AI enablement · HIPAA
Giving a HIPAA-covered company Claude — without giving away its data.
Staff wanted AI in their daily work. Leadership needed it to stay inside the company's BAA and identity controls. The answer was Claude on infrastructure the company owns, connected to the tools people already use.
- Client
- US healthcare company (HIPAA-covered)
- Role
- Architect and lead engineer
- Period
- 2026 – present
- Focus
- Claude under a BAA
- covers every model call
- BAAcovers every model call
- through the existing identity provider
- SSOthrough the existing identity provider
- with a first group of staff
- Livewith a first group of staff
The problem
Consumer AI tools are the fastest way for protected health information to leak. Banning them just pushes people to use them anyway.
The company also had a backlog of small internal tools that nobody had time to build — and no safe place to run them.
What I built
- 01
Claude inside the BAA
Claude served through AWS Bedrock under the company's BAA, with sign-in through the company's existing Microsoft identity.
- 02
Connectors
Connectors to Microsoft 365 and the business tools staff already use, limited to vendors covered by a BAA wherever health data is involved.
- 03
Identity and device controls
Single sign-on through the company's existing identity provider, and managed-device policies that lock the desktop app to the approved configuration, all defined in Terraform.
- 04
A safe home for internal AI tools
AI helpers and internal tools that staff build ship onto a dedicated internal app platform, behind the same sign-in and access controls.
The result
- Live with a first group of staff, on the same compliance footing as the rest of the company's systems — and rolling out device by device.
- A live internal app platform, so new tools ship behind SSO without a ticket to IT.