AI safeguards

PHI safeguards with a BAA before production use.

ABACare documents clinic-scoped access controls, audit trails, data boundaries and explicit human approval gates. Every AI draft routes through a qualified reviewer, and production PHI use requires an executed BAA plus a separate readiness review.

Where AI sits, and who decides.

The trust model on one screen. This is the product, on a fictional clinic.

The four safeguards.

  • BAA before production PHI. ABACare executes a Business Associate Agreement before a clinic introduces production PHI. Coverage, enabled services and data flows are confirmed in a separate readiness review.
  • Clinic-scoped data isolation. Clinic-scoped query, prompt and document-retrieval controls are implemented across tested workflows. Role-based access restricts what each user sees, and production activation requires completion of the tenant and capability readiness review.
  • AI data boundaries. ABACare limits each AI request to the minimum necessary data and routes PHI-bearing work only to verified eligible providers under the required agreements and readiness review. Provider eligibility and the approved data flow are checked before activation.
  • Human approval on every AI output. Voice-to-note drafts, denial appeal letters and treatment plan drafts all need explicit clinician approval before they become part of the chart, the billing record or a family communication. No AI output reaches a payer or a parent without a person approving it.

Why ABA teams need verified AI data boundaries.

Session notes, treatment plans and billing data are all PHI under HIPAA. If PHI goes to an AI service that is not covered by a BAA, the clinic carries the regulatory and business risk, not the vendor.

ABACare uses a minimum-necessary routing policy. Voice, note, appeal and treatment-plan workflows may send approved data to a verified eligible provider only when the applicable agreements, service configuration and readiness review permit that data flow. Requests fail closed when those conditions are not met.

The approval gates add a second layer. AI generates drafts with evidence citations, and nothing becomes part of the clinical or billing record until a clinician explicitly approves it. That keeps clinicians in control and leaves an audit trail for every AI-assisted decision.

A worked example, one family update through the safeguards.

An example with invented figures, to show how the chain works. It is not a customer result and not a prediction for your clinic.

  1. Evidence

    A week of approved session data for one client. Only the data the update needs is used, which is the minimum-necessary rule.

  2. Rule

    Before any model is called, the provider's eligibility and the clinic's agreement are checked. If a condition is not met, the request fails closed.

  3. Proposal

    A weekly update is drafted with help from AI and marked as AI-written. A family cannot see it yet.

  4. Approval

    A BCBA reads it, edits it and approves it by name. Until then it stays a draft.

  5. Action

    The approved update is released to the family, marked as reviewed and approved by the BCBA.

  6. Audit

    The receipt records who approved what, when, and which evidence the draft cited.

What ABACare does today, and what it does not.

  • Does: require an executed BAA and a readiness review before production PHI, and keep demo and sandbox work on synthetic data.
  • Does: keep a record of who approved each AI-assisted output.
  • Does not: claim HIPAA certification. This page describes safeguards, not a certification.
  • Does not: let an AI draft sign a note, release a family update or reach a payer on its own.

Questions about AI and PHI.

Is ABACare HIPAA compliant?
ABACare does not claim HIPAA certification. This page lists the safeguards that exist: a BAA before production PHI, clinic-scoped access, minimum-necessary AI data, audit trails and human approval. The full detail is on the security page.
Will ABACare sign a Business Associate Agreement?
Yes. A BAA is executed before a clinic introduces production PHI, and a separate readiness review confirms coverage, enabled services and data flows.
Does AI write notes or messages without a person?
No. AI prepares drafts. A clinician or biller approves anything that becomes part of the chart, the billing record or a family communication.
Can I try this without real client data?
Yes. The live demo is a fictional clinic: no password and no PHI. Start free opens a sandbox on synthetic data. Self-serve real client data requires a signed BAA and verified active Type-2 organization NPI; production use also follows a separate readiness approval.