CSOAI
Initializing...
Free forever · No credit card
CSOAI
Initializing...
HIPAA + AI Compliance Kit — £999 one-time + £199/mo monitoring (optional)
Generative AI in healthcare must protect PHI, sign BAAs, enforce minimum necessary, and maintain audit trails. We provide the templates, workflows, and attestation to keep your AI legal.
HIPAA risks in healthcare AI
HIPAA Quick Scope
£9one-time
PHI flow checklist and 15-question HIPAA + AI scope test.
Get £9 Quick ScopeHIPAA + AI Kit
£999one-time
BAA templates, de-identification workflow, access controls, audit log spec, and one signed attestation.
Buy — £999Audit-Prep Bundle
£4,950one-time
Kit + 2-day engagement + mock OCR review + 90-day support.
Buy Audit-Prep — £4,950Enterprise
£1,499/month
Continuous PHI monitoring, quarterly BAA refresh, incident response retainers, and unlimited attestations.
Talk sales — £1,499/moBusiness Associate Agreement (BAA) kit
BAA templates and checklists for OpenAI, Anthropic, Google Cloud, AWS Bedrock, Azure OpenAI, and specialty healthcare AI vendors.
PHI minimisation & de-identification
Safe Harbour and Expert Determination workflows, prompt sanitisation, and PHI detection guardrails before any model call.
Access controls & audit logs
Role-based access aligned to workforce clearance, immutable audit logs for every AI interaction, and automatic access reviews.
Breach notification & risk assessment
Breach risk assessment worksheet, 60-day notification timeline tracker, and OCR-style incident documentation templates.
Only if you have a signed Business Associate Agreement (BAA) with the vendor and appropriate safeguards in place. The consumer version of ChatGPT does not offer a BAA and should not be used with PHI. Enterprise/healthcare tiers from some providers do offer BAAs.
HIPAA requires covered entities and business associates to make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose. For AI, this means de-identification, prompt sanitisation, and limiting context windows.
Yes. If the input or output contains PHI, the entire workflow is subject to HIPAA. This includes summarisation, coding, prior-authorisation drafting, and clinical decision support.
A BAA is a contract between a covered entity and a business associate that establishes how PHI will be protected. AI vendors that process PHI on your behalf typically must sign a BAA.
The kit includes a breach risk assessment worksheet, a 60-day notification timeline, and templates for notifying affected individuals, HHS/OCR, and media where required.
Also need EU AI Act compliance for clinical AI?
See EU AI Act for healthcare →MEOK AI Labs · CSOAI LTD · UK Companies House 16939677