HEALTHCARE · HIPAA-COMPLIANT AI USE

Let Clinicians Use AI Without Exposing PHI

Free AI tools don't sign a Business Associate Agreement. Wald detects patient data on the device and stops it before it reaches ChatGPT, Gemini, Claude or Copilot, so your teams get AI's time savings without a HIPAA breach.

Book A Demo

Built for HIPAA:

HIPAAHITECH42 CFR Part 2Minimum necessaryAudit logs
Healthcare AI DLP: Wald blocks patient names, MRNs and diagnoses on the device before they reach ChatGPT, Claude, Gemini or Grok

Trusted By

55+

Regulated Organizations

Symmetrical horizontal blue light streaks on a black background, creating a sense of motion and speed.
WHY AI IS THE NEW HIPAA RISK

AI Is Now the Easiest Way PHI Leaves Your Organization

EHRs, email and file sharing have had safeguards for years. AI prompts have not. Clinicians and billing staff paste chart notes into a browser tab, often from personal accounts, and legacy DLP never sees it.

#1

GenAI is now the top channel for corporate data moving to personal accounts, carrying 32% of it.

77%

of employees using GenAI paste data straight into prompts.

82%

of those pastes happen in unmanaged personal accounts your tools can’t see.

Source: LayerX, Enterprise AI & SaaS Data Security Report 2025

N
Nicole · Care coordinatorFree ChatGPT · personal account · Mon 2:41 PM
TYPICAL SCENARIO

Summarize this discharge note in plain language for the family. Patient Maria Lopez, DOB 03/12/1958, MRN 00482913. Diagnosed with stage II breast cancer, starting tamoxifen 20 mg, follow-up at St. Mary’s oncology in two weeks.

PHI in one prompt: NameDOBMRNDiagnosisMedication

What just happened

  • PHI disclosed to an AI vendor with no Business Associate Agreement
  • No minimum-necessary review and no access log
  • A possible breach you now have to assess, document and maybe report
One prompt, sent in under a second. Instant HIPAA exposure.
HIPAA CIVIL PENALTIES
$2M+

Inflation-adjusted HIPAA penalties can exceed $2 million per violation category, per year. Disclosing PHI to a vendor without a BAA is one of the easiest ways to get there.

60 daysHITECH: the outer limit to notify patients of a breach of unsecured PHI
500+ peopleBreaches this size are reported to HHS and posted publicly

Why Employee AI Use Puts HIPAA Compliance at Risk
‍

01

Free AI Tools Don’t Sign a BAA

Consumer AI tools don’t offer a Business Associate Agreement. PHI shared with them is a disclosure HIPAA doesn’t allow.

02

PHI Hides in Clinical Shortcuts

A discharge summary, a prior-auth appeal, a referral letter. Clinicians rarely see these as data transfers. HIPAA does.

03

Burnout Drives Shadow AI

Clinicians turn to AI to win back documentation time. Blocking AI outright just moves it to personal phones.

04

No Record, No Risk Assessment

Without a log of what went to which AI tool, you can’t run the breach risk assessment HIPAA requires or answer an OCR inquiry.

The Health Data Wald Protects

HIPAA protects 18 identifiers and the clinical details tied to them. These are the data types that surface most often in AI prompts at providers, payers and health tech companies. Wald detects each one on the device, and you choose Allow, Warn or Block.

Patient identifiers

The details that make a record identifiable.

  • Full name
  • Date of birth
  • MRN
  • SSN
  • Home address

Clinical data

Chart content pasted for summaries and letters.

  • Diagnoses
  • Medications
  • Lab results
  • Imaging reports
  • Clinical notes

Insurance & billing

Revenue cycle data in appeals and coding work.

  • Member ID
  • Claim numbers
  • ICD & CPT codes
  • EOBs
  • Prior auths

Contact & device

Identifiers HIPAA counts that staff often forget.

  • Phone
  • Email
  • IP address
  • Device IDs
  • Photos

Highly sensitive records

Data with extra legal protection.

  • Mental health notes
  • Substance use (Part 2)
  • HIV status
  • Genetic results
  • Reproductive health

Research data

Trial and study data tied to participants.

