How to Build a HIPAA-Ready AI Product in India

What HIPAA Actually Requires for LLM Applications

HIPAA's Security Rule applies to electronic Protected Health Information (ePHI). For AI applications, ePHI includes: patient names, dates (birth, admission, discharge), geographic data smaller than state, medical record numbers, health plan beneficiary numbers, and any data element that could identify an individual in a healthcare context.

The 4 HIPAA requirements most LLM teams miss:

1. Business Associate Agreements with AI vendors: If your LLM sees PHI, your AI provider is a Business Associate under HIPAA. You must have a signed BAA. Without it, you are in violation the moment PHI touches the API regardless of technical security.

2. Minimum necessary standard: Send only the PHI fields your AI needs for the specific task. If your AI is summarising discharge notes, don't send the full patient record.

3. Access controls for AI outputs: If your AI generates a summary containing PHI, that output has the same access controls as the source PHI role-based access, audit logging, encryption at rest.

4. Breach notification: If PHI is inadvertently sent to an AI system without a BAA, it may constitute a breach requiring notification under HIPAA's Breach Notification Rule.

The HIPAA-Compliant LLM Architecture

Option 1: De-identify before LLM (preferred for most use cases): PHI → PHI de-identification layer (NER + rule-based) → de-identified text → LLM → response → PHI re-identification layer (if needed) → output.

This eliminates the need for a BAA with your LLM provider for the inference step. De-identification must satisfy HIPAA's Expert Determination or Safe Harbor method.

Option 2: HIPAA-compliant cloud LLM: AWS Bedrock with BAA, Azure OpenAI with BAA, or Google Vertex AI with BAA all operate within HIPAA-eligible environments. PHI can be sent to these services under an executed BAA.

Option 3: On-premise/VPC LLM: Self-hosted Llama or Mistral model within your HIPAA-compliant AWS VPC. PHI never leaves your environment. Highest security, highest infrastructure cost.

Shoppeal Tech's standard build uses Option 1 for new clients it's the fastest to implement and requires no LLM vendor negotiation.