AI Privacy for Healthcare

HIPAA (Health Insurance Portability and Accountability Act) strictly regulates the use and disclosure of Protected Health Information. PHI includes patient names, dates of birth, medical record numbers, diagnoses, treatment plans, and any other individually identifiable health information. When a clinician types patient details into an AI chatbot, that data is transmitted to a third-party server — constituting a potential HIPAA violation. Most AI providers do not have Business Associate Agreements (BAAs) in place, and even those that do (like some enterprise ChatGPT deployments) still involve data leaving the healthcare organisation's control. In the UK and EU, similar protections apply under GDPR and the common law duty of medical confidentiality. The Caldicott Principles require that patient-identifiable information is only shared when absolutely necessary and with appropriate safeguards.

MyYaad replaces all patient-identifiable information with realistic shadow values before any prompt reaches an AI provider: - Patient names become different realistic names - Dates of birth shift to different plausible dates - NHS numbers, MRN numbers, and SSNs are replaced with shadow identifiers - Addresses and contact details are substituted - Prescription dosages and medication names can be added as vault entries for shadowing — they aren't auto-detected from free-text by default The AI receives a clinically coherent prompt with all the medical context it needs — but with no real patient data. When the response comes back, MyYaad restores the original values so the clinician sees the output with the real patient details. Critically, each AI provider sees different shadow values. If a clinician uses ChatGPT for note drafting and Claude for differential diagnosis support, neither provider can correlate the data back to the same patient.

Healthcare professionals use AI across a wide range of clinical and administrative tasks: - Drafting clinical notes and discharge summaries - Summarising patient histories for referrals - Supporting differential diagnosis with symptom analysis - Generating patient-facing educational materials - Analysing lab results and imaging reports - Drafting letters to GPs, insurers, or specialists - Coding and billing documentation Each of these scenarios involves PHI. MyYaad shadows this data automatically, allowing clinicians to work efficiently with AI while maintaining HIPAA compliance and patient trust.

Healthcare workflows often involve clinical documents — lab reports, discharge summaries, referral letters. MyYaad can parse PDF and DOCX files locally, shadow all patient-identifiable information, and provide the shadowed content as AI context. The original clinical documents never leave the clinician's device. The shadow engine processes them locally, ensuring that even the parsed text is protected before any AI interaction.