Skip to main content
Start healthcare prototypes with wholly synthetic data. Before introducing patient information, have the responsible legal, privacy, security, and clinical reviewers assess the intended task and every service involved.
This guide does not establish Threetone’s suitability for HIPAA-regulated data or provide a business associate agreement. Confirm the supported service scope and required executed agreements with Threetone before sending protected health information. A plan name, configuration setting, or provider relationship does not establish that approval.

​
Determine the parties and data

For a U.S. HIPAA review, determine whether the organization is a covered entity or business associate and whether the proposed workflow involves protected health information (PHI). HHS explains that business associate status depends on the function performed and the information handled, including services provided through AI systems. See HHS business associate guidance. Map the actual information in audio, transcripts, prompts, knowledge documents, tool requests, logs, and exports. A workflow described as scheduling or administration still needs this assessment; its label does not establish the classification of its data.

​
Confirm agreements and service scope

HHS explains that a cloud service handling electronic PHI on behalf of a covered entity or business associate can itself be a business associate, including when it cannot decrypt the information. Its guidance addresses the business associate agreement and responsibilities for the services involved. See HHS guidance on HIPAA and cloud computing. For the proposed workflow, record which party contracts with each service and how any required downstream agreements are handled. Check the actual scope: environments, storage, model and speech processing, connected tools, support access, and permitted data use. Do not infer that an agreement for one service covers every connected service.

​
Prepare the deployment review

1

Bound the task

Describe the intended administrative or clinical task, expected users, data categories, and excluded actions. For a clinical workflow, obtain a separate clinical safety review and define who handles situations outside the approved task.
2

Trace each data path

Identify where data enters, which services process it, where copies remain, and who can access them. Include troubleshooting logs and exports rather than reviewing only the conversation screen.
3

Evaluate safeguards

Review authentication, authorization, audit evidence, transmission and storage protection, recovery, and incident handling. Obtain evidence for the intended environment instead of treating a prompt or interface label as a safeguard.
4

Resolve retention and deletion

Identify the applicable recordkeeping requirements and the systems responsible for retaining or deleting each copy. Confirm what the actual controls do before describing a retention field as an enforced policy.
5

Record the release decision

Keep the agreements, assessment, control evidence, unresolved issues, and responsible reviewers together. Do not introduce PHI while required agreements or service suitability remain unresolved. Confirm runtime availability separately before an operational pilot.
For regulated entities, the HIPAA Security Rule addresses safeguards and risk analysis; a contract alone does not complete that work. Use the HHS Security Rule summary with the responsible reviewers to determine the applicable requirements. Review access and credentials, stored conversation inspection, and current execution availability when collecting technical evidence. These product guides describe configuration and inspection, not healthcare approval.

​
Frequently asked questions

Do not assume one is included. Confirm whether the proposed service is supported and whether the required agreement has been executed with the correct parties and scope before using PHI.
No. HHS cloud guidance addresses business associate responsibilities even for encrypted data that the service cannot read. Review the agreements, data flows, and safeguards together.
Use synthetic examples while the service scope is unresolved. For an approved workflow, follow its authorized support and data-handling process rather than sending patient information through an unreviewed channel.