How we handle sensitive and health data
If your business touches protected health information, every vendor you let near it becomes your problem. This page says plainly what we do with sensitive data, what we refuse to do, and what we expect from the services we build on. It is written so you can hand it to your compliance officer or your counsel.
The one rule everything else follows from
Protected health information stays in your environment. We build inside systems you control, under agreements you hold, with access you can revoke. We do not copy PHI into our own tools, our own accounts, or a convenient sandbox. When a piece of work can be done without PHI at all, that is how we do it.
On the words we use. There is no official HIPAA certification, and the Department of Health and Human Services does not recognize one. So we do not claim it. What we build is built to support your HIPAA obligations: the technical and administrative safeguards the Security Rule asks for are part of the design, and the evidence that they exist is something you can show an auditor.
The controls, in plain terms.
These are defaults on every engagement that involves sensitive data, not options you have to ask for.
Data stays in your environment
PHI lives in your cloud accounts and your systems. We work inside them with named, revocable access. Nothing is exported to ours.
Only BAA-covered AI and cloud services
When PHI is involved, every AI model and every cloud service in the path is covered under a Business Associate Agreement and configured so your data is not retained for training.
Encryption in transit and at rest
Data is encrypted on the wire and on disk, using the platform's managed encryption so keys are handled properly rather than by hand.
Access controls
Access is scoped to role and to need. Administrative access requires multi-factor authentication. Credentials are never shared, never in source code, and rotated when someone leaves the project.
Audit logging
The system records who accessed or changed what, and when. Logs are kept where they cannot be quietly edited, and they are readable by your team, not just ours.
Synthetic data for demos and development
We build, test, and demonstrate with realistic generated data. Real patients never appear in a test environment, a screenshot, or a sales call.
Minimum necessary
AI features see the fields they need and nothing more. Where a feature can run on de-identified data, it does.
Documentation you can hand to an auditor
Data flow diagrams, a list of every service that touches PHI, and the agreements that cover each one. Kept current as the system changes.
What this means for AI specifically
AI adds one new kind of vendor to your picture: the company whose model reads the data. The same rules apply to it as to any other business associate, and a few deserve emphasis.
- A BAA, or no PHI. If a model provider will not sign a Business Associate Agreement that covers the service we are using, PHI does not go to it. Consumer chat apps and free tiers never qualify.
- No training on your data. The services we use are configured so prompts and outputs are not used to train models, and retention is as short as the provider allows.
- Where the data goes is written down. Which model, hosted where, under which agreement, with what retention. If that changes, the document changes first.
- Regulatory status is checked early. If an AI feature could make your product a regulated medical device, we raise it before building and bring in your regulatory counsel. We do not give regulatory or legal advice.
For a longer, vendor-neutral version of this, written for the person at a small healthcare company who has to evaluate AI vendors, read our guide: HIPAA and AI: what a small healthcare company should expect from its AI vendor.
Business Associate Agreements
We sign BAAs. When an engagement involves PHI, Skye Road Systems signs a Business Associate Agreement as your business associate, and every AI or cloud service we put PHI through must be covered by one as well.
What we ask of you
Security is shared. The controls above cover what we build and how we work. Your side includes keeping your own policies, training, and risk analysis current, managing who on your team has access, and telling us promptly when someone leaves or a vendor changes. We will tell you plainly when something you ask for would weaken the design, and we will propose the version that does not.
Outside healthcare
Most of this applies to any sensitive data: customer records, financials, pricing, contracts. The habits are the same whether the regulation is HIPAA, a customer contract, or your own good judgment. Our privacy policy covers what this website itself collects.
Common questions about health data.
Is there such a thing as HIPAA certification?
Which AI services do you use when PHI is involved?
Do you use real patient data in demos or development?
Where this fits.
See what we build for healthcare and medical device companies, read the case studies, or start with the AI Opportunity Assessment to find where AI pays off without putting data at risk.
Have a compliance question before you have a project?
Ask it. Our AI can answer the common ones right now, and anything it cannot answer goes to a person who can.