A clause-level mapping of the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule to a private AI platform deployed inside a healthcare provider's own Azure environment, under the provider's Microsoft BAA.
Healthcare providers are in a three-way bind on AI.
Consumer tools (ChatGPT, Copilot in its consumer mode, Gemini, Claude) become a reportable disclosure the moment a clinician pastes a patient note. “AI-enabled” SaaS layers your BAA across vendors who don't always extend it to the inference layer. And shadow AI is already happening. The CISOs we talk to know it, can't measure it, and have no audit log to show OCR.
This paper documents the architecture nBrain deploys for healthcare providers, mapped clause by clause. The same architecture runs for Regal Technology Partners, a Tier 2 defense manufacturer, under ITAR and CMMC rules, which are stricter on audit and isolation than HIPAA.
The pattern: private AI inference inside your own Azure subscription, covered by your existing Microsoft BAA; the Brain's data stays in your environment; no training on your data; and tamper-evident audit logging that produces the records OCR asks for. It adds three control surfaces (gateway, vector database, inference endpoint). None of them widen the PHI boundary or weaken a control already in place.
Every component that touches PHI runs in a HIPAA-eligible region of your own subscription. nBrain personnel reach it only with credentials you grant.
01 · Identity
Clinician signs inEntra ID, MFA, Conditional Access, device compliance02 · Gateway
Role and purpose checkTreatment, payment, or operations code; DLP scan03 · Retrieval
Vector databaseReturns only documents the user may see; AES-256, your keys04 · Inference
Azure OpenAIPrivate endpoint; GPT-6 Astra deployment; no training05 · Audit
Microsoft Sentinel or your SIEMAppend-only, signed with a per-tenant key in Key Vault; 90 days hot, at least six years archived06 · Detection
Defender for CloudRules for unusual volume, out-of-role retrieval, prompt injection07 · Your SOC
Existing incident workflowAlerts route to the team that already handles themNetwork rules deny outbound traffic to the public internet. The only egress allowed is to documented Microsoft service endpoints inside your BAA scope. PHI never goes through nBrain's own portal or email.
If both are answered with documented evidence, the rest of the mapping supports them. If either fails, the rest doesn't matter.
Most “AI for healthcare” SaaS fails this test. The vendor licenses inference from a third party, often the same Azure OpenAI endpoint you could call directly, without putting you in privity with that provider. Your BAA with the vendor doesn't reach the model call. When OCR asks to see the BAA covering the model, the chain breaks at the inference layer.
Here, inference runs in your own Azure subscription, under your existing Microsoft BAA. You are in direct privity with Microsoft for the inference call. nBrain, which builds and supports the system, signs its own BAA with you.
You need to answer on demand: show every PHI document retrieved for this query, who asked, when, and what the model returned. The log has to resist tampering, be kept at least six years to line up with §164.530(j)(2), and be readable by a person.
The platform writes a signed log entry for every prompt, retrieval, model call, and administrative action to Microsoft Sentinel or your SIEM. The schema is in section 07.
If your Azure environment is HIPAA-aligned, the AI capability described here inherits that posture. It doesn't widen the PHI boundary, and it doesn't create a new logging gap.
Every provider picks one of three patterns. Each carries a different HIPAA posture and audit burden.
| Dimension | Private AI (this paper) | Consumer AI (ChatGPT, Copilot, and similar) | AI-enabled SaaS |
|---|---|---|---|
| BAA covers the inference call | Yes. Directly between you and Microsoft | No | Sometimes. Varies by vendor |
| Where PHI flows | Your Azure subscription only | The vendor's commercial cloud | The vendor's cloud, then back |
| Model trains on PHI | No. Committed in Microsoft's data protection terms | Possibly. Read the EULA | Depends on the vendor |
| Audit log under your control | Yes. Written to your SIEM | No. Vendor-side only | Partial. Exported on request |
| Data residency | US Azure regions you choose | Set by the vendor, often global | Set by the vendor |
| Workforce pasting PHI into AI | Replaced by a sanctioned tool | An active reportable disclosure | Reduced, not eliminated |
The Privacy Rule (45 CFR §§164.500–534) governs how covered entities and business associates use and disclose PHI. These are the sections an AI deployment touches most.
