HIPAA and AI tools
What the Privacy and Security Rules have to say about a prompt box: when a paste is a disclosure, why stripping the name is not de-identification, and which of the eighteen identifier categories survive it.
Read the guideWhat we solve
Where a patient record actually goes
The prompt box is the one everybody worries about. Email, removable drives and the folders that sync a laptop to a personal cloud carry the same records out, and none of those three passes a web proxy.
-
Email
- Outlook
- Gmail
Discharge summaries, referrals and prior-authorisation packets, going wherever autocomplete put them.
Itzal Mail reads the message and its attachments inside Outlook and Gmail, before the send leaves the client.
-
AI tools
- ChatGPT
- Claude
- Gemini
- Copilot
A note pasted in whole, because summarising it is the job and the note is the input.
Itzal Guard reads the composer, and the file attached to it, on the clinician’s own device.
-
Drives and sync folders
- Drive
- Dropbox
- OneDrive
- USB
A census exported from the EHR, then uploaded somewhere, synced somewhere, or copied onto a stick.
Itzal Shield applies one policy to uploads, to USB and to the folders that mirror a laptop.
The record
Whichever of the three stops it, your console is handed the same thing: which identifiers fired, which framework they mapped to, where it was going, and whether that device was covered at the time, with no readable patient data anywhere in it.
- Guard
- Shield
Worked example
What a summarisation prompt takes with it
A discharge note goes into an AI tool because summarising it is the job and the note is the input. Itzal checks the text on the device, in the instant before it is sent.
If it finds PHI it warns the clinician or blocks the send, and your security team gets a record saying which Safe Harbor identifiers were present. The note itself never goes anywhere.
Illustration. The data shown is invented.
Why the context rule matters
Removing the name does not de-identify a note
Three of the eighteen Safe Harbor identifiers are present in the line below, and every one of them would survive a find-and-replace on the patient’s name. Staff who believe they de-identified a note usually have not.
62-year-old male, admitted 3 March, MRN 4471102, resident of Bellevue, presenting with…
A date more specific than year, a medical record number, and a geographic subdivision below state level. Invented data.
The eighteen Safe Harbor identifiers
- Names
- Geography below state
- Dates except year
- Phone
- Fax
- SSN
- Medical record number
- Health plan beneficiary number
- Account numbers
- Certificate & licence numbers
- Vehicle identifiers
- Device identifiers & serials
- URLs
- IP addresses
- Biometric identifiers
- Full-face photographs
- Any other unique code
Compliance
Built for the frameworks you answer to
The three above come on the day you pick the healthcare template. The rest are a licence away, and every one of them reads the same text on the same device.
-
HIPAA
Fires when a Safe Harbor identifier and a health context term appear together, so a staff directory does not read as PHI.
-
GDPR
Health data is a special category, so an EU patient record carries a lawful-basis question a US one does not.
-
PCI DSS
Cardholder data in patient billing and payment threads, where the card number arrives beside the chart.
-
See it on your own policy
Forty-five minutes with an engineer, against the frameworks you actually answer to.
Book a demo
Also licensed, and off until you ask for them
- State privacy CCPA and CPRA
- GLBA The payer side of a health system
- FERPA Academic medical centres
- Your own rules Codenames and your own entity types
A framework here is a detector set and an action, not a certificate. What it finds, and what it does when it finds it, is yours to set per department.
Getting started
You can be covered by this afternoon
One installer, one browser policy per browser family, and the MDM you already run. No appliance, no proxy, and no certificate to distribute.
-
Hour 0
Sign in, pick HIPAA
The industry template sets your starting policy. Nothing has touched a device yet.
-
Hour 1
Push one installer
One signed package per platform, carrying the detection model, so there is nothing else to stage.
-
Hour 2
Add the browser policy
One per browser family. Chrome, Edge and Firefox each need their own, and this is the step rollouts get wrong.
-
Hour 3
Read coverage, not installs
The console shows whether the composer actually bound on each site. A clean install that never binds looks identical from the installer’s side.
-
Same day
Findings start arriving
You can see what is being sent, and to where, before anything warns or blocks.
Those hours are a pilot group, not a fleet. And nothing is warned or blocked until you say so: enforcement waits on a measurement of false positives against your own clinical language, which takes weeks rather than hours. The staged rollout.
Straight answers
The questions a privacy review always asks
They are answered here rather than saved for a call, including the ones where the honest answer is that it depends on your counsel.
Does Itzal itself need a BAA?
Itzal’s servers never receive PHI, because detection and redaction happen on the device. Many healthcare customers still execute a BAA as a matter of policy, and that is straightforward, but the architecture is designed so that a breach of Itzal’s infrastructure could not expose PHI.
Will it flag every phone number in the organisation as PHI?
No. HIPAA severity fires only when an identifier co-occurs with health context terms, and that term list is editable per organisation. Without it, a hospital’s own directory would generate constant false positives.
Can clinicians still use AI tools?
Yes, that is the intended outcome. Sanction a tool under a BAA, then use policy to make the sanctioned destination the path of least resistance while blocking PHI to everything else.
Does Itzal see the message itself?
No. The check runs in a small program on the device, and the raw text is never transmitted, stored off the device, or written to a log. Your console receives finding types, frameworks and the action taken.
How long does deployment take?
One installer, pushed by your existing MDM. There is no appliance, no proxy and no certificate to distribute, and turning on another product later is a licence change rather than a second rollout.
What does Itzal not see?
Plenty, and we publish it rather than wait to be asked. Coverage is reported per surface and the uncovered ones are named. Surface coverage.
Can people still use AI tools after this is installed?
Yes, and that is the point. Banning them moves the work to a phone you cannot see. Itzal checks what is about to be sent and only intervenes when a rule you set says it should.
What happens when a detection is wrong?
You set the thresholds, and any rule can log rather than block while you tune it. Name detection is measured at 0.959 precision on our corpus, and the figure is published rather than claimed.
Read next
The HIPAA guide, and the report it produces
One explains what counts as protected health information once it is inside a prompt. The other is what your compliance team is handed afterwards.
The HIPAA view in the console
Findings by team, department and framework over time, with case management, a per-framework policy editor and coverage health per device, built on records that contain no raw employee content.
See what it reports