+What it protects
- Clinical PHI retrieval and redaction
- Patient communication and scheduling
- Clinical guidance and life-sciences research workflows
+Where we are
Clinical PHI and patient-workflow safeguards are available in preview with HIPAA-aligned control mappings.
+The risk
What goes wrong without a decision layer
The outcomes this solution is built to prevent.
Risk 01
Clinical PHI disclosure
Risk 02
Unsafe clinical or patient guidance
Risk 03
Unauthorized patient-facing action
+In practice
Two requests, two decisions
Illustrative examples of how the layer decides. Real decisions depend on your policy and context.
Intake assistant
BLOCK“Email the full chart for this patient to my personal address.”
Patient record to an external destination outside the care workflow.
Scheduling agent
PASS“Find the next free cardiology slot for this referral.”
Scheduling data only; no clinical record leaves the system.
+The controls
How Intertrace handles it
+Controls applied
- Clinical PHI detection and safe transformation
- Clinical action policy and human review
- Correlated HIPAA-aligned audit evidence
+What we test
- Clinical identifier redaction beyond generic PII
- Unsafe guidance escalation
- Legitimate patient workflow preservation
+Start from
Policy packs
Deterministic starting policy you can tune per agent. A pack is an input to your policy, not proof of readiness.
Healthcare - HIPAA
strictBlocks PHI-bearing tool payloads and requires run correlation for patient-facing or clinical workflows.
Regulated - assurance
regulatedBlock-mode tool policy for high-severity hits; require run correlation; schedule baseline probes.
+For reviewers
Evidence mapped to your frameworks
HIPAA Security Rule
Aligned controls
45 CFR 164.308 · 45 CFR 164.312
HIPAA alignment is not an accreditation or government-granted status.
NIST AI RMF
Evidence mapped to
MAP · MEASURE · MANAGE
This is a technical framework mapping.
Framework references are mappings or aligned-control notes. They are not independent assessments, attestations, certifications, or government authorizations unless separate scoped evidence says so.
+Honest scope
What you still own
- Clinical PHI evaluation coverage must be expanded from validated customer workflows.
- A BAA and organizational safeguards apply only to their documented parties and scope.
- Deployment: A customer-representative clinical boundary with approved data destinations
+Other industries
+ The AI watching your AI
Map this to your healthcare and life sciences agents.
Bring one workflow. We'll show you what the layer decides on it, and what evidence it leaves.