| Section | Requirement | How the architecture meets it | Owner |
|---|---|---|---|
| §164.502(a) | Use or disclose PHI only as the Privacy Rule permits. | PHI is retrieved only for an authenticated query from an authorized workforce member acting in a treatment, payment, or operations role. Each query is gated by Entra ID, Conditional Access, and a role check; the model call is a stateless API under your BAA. | nBrain |
| §164.502(b) | Minimum necessary: limit PHI to what is reasonably needed. | Enforced at three layers: Entra group membership controls tenant access; role-based filtering in the vector database returns only documents the requester can see in the source systems; a DLP scan on the response can mask more identifiers when the role doesn't need them. | nBrain |
| §164.506 | Permitted uses for treatment, payment, and healthcare operations. | Every AI-mediated retrieval is logged with a purpose code. Operations queries (quality improvement, utilization review) are flagged separately from treatment and can carry extra reviewer policy on your side. | nBrain |
| §164.508 | Authorization for uses and disclosures not otherwise permitted. | The AI doesn't initiate disclosures that need authorization; it doesn't push PHI to outside parties. If you build an external workflow on top, you own the authorization. The boundary is documented. | Customer |
| §164.514(b) | De-identification: Safe Harbor or Expert Determination. | For work that doesn't need PHI (aggregate analytics, cohort summaries for quality improvement), an optional tokenization step, built where needed, strips or pseudonymizes the 18 identifiers before retrieval, producing a Safe Harbor dataset. Original PHI never reaches inference. | nBrain |
| §§164.524 / 526 / 528 | Individual rights: access, amendment, accounting of disclosures. | The AI keeps no separate designated record set; your source systems handle access and amendment. The audit log cites sources for every AI-mediated retrieval, which supports accounting-of-disclosures requests. | Shared |
| §164.530(j) | Keep documentation six years from creation or last effective date. | AI policies, audit logs, configuration snapshots, and BAA and DPA records kept at least six years. Sentinel: 90 days hot, then at least six years in archive, with signed bundles. | nBrain |
The policies, procedures, and workforce controls around the AI: risk analysis, workforce security, access management, incident response, contingency planning, and the BAA structure itself.
| Standard | Requirement | How the architecture meets it | Owner |
|---|---|---|---|
| §164.308(a)(1)(ii)(A) | Risk analysis of threats to ePHI. | An AI-specific addendum to your organization-wide risk analysis before deployment, updated after each material architecture change. | Shared |
| §164.308(a)(1)(ii)(B) | Risk management: measures to reduce risk. | Encryption, role-based access, audit, and BAA scope are built in. Risk acceptance, residual risk, and management sign-off stay with you. | Shared |
| §164.308(a)(3) | Workforce security: authorization, clearance, termination. | Access provisioned and removed through Entra ID lifecycle workflows tied to your HR system. On termination, access is revoked within minutes and the log keeps every query up to that point. | nBrain |
| §164.308(a)(4) | Information access management. | Three tiers of role-based access: tenant, document collection (for example cardiology, oncology, behavioral health), and function (query, ingest, admin). Privileged Identity Management with time-bound elevation for any admin role. | nBrain |
| §164.308(a)(5) | Security awareness and training on AI use. | Covered in your own training program. Topics: never paste PHI into consumer AI, using the sanctioned tool, query logging, reporting suspected AI exposure. | Customer |
| §164.308(a)(6) | Security incident procedures. | Defender for Cloud and Microsoft Sentinel with AI-specific rules: unusual query volume, out-of-role retrieval, prompt-injection patterns. Incidents go to your existing SOC workflow. | nBrain |
| §164.308(a)(7) | Contingency plan: backup, recovery, emergency mode. | Vector database and configuration backed up with Azure geo-redundant backup and documented recovery objectives. Emergency-mode operation doesn't depend on AI; it augments care, it isn't a single point of failure. | Shared |
| §164.308(a)(8) | Periodic technical and non-technical evaluation. | An annual report on platform changes, anomalies detected, and updated risk posture, folded into your organization-wide evaluation. | Shared |
| §164.308(b) | Business associate contracts. | Microsoft's BAA and data protection addendum cover Azure OpenAI in HIPAA-eligible regions. nBrain signs a separate BAA covering implementation, support, and any administrative access. No other subprocessors touch PHI without your written approval. | Microsoft BAA |
Mostly inherited from Azure's data centers. You keep workstation policy, and the AI adds no new physical media.
