HIPAA-compliant AI

• Minimum necessary use — HIPAA requires you to disclose only the minimum PHI needed for the task. Tokenization is the most aggressive minimum-necessary posture: zero PHI is disclosed.

• Business Associate Agreements — Any third party that touches PHI needs a BAA. With Cypherz, the LLM provider never touches PHI — only your infrastructure does. (We sign BAAs at Business and Enterprise tiers.)

• Audit controls — 164.312(b) requires audit trails for PHI access. Cypherz logs every tokenize, detokenize, and proxy call with structured metadata.

• Access controls — Per-project encryption keys and API keys enforce role-based access. No global plaintext access path.

• Detectors tuned for PHI — Patient names, SSNs, dates of birth, medical record numbers via custom regex, addresses, phone numbers, insurance IDs.

• Custom dictionaries for clinical terms — Paste your patient roster or facility list; Cypherz tokenizes those terms on sight.

• Encrypted file pipeline — Upload clinical notes (DOCX), lab reports (PDF), or scanned charts (image OCR). Files are AES-256-GCM encrypted at rest with per-project keys.

• Self-host option — If your compliance posture requires on-prem, `docker-compose up` in your VPC — same binaries, same tokenizer, no data leaves your network.

Cypherz provides infrastructure that helps you implement HIPAA controls. It is not, by itself, a HIPAA compliance certification. Work with your compliance officer or counsel to confirm your end-to-end posture.