Policy Controls for Healthcare AI Traffic

Healthcare teams often must keep health information away from a model and control medical language in answers. Verdictan has two policy controls for these tasks. This article compares them. Each control page gives the full field reference.

These controls examine text. They do not make you compliant with a regulation.

Compare the controls

Control	Phase	What it does
hipaa-phi-detector	Input, and the response pass	It replaces or blocks text that looks like protected health information (PHI) before the model gets the request.
healthcare-compliance	Output	It blocks an answer that contains a phrase that you list. It also puts a disclaimer before an answer that looks like medical advice.

Replace PHI in requests

The hipaa-phi-detector control finds the base PII identifiers. It also finds names, medical record numbers, health plan IDs, and other HIPAA identifiers.

Inside policy-config.yaml

policy:
  hipaa-phi-detector:
    action: redact

action is the only field. redact replaces each match and continues. block stops the request. With gateway 0.1.26 or later, the gateway also applies these rules to streamed and buffered answers.

Control medical language in answers

The healthcare-compliance control examines the complete model answer:

Inside policy-config.yaml

policy:
  healthcare-compliance:
    blocked_patterns:
      - prescribe
      - increase the dose
      - stop taking
    required_disclaimers:
      - This is not medical advice.

fda_class only selects a built-in disclaimer. It does not classify or approve your product. The control does not examine whether clinical information is correct.

Know the limits

• hipaa-phi-detector is a heuristic text detector. It does not prove HIPAA Safe Harbor de-identification.
• hipaa-phi-detector does not examine images, audio, or other data that is not text.
• healthcare-compliance runs only with stream: false.
• healthcare-compliance matches substrings. For example, prescribe matches I cannot prescribe medication, and treat matches treaty.
• Neither control limits access. Use RBAC for minimum-necessary rules.

Test each control with synthetic data on a test agent before a rollout.

Next steps

• HIPAA PHI Detector: the identifier sets and the output behavior.
• Healthcare Compliance: the advice check and the built-in disclaimers.
• PII Detector: the markers and the base PII rules.