2.4 · Our Approach
AI Provider Standards
The AI engine in this platform is the highest-exposure single component. When a clinic uploads a document for analysis, the full content of that document is sent to the model. If that path is not covered by a Business Associate Agreement, we have a HIPAA violation regardless of how well-secured every other part of the system is. This page walks the landscape of AI providers and explains the choice we made.
How AI providers handle Business Associate Agreements
Every AI provider falls into one of three categories. The first column is the category, the second is the rule, and the third is which providers sit there.
| Category | Rule | Who sits here |
|---|---|---|
| Business Associate Agreement available standard | HIPAA-eligible by default. Route Protected Health Information once the agreement is signed. | AWS Bedrock, Azure OpenAI Service, Google Vertex AI |
| Business Associate Agreement available at higher tier | Offered only on enterprise pricing or through a sales-mediated contract. Standard developer accounts are not eligible. | Anthropic direct API, OpenAI direct API |
| No Business Associate Agreement available | Off-limits for any regulated workload, regardless of how the tool is used. | Consumer AI tools, unofficial integrations |
The provider landscape side by side
The same five providers, compared on the things that actually matter for our decision.
| Provider | Business Associate Agreement | Underlying model | Fits our stack | Why we did or did not choose it |
|---|---|---|---|---|
| AWS Bedrock | Yes, standard | Anthropic Claude (and others) hosted inside AWS | Yes | Our chosen path. Same agreement that covers the rest of our infrastructure. No additional vendor. |
| Anthropic direct API | Enterprise tier only | Claude | Adds a vendor | Bedrock gives us the same Claude models without a second vendor relationship. |
| Azure OpenAI Service | Yes, standard | OpenAI GPT family | No | Mature for Microsoft-shop healthcare. Wrong fit because we are not on Azure. |
| Google Vertex AI | Yes, on listed services | Gemini and partner models | No | Comparable to Azure OpenAI. Wrong fit because we are not on Google Cloud. |
| OpenAI direct API | Enterprise tier only | GPT family | No | Standard developer tier has no agreement, so Protected Health Information is off-limits. |
| Vercel AI Gateway and similar routers | Depends on underlying provider | Pass-through | Convenience layer | A router can be covered, but the underlying model still has to be covered. Adding a router is convenience, not compliance. |
Settings that matter once an agreement is in place
A signed Business Associate Agreement is necessary but not sufficient. The AI integration also has to be configured correctly. Every AI call that may touch Protected Health Information has to clear the five settings below.
| Setting | What it requires |
|---|---|
| Zero data retention | The provider does not store our inputs after the request completes and does not use them for training. This is part of the agreement terms with Bedrock and similar services. |
| Logging scope | No prompt logging at the provider, or logging that sits inside the same agreement scope as the requests themselves. |
| Region pinning | Requests stay in U.S. regions that are explicitly covered by the agreement. Failover to non-covered regions is disabled. |
| Minimum necessary | Send only the data required to answer the question. This is a HIPAA principle, not a technical convenience. |
| Audit trail | Every AI request that touches Protected Health Information is logged in our own audit table: who triggered it, what record it pertained to, when, and what came back. |
The current state of our AI path
Today, the AI extraction inside the platform routes through OpenAI gpt-4o-mini via Vercel AI Gateway. That path is not covered by a Business Associate Agreement at our current tier and must not see Protected Health Information. Until the AWS Bedrock integration is in place, the AI features are restricted to business operations content (clinic profiles, policy text, internal team notes) and explicitly prohibited from any data that identifies a learner.
The migration to Bedrock is on the Action Items page as the prerequisite for moving Protected Health Information through the AI layer.