⬡ The Compliance-Ready AI Stack Series · Issue 4 of 5 · Healthcare

RISK 1 · PHI in General AI Tools

This is the most common and most immediate risk. An employee at a hospital pasting patient notes into an unapproved AI tool has just created a HIPAA violation, regardless of their intent. Intent doesn't matter. The violation is the disclosure to a non-BAA-covered entity — not the outcome.

The two categories of information that never go into any general AI tool: Protected Health Information (patient names, dates of service, diagnoses, treatment details, insurance information) and Individually Identifiable Health Information (anything that could be linked to a specific patient). Not summarized. Not "anonymized" by removing the name. Not processed with "just the clinical question." Any PHI in any form.

The rule: PHI only enters AI tools that operate under a signed Business Associate Agreement and have demonstrated HIPAA-eligible infrastructure. Airia enforces this automatically. A policy that relies on staff remembering to do it does not.

RISK 2 · Clinical AI and FDA Software as a Medical Device

AI tools that assist with diagnosis, treatment recommendations, or clinical decision-making may qualify as Software as a Medical Device under FDA guidance — requiring 510(k) clearance or equivalent before clinical use. The line between "administrative AI" (scheduling, documentation, billing) and "clinical AI" (diagnosis support, treatment recommendations) is the line that determines FDA jurisdiction.

Most practices using AI for scheduling, patient intake, and administrative workflows are firmly in the administrative category. The moment the tool begins influencing clinical decisions — flagging potential diagnoses, suggesting treatment modifications, generating clinical summaries that inform care decisions — FDA review is in scope.

The rule: Maintain a clear documented distinction between administrative AI and clinical AI in your practice. The stack in today's issue covers administrative workflows only.

RISK 3 · Patient Consent and AI Transparency

CMS requires informed consent when AI influences clinical decisions. Multiple states are moving toward patient disclosure requirements for AI use in healthcare settings broadly. The standard is shifting: patients have a right to know when an AI tool contributed to decisions about their care.

The rule: Build patient disclosure language into your intake workflow now, before your state requires it. Early disclosure builds patient trust. Retroactive disclosure after a regulation takes effect looks like you were hiding something.

RISK 4 · Data Residency and Third-Party Vendor Risk

Healthcare organizations subject to HIPAA must know where their data is processed and stored — including the data that flows through every AI tool their staff uses. Tools built on models hosted in different countries have different legal and regulatory implications, and for industries subject to data residency requirements, this requirement isn't optional.

The rule: Every AI tool in your stack must have a documented data residency policy confirming US-based processing and storage, or equivalent protections mapped to your HIPAA compliance requirements.

⬡ Jordan · AI Solutions Director · thepromptory.com

Free · No account required · No sales call after

In healthcare, Airia does something that policy alone cannot: it enforces which data types can flow to which AI models, in real time, automatically. When a staff member attempts to send information that includes PHI to a non-BAA-covered model, Airia blocks it before it leaves. The audit trail it generates becomes the compliance documentation HHS investigators request when examining a potential HIPAA violation. You're not hoping staff remember the policy — you're enforcing it technically.

Covers: Real-time PHI blocking · HIPAA-eligible infrastructure · HHS audit trail generation · BAA-compliant model routing

Tidio handles administrative intake — appointment scheduling, FAQ responses, pre-visit logistics — with configurable data retention and deletion policies that align with HIPAA's minimum necessary standard. The critical architectural point: Tidio is for administrative information at the front end, not clinical information. Name, contact details, appointment type, and insurance verification. Not reason for visit, not symptoms, not clinical history. That data boundary is what keeps administrative AI in the administrative category.

Covers: GDPR + CCPA compliance · Configurable data retention · Administrative data only · No clinical information

Provider burnout is the healthcare workforce crisis running parallel to the AI adoption conversation. Reclaim protects the administrative and documentation time that AI creates space for — automatically blocking it on the calendar before meetings can absorb it. The data architecture is calendar metadata only: no clinical information, no patient data, no PHI-adjacent processing. SOC 2 Type II certified, GDPR compliant.

Covers: Calendar metadata only · No PHI contact · SOC 2 Type II certified · GDPR compliant

Healthcare providers and administrators receive patient communications that often contain PHI. SaneBox's metadata-only processing model means it never reads the content of those emails — it learns from sender priority signals only. This architectural distinction is what makes it appropriate for healthcare email triage: it delivers the productivity benefit without creating a PHI exposure from email content processing.

Covers: Zero email content processing · PHI in email stays unprocessed · Metadata-only priority signals

Making the business case for AI in a healthcare practice requires the before-and-after data. Toggl tracks actual administrative time by task category — intake processing, scheduling, documentation, billing — so when AI reduces that time, you have the evidence to quantify the gain. That data also informs staffing decisions, workflow redesign, and the ROI case for expanding the governance stack as the practice grows.

Covers: Administrative time capture only · No PHI logging · ROI documentation

⬡ The Absolute Rule for Healthcare AI

Patient case notes, PHI, clinical information, diagnosis history, treatment details, insurance data, and any individually identifiable health information never enter any AI tool that hasn't signed a Business Associate Agreement.

This applies to every physician, every nurse, every administrator, every biller, every front desk staff member. It applies when someone is in a hurry. It applies when the alternative seems faster. It applies at 8pm when someone is finishing documentation at home.

The technical enforcement layer — Airia — exists precisely because human memory and good intentions are not compliance infrastructure. Build the control. Enforce it automatically. Document that it's running.

📬 Tomorrow — Series Finale

Friday: The 6-Step Compliance-Ready AI Stack Framework — the universal methodology behind everything built in this series, adapted for any professional services firm, with the documentation templates your firm can publish as its own AI governance starting point. This is the issue you'll want to save and share.

Want a HIPAA-aware AI governance assessment for your practice? Jordan walks through it free → thepromptory.com