Anchor the program in the rule in force
The current Security Rule sets national standards for electronic protected health information held or transmitted by covered entities and business associates. HHS describes administrative, physical, and technical safeguards for confidentiality, integrity, and availability. Its current summary emphasizes accurate risk analysis, risk management, assigned security responsibility, access management, and periodic evaluation.
Track the proposal without converting it into a promise
HHS issued the proposed update in December 2024 to strengthen cybersecurity protections. Proposed controls can inform forward-looking design, but procurement material, policies, and customer statements should label them as proposed until the rulemaking produces a final rule. Maintain a requirements register that records source, status, owner, implementation evidence, and review date.
Treat connected AI as another ePHI path
If an AI assistant, retrieval pipeline, or support workflow handles ePHI, map where that information is created, received, maintained, and transmitted. Minimize unnecessary fields, authorize access for the specific role and purpose, retain useful security events without copying ePHI into logs, and test what happens when a provider or policy dependency fails.
Keep the product boundary exact
On integrated routes, Securelay can de-identify configured sensitive values before configured AI connections, enforce configured access decisions, and record value-free evidence. It does not make an organization HIPAA compliant, replace a risk analysis, control unintegrated routes, or substitute for legal and clinical governance.