  • Participant IDs
  • Case report forms
  • Adverse events
  • Protocol drafts
  • Cohort data

Workforce data

Staff records in HR and quality work.

  • Credentialing
  • Employee health
  • Incident reports
  • Peer review
  • Payroll

Operational data

Confidential business information.

  • Payer contracts
  • Pricing
  • Quality reports
  • Vendor contracts
  • Risk assessments

HIPAA expects reasonable safeguards for PHI wherever it goes. Today, that includes AI prompts.

Stop PHI before it reaches AI

Wald’s on-device models recognise patient identifiers and clinical context, so a chart note, referral or appeal never leaves the workstation inside a prompt.

  • Patient name, DOB & MRN detection
  • Diagnoses, medications & lab results
  • Context, not just pattern matching

Apply HIPAA policies with Allow, Warn, or Block

Set rules per data type, department and AI tool. Block identifiable PHI outright, allow de-identified clinical questions, and coach staff in the moment instead of after an incident.

  • Per-data-type, per-department policies
  • Inline coaching before a block
  • Free and paid AI tools covered

Evidence for your privacy officer

Every AI interaction is logged with user, tool, data type and policy outcome, so privacy and security officers can document safeguards, run breach risk assessments and answer auditors fast.

  • Centralised audit trail
  • Exportable reports for OCR and auditors
  • Per-user, per-tool records

A BAA-Covered AI Plan Alone vs. Wald

BAA-covered AI plan alone
With Wald
PHI still leaves the workstation
PHI stopped on the device
Free tools without a BAA stay open
Every AI tool covered, BAA or not
No minimum necessary check on prompts
Allow, Warn or Block on every prompt
Usage logs held by the AI vendor
Your own record for breach risk assessments
Jonathan Antonio
Wald enables our employees to safely leverage leading AI models so they can reduce the time they spend on manual tasks. Our traditional DLP was built for email and file transfers and not AI prompts. Wald gave us real visibility and control over how our employees use LLMs without slowing productivity.
Jonathan Antonio
Jonathan Antonio
Vice President of Infrastructure @Suki

Stop PHI Leaking Into AI

Keep patient data out of AI tools, and keep the proof that you did. See how Wald fits your HIPAA program in a 30-minute demo.

Book a Demo
3D illustration of Wald AI visibility and protection

Frequently Asked Questions

Talk to Sales

Is it a HIPAA violation to paste PHI into ChatGPT?

It can be. Sharing PHI with an AI vendor that hasn't signed a Business Associate Agreement is generally an impermissible disclosure under HIPAA.

‍

Consumer AI tools don't offer BAAs, so PHI pasted into them is outside your control from the moment it is sent.

Does a BAA with our AI vendor make AI use compliant?

A BAA covers the tool you license, under the terms you agreed. It doesn't cover the free tools staff use on the side, and it doesn't stop more PHI than necessary from being shared.

‍

Wald adds on-device detection across every AI tool, so the minimum necessary standard holds in practice, not just on paper.

Is a paid ChatGPT or Gemini plan enough for HIPAA?

Business plans typically stop the vendor from training on your data, but PHI still leaves the device and is stored by a third party, and it is only covered if you have a BAA in place. They also cover only the tool you license. Wald adds on-device detection and control across the AI tools your teams actually use.

Which health data does Wald detect?

Patient identifiers such as names, dates of birth, MRNs and member IDs, plus diagnoses, medications, lab results, insurance details and substance use treatment records.

‍

On-device models understand context, not just patterns, and you decide whether each type is allowed, warned on or blocked.

Which regulations does Wald help healthcare organizations meet?

Wald helps you maintain HIPAA Privacy and Security Rule safeguards, HITECH breach notification readiness and 42 CFR Part 2 protections wherever AI is involved.

‍

It also supports state health privacy laws and GDPR for organizations that serve patients outside the US.

How quickly can we roll out Wald across clinical teams?

Wald runs as a lightweight agent across browser and desktop, deployed through your existing MDM, so you can start seeing AI usage across clinical and administrative teams soon after rollout. We'll map out a deployment plan with you during your demo.

Helps you maintain:

SOC2 TYPE II
HIPAA
HITECH
42 CFR PART 2
GDPR