> For the complete documentation index, see [llms.txt](https://docs.layerlens.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.layerlens.ai/more-in-this-section-2/compliance-4.md).

# Healthcare compliance

## Regulatory frame

Clinical AI sits at the intersection of three regulatory regimes. Each has its own evaluation evidence requirement.

| Regime                          | Applies when                                                                                        | Evaluation-evidence shape                               |
| ------------------------------- | --------------------------------------------------------------------------------------------------- | ------------------------------------------------------- |
| **HIPAA / BAA**                 | Anything touching Protected Health Information (PHI)                                                | Tenant-isolation, audit log, PHI handling controls      |
| **FDA SaMD**                    | The AI makes or substantially supports a clinical decision (Class II+ Software as a Medical Device) | Clinical-validation evidence, change-control records    |
| **State Medical Practice Acts** | The AI's output could be construed as practicing medicine                                           | Disclaimers, scope-of-use constraints, escalation paths |

Stratix supports the evidence side of all three. It does not certify your product — that's between you and your regulator. It produces the artifacts that make certification tractable.

## HIPAA / BAA

Stratix Enterprise supports a Business Associate Agreement.

**Required for production:**

1. Executed BAA with LayerLens
2. PHI redaction at trace ingestion (in your application code, not Stratix's)
3. SSO with role-based access (no shared logins)
4. Extended audit retention for the period your record-retention policy requires
5. Data residency in a region your security team has approved

**Discuss with** [**sales@layerlens.ai**](mailto:sales@layerlens.ai) **and** [**legal@layerlens.ai**](mailto:legal@layerlens.ai) to start the BAA workflow. See **DPA process** (Enterprise tier — contact sales) for the legal mechanics.

## PHI handling

PHI must never enter Stratix trace bodies in plaintext unless your BAA covers it AND your security team has approved the data flow.

**Recommended pre-trace redaction:**

* Names → `<PATIENT_NAME>` token
* DOB → age-band only
* MRN / SSN / addresses → category tokens
* Free-text clinical notes — entity-level redaction (Presidio, AWS Comprehend Medical, or equivalent) before the trace leaves your boundary

The redaction happens **client-side**, before Stratix sees the data. Stratix's [PHI-redaction rule pattern](/more-in-this-section-2/eval-patterns-4.md) then verifies redaction was effective by scoring traces for any leftover PII.

## FDA Software as a Medical Device (SaMD)

If your product makes or substantially supports a clinical decision, FDA may classify it as SaMD. The classification (Class I, II, or III) drives the evidence burden.

**Stratix's role in the SaMD evidence pack:**

* **Pre-market validation** — agentic evaluations against curated clinical trace sets become the validation evidence
* **Change control** — every release pin cites the evaluation ID that gated it; before-and-after evaluations document the impact of any change
* **Post-market surveillance** — continuous trace evaluations on production traffic become the post-market quality monitoring artifact

Talk to your FDA regulatory consultant about how the evaluation evidence Stratix produces maps to your specific submission shape (510(k), De Novo, PMA).

## Audit retention

Enterprise tier supports configurable audit retention. Common configurations:

| Use                                                   | Retention                                     |
| ----------------------------------------------------- | --------------------------------------------- |
| HIPAA-compliant operational logs                      | 6 years (HIPAA minimum)                       |
| FDA-regulated clinical-AI change logs                 | Lifecycle of the product + post-market period |
| Quality audit trail (eval IDs cited in release notes) | Indefinite                                    |

Configure during onboarding; retention period is a contractual term.

## State medical practice acts

State boards regulate "practice of medicine." AI that crosses certain thresholds (diagnosis, prescription, treatment recommendation) may be regulated as such.

**Mitigations Stratix's evaluation framework supports:**

* **Disclaimer-presence rule** on patient-facing outputs (state-specific)
* **No-diagnosis rule** that a triage assistant must not assert a specific diagnosis
* **Escalation rule** to a licensed clinician for any output above configured risk

These are documentation patterns, not legal opinions. Consult counsel for your specific deployment.

## Data residency

Enterprise: choose US, EU, or other available region for tenant data. Healthcare customers typically pin to a region matching their patient population to avoid cross-border data transfers.

## Recommended setup

1. Enterprise tier with executed BAA
2. PHI redaction at trace ingestion (your code)
3. SSO with role-based access
4. Trace evaluations with evaluation IDs cited in release notes
5. Continuous trace evaluation on production traffic for post-market quality monitoring
6. Data residency configured to your region of record
7. Audit retention configured to your record-retention policy

## See also

* [Enterprise](/4.2-industry-use-cases/healthcare.md)
* **Enterprise — DPA process** (Enterprise tier — contact sales)
* [Security and compliance](/4.2-industry-use-cases/healthcare.md)
* [Concept: Multi-tenancy](/7.-observe-see-whats-happening/multi-tenancy.md)
* [Industry pattern: healthcare contraindicated cocktail](/4.2-industry-use-cases/pattern.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.layerlens.ai/more-in-this-section-2/compliance-4.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.