| Standard | Requirement | How the architecture meets it | Owner |
|---|---|---|---|
| §164.310(a) | Facility access controls. | Inherited from Azure data-center physical controls, which Microsoft attests to in its SOC 2 Type II and FedRAMP reports. | Microsoft BAA |
| §164.310(b) | Workstation use. | Your existing workstation policy applies. The AI runs in a browser or sanctioned app; no special setup. | Customer |
| §164.310(c) | Workstation security. | Managed through Intune or your MDM. No PHI stored locally; it stays in the Azure boundary. | Customer |
| §164.310(d) | Device and media controls. | No physical media in the pipeline. Embeddings, logs, and configuration snapshots live on Azure managed services, with cryptographic erase at decommissioning. | nBrain |
The section the AI deployment touches most. Every standard below is implemented in the platform.
| Standard | Requirement | How the architecture meets it | Owner |
|---|---|---|---|
| §164.312(a)(1) | Access control: unique IDs, emergency access, automatic logoff, encryption. | Unique IDs through Entra ID. Emergency access through a break-glass account with mandatory PIM elevation and audit. Automatic logoff at 15 minutes, configurable. | nBrain |
| §164.312(a)(2)(iv) | Encryption and decryption (addressable). | AES-256 at rest on the vector database, embeddings, and log store. Customer-managed keys in Azure Key Vault with HSM backing. | nBrain |
| §164.312(b) | Audit controls. | Every prompt, retrieved document, response, and admin action logged with cryptographic signing to Microsoft Sentinel (schema in section 07). Append-only rights on the log table prevent tampering. | nBrain |
| §164.312(c) | Integrity: protect ePHI from improper change or destruction. | Embeddings are immutable per ingestion event; updates create a new generation and keep the old one for audit. Hash checks at retrieval confirm nothing was altered. | nBrain |
| §164.312(d) | Person or entity authentication. | Entra ID Conditional Access enforces MFA, device compliance, and risk scoring. Services authenticate with managed identities; no shared secrets. | nBrain |
| §164.312(e) | Transmission security. | TLS 1.3 for all client-to-AI and AI-to-Azure-OpenAI traffic. Private endpoints and network isolation keep traffic off the public internet. | nBrain |
Each significant event (query received, retrieval run, model called, response returned) writes one entry, signed with a per-tenant key held in Azure Key Vault.
event_id : uuid // per-event UUID v7 event_type : "query.received" | "retrieval.executed" | "model.invoked" | "response.returned" | "admin.action" | "consent.event" tenant_id : uuid workspace_id : "clinical-docs" | "prior-auth" | … user : id : entra_object_id upn : "alice@health-system.com" role : "clinician" | "case-mgr" | "admin" department : "cardiology" // minimum-necessary scope session : id : uuid device_compliance: "compliant" ip : "10.x.x.x" // internal-only tpo_purpose : "treatment" | "payment" | "operations" prompt : hash : sha256 // full text in encrypted store phi_detected : bool retrieval : // retrieval events only documents : [ { doc_id, collection, access_authorized: bool } ] model : deployment : "gpt-5-prod" retention : "none" // requires the abuse-monitoring exemption response : hash : sha256 dlp_scan : "clean" | "redacted" | "blocked" timestamp : ISO8601 // monotonic UTC signature : hmac-sha256 // per-tenant key in Key Vault
The schema is queryable with Sentinel KQL. A typical OCR-style request, “show me everything user X retrieved on patient Y between dates A and B,” is answered with one query and produces a readable audit bundle with source documents cited and response hashes kept.
Under §164.402, a breach is an acquisition, access, use, or disclosure of PHI the Privacy Rule doesn't permit that compromises its security or privacy.
| Pattern | HIPAA posture | How the architecture changes it |
|---|---|---|
| A workforce member uses unsanctioned AI with PHI | Reportable disclosure under §164.402 | The sanctioned tool replaces the unsanctioned one. The log shows which tool was used and when, supporting the workforce-discipline path over the breach path. |
| An authorized user retrieves PHI for an unauthorized purpose | Workforce discipline | The log captures the retrieval and feeds your investigation. Finding affected individuals takes hours, not weeks. |
| An external attacker compromises the AI tenant | Security incident under §164.308(a)(6) | Sentinel detection tuned for AI attacks (prompt injection, retrieval enumeration, embedding extraction). The log identifies affected individuals and scope within hours. |
§164.404 requires notice to affected individuals without unreasonable delay and no later than 60 days after discovery. HHS must be notified, and the media too when more than 500 residents of a state or jurisdiction are affected. The audit log is designed to help you meet those timelines, not stretch them.
