Tag: hipaa
Design patterns for healthcare AI on Claude
A signed BAA makes a Claude healthcare workflow legal, not safe. The engineering work is keeping protected health information away from the model. Three design patterns do most of that: de-identify before the model, keep PHI local, and log what the model saw.
The BAA for Claude Code is narrower than it looks
Is there a BAA for Claude Code? Yes, but the coverage is narrow. A BAA can cover the Claude Code CLI, but only with Zero Data Retention enabled, and the self-serve Enterprise HIPAA toggle does not include it. What is covered, what is not, and why.
SOC 2 and HIPAA overlap for SaaS companies
If you already have SOC 2 Type 2, you have done roughly 60-70% of the work needed for HIPAA compliance. The overlap in access controls, encryption, audit logging, and incident response is large. Here is where the frameworks share ground and what HIPAA adds that SOC 2 does not address.