HIPAA-era compliance
Clinical decision evidence an OCR reviewer can re-walk.CDS flags, prior-auth escalations, coverage decisions — on the same signed chain.
The regulator’s questions almost never match the dashboard your model team built — so Plumbline writes every clinical decision the model made onto a SHA-256 chain that’s already the answer. PHI-tagged inputs, BAA-scoped access paths, retention windows you agreed in week one, and a signed PDF the auditor can re-derive without a call back to engineering.
§01 · Auditor posture
What OCR / HHS asks for — and where the evidence lives in the answer.
The auditor’s questions are almost always the same. Every row below is a real OCR / HHS expectation and the Plumbline artifact the ledger already produces on the way through — no after-the-fact paste-up.
- 45 CFR §164.514 · HIPAA Safe Harbor
Every PHI field the model touched is recorded at inference time, with the field-level scope of the disclosure.
Reviewer-visible artifact · EVAL · PHI-TAGGEDThe SDK tags input fields against the buyer-declared PHI schema and writes the tagged input hash to the record. No after-the-fact annotation or reconstruction.
- 45 CFR §164.504(e) · BAA boundary
Only covered entities and named business associates handle PHI; sub-processors are declared and access-scoped.
Reviewer-visible artifact · BAA · SCOPEDSub-processor matrix is published at /sub-processors. Each record carries an access-scope tuple at write time, so the BAA boundary is a query, not a delegation chart.
- 45 CFR §164.308(a) · Workforce access
Reviewer roles can be re-derived from the record — including medical director, care manager, and compliance audit.
Reviewer-visible artifact · SCOPE · AUDITEach record's scope row pins the four access paths the buyer's compliance officer defined: care-manager, medical-director, compliance-audit, and read-only export.
- 45 CFR §164.530(j) · 6-year retention
PHI retention is contractual, not a default; old records cannot be silently re-fetched after the window closes.
Reviewer-visible artifact · RETENTION · WINDOWEDRetention is set in week one with the buyer, written into the BAA addendum. Records past the window are tombstoned with a signed deletion record — the chain tells the auditor the record is gone on purpose.
- 21 CFR 820.198 · 42 CFR §11 (SaMD)
Post-market incidents are recorded, including the record(s) that triggered the alert and the resolution that closed it.
Reviewer-visible artifact · INCIDENT · CHAINEDDrift signals and incident records ride the same SHA-256 chain. The cause → detect → resolve sequence is provable end to end with no side-table reconciliation.
- ONC HTI-1 §170.315(b)(11)
Clinical decision support surfaces the source attribution the recommendation came from and an independent rationale the reader can audit.
Reviewer-visible artifact · CDS · ATTRIBUTEDThe record carries the model + scorer version, an evaluator breakdown, and an independent rationale evaluator. The reader sees why the recommendation surfaced, not just that it did.
- NIST AI RMF · MEASURE 2.4
Model change-management produces signed artifacts a buyer can hand to the auditor and counsel together.
Reviewer-visible artifact · BUNDLE · CO-SIGNEDModel cards, audit-export PDFs, and webhook event streams are co-signed onto the same chain — auditor and counsel read the same signed bundle.
§02 · The replay walk-back
A radiology CDS flag, opened two quarters later.What the record carries — and what a reviewer walks back.
- 1.What recommendation did the model surface? The CDS flag (escalate to radiologist) and the underlying finding sit on the same row as the model version and the rationale evaluator’s score.
- 2.Was the source attribution on the recommendation? ONC HTI-1 §170.315(b)(11) expects the model card + an independent rationale; the evaluator set runs both, signs both, and pins both to the record.
- 3.Did the calibration drift before or after? Score distribution walks back through the same ledger 30, 60, or 90 days at a time — no separate lake to reconcile.
- 4.Who has read this record since? Scope is set at write time. The session log on the record names every role and every export, signed against the BAA boundary.
- 5.Has the record been edited since capture? The SHA-256 chain breaks visibly at the next record; tampering is detected at fetch, not at audit time.
- 6.What does the auditor hand back to counsel? A signed PDF audit log (model card + record hash + signature chain), re-derivable from the public /verify page.
§03 · Cross-links
Read next, by buyer intent.
Reserve a pilot, or give the procurement team the evidence and BAA path.
Buying for a clinical-AI program and want the reviewer walk-through? Drop your email and the scoping checklist lands in your inbox before any contract is drawn up. Buying at the enterprise level with a BAA template already on the desk? Send the procurement team the intake form and we'll reply with the security packet and a short validation offer.
We'll never share your email. No marketing blast — only the next-step note when a slot opens. If you already have a BAA template ready, mention it on the call.
Four moments the buyer can replay
- 01CaptureThe request lands with its context and scope.
- 02Evaluate / escalateScores and thresholds explain the manual-review path.
- 03ReviewNotes and sign-off stay attached to the decision.
- 04Replay / exportThe chain and signed evidence travel together.
Unlock the PDF
Leave an email for the next-step note, then the download appears here.
Fictional demo data only: Patient-7421 is not a real patient or PHI. The full walkthrough lives at /sample-evidence.
§06 · Pricing
Ready to see this on your models?
Start with the $1,000 Evidence Pilot: one workflow, one model, and 30 days ending in a replayable evidence package. Plumbline captures forward from the moment you connect, and the full pilot fee is credited toward Regulated Team.