Microsoft's standard BAA, part of its Product Terms and data protection addendum, covers Azure as a business associate for HIPAA-eligible services, including Azure OpenAI. Microsoft commits not to train on your data, and offers customer-controlled content filtering and customer-managed keys. Prompt retention for abuse monitoring is switched off only once Microsoft approves the exemption, which we request at setup.
nBrain signs a separate, narrower BAA covering implementation, ongoing support access (read-only telemetry by default), any administrative access during support, and the ingestion and embedding pipeline. nBrain does not bring in other business associates without your written approval.
| Coverage path | BAA in place | Scope |
|---|---|---|
| You and Microsoft | Your existing BAA | Azure OpenAI, Storage, Sentinel, Entra ID, Key Vault |
| You and nBrain | New BAA signed with the engagement | Implementation, support access, ingestion and embedding pipeline |
| nBrain and Microsoft | None; pass-through | nBrain staff reach your tenant only with credentials you grant: time-bound and audited |
Every HIPAA control an AI deployment touches, with its status and owner.
| HIPAA section | Topic | Status | Owner |
|---|---|---|---|
| §164.502(a), (b) | Use, disclosure, minimum necessary | Implemented | nBrain |
| §164.506 | Treatment, payment, operations uses | Implemented | nBrain |
| §164.508 | Disclosures needing authorization | Out of scope (AI initiates no disclosures) | Customer |
| §164.514(b) | De-identification (Safe Harbor) | Optional layer | nBrain |
| §164.524 / 526 / 528 | Individual rights | Audit log supports accounting | Shared |
| §164.530(j) | Documentation retention (six years or more) | Implemented | nBrain |
| §164.308(a)(1) | Risk analysis and management | Addendum integrated | Shared |
| §164.308(a)(3) | Workforce security | Implemented (Entra lifecycle) | nBrain |
| §164.308(a)(4) | Information access management | Three-tier role-based access | nBrain |
| §164.308(a)(5) | Workforce training | Module provided; you integrate it | Customer |
| §164.308(a)(6) | Security incident procedures | Sentinel and Defender, tuned for AI | nBrain |
| §164.308(a)(7) | Contingency planning | Geo-redundant backup, recovery objectives | Shared |
| §164.308(a)(8) | Periodic evaluation | Annual report | Shared |
| §164.308(b) | Business associate contracts | Microsoft BAA and nBrain BAA | Microsoft BAA |
| §164.310(a)–(d) | Physical safeguards | Inherited from Azure | Microsoft BAA |
| §164.312(a)(1) | Access control | Implemented | nBrain |
| §164.312(a)(2)(iv) | Encryption at rest (AES-256, your keys) | Implemented | nBrain |
| §164.312(b) | Audit controls (tamper-evident log) | Implemented; schema in section 07 | nBrain |
| §164.312(c) | Integrity | Hashes and immutable embedding versions | nBrain |
| §164.312(d) | Authentication (MFA, Conditional Access) | Implemented | nBrain |
| §164.312(e) | Transmission security (TLS 1.3, network isolation) | Implemented | nBrain |
| §164.400–414 | Breach Notification Rule | Audit log supports the timeline | Shared |
The model is pre-trained by its provider on public data. Each prompt and its retrieved context go to the Azure OpenAI endpoint in your subscription and a response comes back. Prompts aren't used for training, and with Microsoft's abuse-monitoring exemption they aren't stored for human review.
Gateway, vector database, Azure OpenAI endpoint, and Sentinel workspace all run in a HIPAA-eligible region of your subscription. Network rules deny outbound traffic to the public internet; the only egress allowed is to documented Microsoft endpoints within your BAA scope.
Every prompt, retrieval, response, and admin action is logged to Sentinel with cryptographic signing, and the AI service can only append to the log. Your privacy officer, or an OCR investigator under a corrective action plan, can get read-only access to check any entry against the records.
Consumer AI handles your PHI. AI-enabled SaaS rents your PHI. Private AI lets your AI work on your PHI inside the environment you control.
We'll walk through this mapping and the audit-log schema, plus the non-PHI quick wins (accounts payable, contract analysis, commercial-team enablement) you can start while the PHI work finishes risk review. Engineers, not a pitch deck.