02. HIPAA Compliance

The Health Insurance Portability and Accountability Act establishes the regulatory floor for PHI handling in the United States. Understanding which provisions matter for AI systems prevents implementation surprises and compliance gaps that surface during audits.

The Privacy Rule restricts how PHI moves between entities. The Security Rule specifies administrative, physical, and technical safeguards for electronic PHI. The Breach Notification Rule mandates response procedures when unauthorized disclosure occurs. For AI systems, the technical safeguard requirements dominate—access control, audit controls, integrity controls, and transmission security all apply to any system processing PHI.

Local LLM deployment addresses transmission security by eliminating external data transmission. Audit controls require logging that captures model inputs and outputs without creating additional PHI exposure. Access control demands standard authentication mechanisms. The interesting gap is integrity controls: a model generating clinical content must produce consistent outputs for identical inputs, which becomes difficult to verify for probabilistic systems.

# audit_logger.py
import logging
from datetime import datetime
from hashlib import sha256
import json

class PHIAuditLogger:
    def __init__(self, log_path="/var/log/healthcare-ai/audit.log"):
        self.log_path = log_path
        self.logger = logging.getLogger("phi_audit")
        
    def log_inference(self, user_id: str, prompt_hash: str, 
                      response_hash: str, model_id: str, 
                      timestamp: datetime = None):
        """Log inference without storing actual PHI content."""
        entry = {
            "timestamp": (timestamp or datetime.utcnow()).isoformat(),
            "user_id": self._hash_identifier(user_id),
            "prompt_fingerprint": prompt_hash,
            "response_fingerprint": response_hash,
            "model": model_id,
            "action": "inference_completed"
        }
        self.logger.info(json.dumps(entry))
    
    def _hash_identifier(self, identifier: str) -> str:
        """Create irreversible identifier for audit trails."""
        return sha256(identifier.encode()).hexdigest()[:16]
    
    def generate_audit_report(self, start_date: datetime, 
                              end_date: datetime) -> list:
        """Generate compliance audit trail for date range."""
        # Implementation reads and filters log entries
        pass

A common failure mode: teams log model inputs and outputs for debugging, then discover those logs contain PHI. The audit logger above demonstrates correct pattern—hash prompt content for traceability without retaining the actual data.

Business Associate Agreements (BAAs) become simpler for purely local deployments. Cloud AI services require BAAs with the vendor, creating shared liability. Self-hosted models eliminate that requirement, though internal compliance documentation must demonstrate equivalent protections.