How to Standardize AI Across Health System Departments Without PHI Leaving the Firewall

Standardization is a policy problem, not a tool problem

Departments in a health system adopt AI on their own schedules. Clinical operations may use a documentation assistant, revenue cycle an agent that works claims, research a set of hosted and self-hosted models, and IT a coding assistant. Each choice is reasonable locally. Together they produce different PHI handling rules, uneven access controls, and audit evidence scattered across products.

Consolidating onto one tool rarely holds, because departmental needs differ and the model landscape keeps changing. A more durable approach is to standardize what must stay constant: the rules for handling PHI, the access rights granted to people and software, and the evidence produced. Those requirements are the same whichever model or agent is in use.

The constraint is that PHI must not leave the firewall. Routing traffic to an external service so it can be governed centrally would move the very data you are protecting. Enforcement therefore has to come to the data, and run inside your own boundary.

PHI exposure paths and the action that addresses each

PHI can move through more than the prompt. The table is a design analysis of common paths in departmental AI use and the enforcement action that fits each. Your own risk assessment should confirm which paths exist in your environment and which actions you require.

• Prompts: Identifiers pasted or retrieved into a request. Redact or block before the request reaches the model, according to the model's approved PHI scope.
• Model responses: Output that echoes or reconstructs PHI. Redact or block before the response reaches the user or a downstream system.
• Tool calls: An agent passes PHI as an argument or retrieves records. Allow only entitled tools and data, block the rest, and escalate sensitive actions for human approval.
• MCP server access: Agents reach data through connected servers. Allow approved servers per agent, and rate limit bulk retrieval.
• Coding assistants: PHI in source, test data, or pasted logs. Block PHI in context sent to the model and rate limit unusual volume.
• Departmental exceptions: A team needs broader handling for a defined purpose. Grant a scoped, time-bound exception and record its use.

What audit-ready evidence must contain for HIPAA

As of November 2026, 45 CFR 164.312 requires technical safeguards for ePHI. The access control standard allows access only to persons or software programs that have been granted access rights. The audit controls standard, 164.312(b), requires hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI. The text does not name a tool, a log format, or a storage location, and it does not exempt a system because the technology is new.

Treating AI agents and MCP-connected tools as software programs under access control, and mapping runtime enforcement records to 164.312(b), is an interpretation your compliance and security teams should validate. A practical record for each interaction includes the requesting user or agent, the department, the target model or tool, the policy version applied, the action taken (allow, redact, or block), and a timestamp. It should also show whether PHI was detected and handled.

Evidence that is produced by enforcement at the moment of the decision is more reliable than evidence reconstructed from application logs later, because it shows what the system was allowed to do and what it did. Retention periods are not set by the safeguard text, so define them in your own policy and configure them in the evidence store.

Rollout sequence for architects

Start with the inventory, because standardization cannot cover tools nobody has listed. Introduce enforcement in a mode that matches your risk tolerance, then tighten as departments confirm their policy scope.

Governance should run alongside the technical work. ONC SAFER guidance describes AI safety as shared among AI developers, EHR vendors, and healthcare organizations, and says organizations need policies and procedures before using AI-enabled systems in patient care. ONC's HTI-1 rule covers predictive decision support in certified health IT such as EHRs, so confirm whether it applies to each tool in your inventory.

• Inventory AI tools, agents, and assistants by department and map each to ePHI access rights.
• Run a documented risk assessment before each new AI tool or agent goes live.
• Define one baseline policy and a process for approving and recording departmental exceptions.
• Place enforcement in the execution path and route each department's traffic through it.
• Set the audit record content, retention, and review process for each AI system.
• Test access and enforcement controls on a schedule and after operational change.