HIPAA (Business Associate)

A vendor that processes health data for a provider signs an agreement and inherits real duties. Access limits, encryption and incident support become contract terms with legal weight. This starter supplies the technical measures for AI traffic that such an agreement expects.

Direct liability changed the tone of these projects. The audience here is a vendor engineering team that must satisfy a customer security review and a signed contract at once.

The same health baseline ships with both provider starters, so the technical behavior matches. What differs is the paperwork around it. Your agreement names permitted uses, and every stage of the chain gives you something to point at during a customer audit.

Identifier detection runs twice on a request. Safe harbor categories are masked first, then medical record, patient and member numbers are masked by pattern. Prompts that try to pull a whole patient population are refused before the model is reached.

Generated text that reads as a diagnosis, a prescription or a personal medical conclusion is blocked, and two disclaimers are required. Whatever remains is escalated rather than delivered, so a vendor system never speaks to a clinical question on its own. Your customer receives a recorded escalation in place of assistant text, on every call.

Subcontractor agreements, breach reporting to your customer and encryption at rest stay your obligations. Quality floors of 0.85 combined and 0.90 accuracy apply to answers. Nothing here creates a compliant agreement, and a signed agreement remains the first control.