Health · PHIPAHIPAA
Ambient scribing with zero PHI egress.
On-premise open-weight AI gives clinicians back the hours documentation takes — scribing, referral letters, coding suggestions — while personal health information never leaves the LAN. No cross-border transfer analysis, no vendor PHIPA agreements to police.protected health information never leaves the network. No chains of business associate agreements to negotiate and audit.
The problem
The most useful data in medicine is the least shareable.
Documentation burden is the defining operational problem of modern clinical practice, and AI scribing is the clearest solution on offer. But every mainstream scribing product works the same way: it streams recordings of patient encounters to a vendor’s cloud. That single design decision generates the entire compliance workload that follows.
Under PHIPA, custodians remain accountable for personal health information handled by every agent and service provider in the chain. A US-based scribing vendor adds cross-border transfer analysis, the reach of the US CLOUD Act over American providers, and a breach surface the clinic does not control. Provincial privacy commissioners have made clear that accountability does not outsource.
Under HIPAA, every vendor touching PHI needs a business associate agreement — and every BAA is a document to negotiate, an attestation to renew, and a subcontractor chain to audit. The vendor’s retention policy, logging, and breach history all become your compliance posture. The Office for Civil Rights does not accept “the vendor said so” as a safeguard.
Meanwhile, clinicians who are refused sanctioned tools use unsanctioned ones. The fix is not another policy memo. It is an approved tool that is better than the shadow alternative — and architecturally incapable of leaking.
The architecture
The scribe that never phones home.
We deploy a multimodal open-weight bench inside your network: Qwen3-VL for document understanding, OCR, forms, and records digitization; a tuned language model for ambient scribing, referral letters, and coding suggestions. Clinic-vocabulary adapters are trained on your own templates and charts, in your environment, and evaluated against your real documentation before any clinician relies on them.
The deployment is air-gap-capable, with role-based access scoped by care team and full audit logging. Data egress is zero bytes — which turns the hardest question in every privacy review into the shortest answer.
Deployment blueprint
The multi-clinic network, on paper.
A multi-clinic Ontario networkmulti-clinic regional network runs Qwen3-VL plus a tuned scribe model for ambient documentation, referrals, and coding — with PHI never leaving the LANPHI never leaving the network. Read the full reference architecture.
Read the healthcare blueprintQuestions we get
Frequently asked questions
Does an on-premise LLM need a business associate agreement under HIPAA?
No. HIPAA’s business associate framework exists because a third party handles protected health information on your behalf. A fully on-premise deployment has no third party: PHI never leaves your network, so there is no business associate, no BAA to negotiate, and no vendor chain to audit. In Canada, the same architecture resolves PHIPA’s custodianship obligations — personal health information stays with the health information custodian, full stop.
Can AI scribing really run without patient data leaving the clinic?
Yes. Ambient scribing, referral-letter drafting, and coding suggestions all run on models served inside your network — air-gap-capable where required. The multimodal pipeline (Qwen3-VL for documents and forms, a tuned language model for notes) processes audio, text, and images entirely on hardware you control, with role-based access scoped to the care team.
Is open-weight model quality sufficient for clinical documentation?
For documentation, summarization, coding suggestions, and correspondence — yes, at the level of last-generation proprietary flagships. We fine-tune on your templates and clinic vocabulary and evaluate against a harness built from your real charts before rollout. Clinical decision-making remains with clinicians; the deployment is scoped to documentation and administrative work.
How does this compare to cloud scribing vendors on compliance?
Cloud scribing routes recordings of patient encounters through a vendor’s infrastructure — which means vendor agreements, retention policies, breach exposure, and, for Canadian providers using US vendors, cross-border transfer analysis under provincial health privacy law and the reach of the US CLOUD Act. On-premise deployment replaces that paperwork with architecture: egress is zero bytes, and the audit answer is one sentence.
Go deeper
HIPAA-compliant LLMs without a BAA
Five architectures compared — and why fully on-prem needs no BAA at all.
Québec Law 25 and AI
The “equivalent protection” bar for cross-border health and personal data.
What on-premise LLM deployment costs
Real hardware tiers and the ~2M tokens/day break-even against APIs.
Deploy Qwen3-VL on-premise
The multimodal workhorse for records, forms, and intake pipelines.
Deploy GLM-5.2 on-premise
The single-rack language workhorse: 744B MoE, 40B active, MIT.
Air-gapped AI deployment
For environments where the network boundary is the compliance boundary.
Give clinicians the hours back — and keep PHI home.
The two-week sovereignty assessment maps your data classes, privacy obligations, and documentation workloads, and hands you a written architecture with a real cost model.
Book a sovereignty assessment