HIPAA (Covered Entity)

A provider, a health plan or a clearinghouse answers for every use of patient data. Minimum necessary use, access limits and transmission security are the daily tests. This starter applies those tests to AI traffic and leaves the administrative program to you.

Minimum necessary is the rule that makes AI traffic difficult. A prompt tends to carry more context than the task needs, and a model has no reason to refuse it. The stages below reduce what travels instead of trusting the author of the prompt.

Two redaction stages run before the model is called. The first works through the eighteen identifier categories under the safe harbor method. The second adds health record heuristics for medical record numbers, patient identifiers and member policy numbers. A role claim is required with the user and organization claims, so access follows a job rather than a person.

Bulk requests are refused by name. A prompt that asks to export all patients, download a patient database or list all records does not reach the model.

On the return path a health filter blocks output that states a diagnosis, prescribes, or tells a patient what they likely have. Two disclaimers keep the answer inside an informational role. A clinician then holds the final step, because the gateway hands over every response and returns no text to the caller. Diagnosis and treatment questions need that staffing, and so does a routine question about a benefit.

Combined quality must reach 0.85 and accuracy must reach 0.90 before an answer is delivered. Workforce training, facility access and breach notice timing remain organizational duties. Use the service provider starter when you handle this data for another organization.