAs in place. Each of these is testable, and we test for them before go-live and on a schedule afterwards.
A security audit of existing AI systems typically runs 4 to 6 weeks depending on the number of systems in scope, covering threat modeling, active testing of AI endpoints, HIPAA gap analysis, and remediation guidance. A build engagement starts with an assessment of one to six weeks, followed by a build phase that ends with a working system in staging on your cloud, then production deployment with monitoring and compliance validation.
We assess against HIPAA (Security Rule, Privacy Rule, and Breach Notification Rule), NIST AI RMF, OWASP LLM Top 10, and HITRUST CSF where applicable. For organizations with international operations, we also map findings to GDPR and ISO 42001. Each assessment includes a compliance mapping showing which controls satisfy which framework requirements.
Ready to build and run better infrastructure?
Cloud, DevOps, or security, book a free assessment call and we'll scope what you need.
Book a Free Assessment Call