Healthcare AI compliance.
Operationalized.

Healthcare AI compliance covers the regulatory, governance, and operational discipline required to deploy AI in HIPAA-regulated environments. It includes: AI Readiness assessments (does the organization have the policies and controls in place?), AI Risk Assessment (what's the risk profile of a specific AI use case?), AI policy enforcement (are deployed AI systems actually operating within policy?), incident response when AI behaves unexpectedly, and audit trail generation that survives a CMS or OCR review.

Regular HIPAA compliance covers the privacy and security of PHI in conventional systems — access controls, BAAs, breach notification, encryption. Healthcare AI compliance adds: training-data provenance (was PHI used to train the model?), inference-time PHI handling (does the model see PHI in prompts?), model behavior assurance (does the model do what its policy says it does?), and AI-specific audit trails (which model version produced this output?). Most existing compliance programs were not built for these questions.

AI Risk Assessment is a structured evaluation of a specific AI use case across dimensions like: clinical risk (could the AI's output harm a patient?), privacy risk (does it touch PHI?), regulatory risk (does CMS, state insurance, or OCR have jurisdiction?), bias risk (does the AI behave differently across populations?), and operational risk (what happens when the AI is wrong?). The assessment produces a risk score and a set of required controls. CPS One operationalizes this workflow.

Most of CPS One uses no AI by design. The core privacy operations modules — incident management, breach notification, BAA tracking, disclosure accounting, policy enforcement, AI Readiness, and AI Risk Assessment — run on deterministic, rule-based workflows. The CPS Insights reporting module is the single exception; it uses Aether One™ for analytical pattern detection across aggregated reporting data only. PHI is never used for AI training. This scoping is contractual and architectural — not a marketing choice.

Five anchors: HIPAA — still the foundation for any system handling PHI, with the 2026 Security Rule update tightening AI-relevant controls; the FDA's framework on AI/ML medical software, including the SaMD pathway; state-level AI regulations on bias, transparency, and clinical-decision support; the NIST AI Risk Management Framework, increasingly cited as the federal benchmark; ONC's HTI-1 rule, requiring transparency on predictive Decision Support Interventions in certified EHRs.

Yes. CPS One is built specifically for HIPAA privacy and security operations: incident management, breach notification, BAA tracking, disclosure accounting, and audit-ready compliance reporting. CPS One has been deployed in healthcare privacy programs for over a decade — the platform was previously called CompliancePro, with 96% three-year customer retention.

AI Readiness is an organizational assessment of whether a healthcare entity has the policies, controls, and operational maturity to deploy AI safely. It typically covers: AI governance policies, vendor due diligence, BAA terms for AI vendors, model documentation, model monitoring capabilities, incident response, training data provenance, and the surrounding data-governance program. AI Readiness is a prerequisite to deploying any AI system that touches PHI or affects clinical decisions.