Healthcare · HIPAA · 45 CFR Part 164
Clinicians paste PHI into AI every day. Make it a non-event.
Documentation, billing and summarization tools are too useful to ban — but every patient record pasted into them is a HIPAA disclosure. HoundShield detects PHI on your hardware and blocks or quarantines it before it reaches any model, satisfying minimum-necessary and audit requirements.
What it is
A local proxy that scans every AI prompt for protected health information before it leaves your facility's network.
Who it's for
CISOs, compliance officers and privacy leads at hospitals, clinics, payers and digital-health companies.
How you use it
Route your documentation AI through HoundShield. PHI is held for human review or stripped — clinicians keep working.
What it detects for you
How it works
- 01
Route documentation AI through HoundShield
One URL change for your scribe, coding or summarization tool.
- 02
PHI is blocked or quarantined
The exact identifier is flagged on-device; nothing reaches the model unreviewed.
- 03
Audit-ready for OCR
Tamper-evident logs map to 45 CFR 164 access & disclosure requirements.
How HoundShield supports HIPAA (45 CFR 164)
| Control / requirement | How HoundShield maps to it | Status |
|---|---|---|
| 164.312(a)(1) — Access control | PHI blocked before it can be disclosed to a model | Enforced |
| 164.312(b) — Audit controls | Tamper-evident log of every prompt decision | Logged |
| 164.502(b) — Minimum necessary | PHI stripped or held for review before the model sees it | Enforced |
| 164.308(a)(6) — Incident response | Real-time alerts when PHI is caught in a prompt | Alerted |
Common questions
Do you receive our PHI? Is a BAA needed?+
Detection runs on your hardware and we never receive PHI, so HoundShield isn't a typical cloud BAA exposure — and we still sign a BAA on paid plans.
Will it block clinicians from working?+
No. Clean prompts pass through; only PHI is held for review or stripped, so documentation keeps flowing.
Does it cover ambient scribe and coding tools?+
Yes. Any AI tool that speaks the OpenAI API can be routed through the gateway, including scribe, medical-coding and summarization assistants.
How is quarantined PHI stored?+
Quarantined content is encrypted at rest with AES-256 and only released after human review. Raw prompt content is never stored in plaintext.
HIPAA settlements have reached $16M
HHS OCR penalties run from tens of thousands into eight figures (Anthem settled for $16M). Let your team use AI without becoming the next enforcement headline.
Protect PHI