The Short Answer
Clinical AI stalls at the information layer — retrieval, permissions and audit — not at the model. On ibl.ai you own all the code and the data, so PHI is processed inside your perimeter and minimum-necessary is enforced at query time rather than at display time. It is model-agnostic with no per-seat pricing, and deploys anywhere, including fully air-gapped.
Healthcare AI roadmaps converge on the same promise: private clinical AI, available around the clock, HIPAA compliant.
The promise is reasonable. What is rarely priced is what those three words quietly require, and none of it is a model capability.
They require inference inside the perimeter, field-level access control enforced during retrieval, and an audit trail that can stand alone as the account of what happened. Swap in a better LLM every quarter and not one of those three gets closer.
Why is the minimum necessary standard a retrieval problem?
Because it constrains what the system may read, and most clinical AI enforces it on what the system shows.
HIPAA's minimum necessary standard, at 45 CFR 164.502(b), requires reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose.
Now consider a typical retrieval-augmented clinical assistant. It indexes the chart, retrieves the passages most similar to the question, and generates an answer. Access control is applied to the output — the interface hides what this user should not see.
By then the model has already read the fields that user was not entitled to, and the summary it produced is downstream of them. Filtering the answer does not unread the record.
This is the distinction that gets lost: minimum necessary is a constraint on retrieval, not a constraint on display. Enforcing it correctly means the retrieval layer resolves each request against that specific user's entitlements before any content reaches the model.
That is architectural work, and it is invisible in a demo running on de-identified data — which is exactly the demo that gets funded.
What does "24/7" actually add to the requirement?
It removes the human witness, which changes what the audit trail is for.
When a clinician queries a record, that clinician is the account of why. When an agent runs unattended overnight — reconciling records, drafting follow-ups, triaging a queue — nobody watched, and the log becomes the only evidence of what was accessed and on whose behalf.
The Security Rule anticipates this. 45 CFR 164.312 requires audit controls that record and examine activity in systems containing electronic PHI, alongside technical access controls.
For an autonomous agent that means logging more than the answer: the identity the request ran under, the fields retrieved, the tool calls made, and the model that produced the output. Reconstructing that after an incident is not possible if it was not captured at the time.
An agent that cannot produce that record is not a compliance risk in the abstract. It is a system whose behaviour cannot be explained to an investigator.
Doesn't a BAA cover this?
A business associate agreement governs the disclosure. It does not prevent it, and it does nothing about the two problems above.
Sign a BAA and the vendor is bound to safeguard PHI, restrict its use, and report breaches. That is real, and it is how most healthcare technology is bought.
What it cannot do is stop PHI from leaving your network, and it cannot enforce minimum necessary inside a retrieval system you do not operate. Those are properties of where the system runs and how it was built.
We set the two approaches side by side in HIPAA BAA vs Self-Hosted AI. The short version: a BAA makes cloud clinical AI defensible; it does not make it private, and the distinction becomes sharper the more autonomous the system is.
Why do clinical AI pilots stall after the demo?
Because the demo runs where the information layer does not exist yet.
A pilot on de-identified data, or on a single department's documents, has no minimum-necessary problem, no cross-system entitlement resolution, and no audit obligation worth the name. It works, it impresses, and it gets funded.
Production has all three.
That gap is why 79% of enterprises reported AI cost overruns in the past twelve months and 88% of AI pilots never reach production — and healthcare has a stricter version of the general problem, because the layer that has to be built is also the layer a regulator will examine.
McKinsey's assessment is that AI solutions are proliferating faster than health systems can absorb them, which is the same observation from the demand side: the constraint is not the supply of models.
The consequence for planning is direct. Budget the information layer first, and treat the model as the cheap, replaceable part — because it is.
What does getting the information layer right require?
Four things, and they are architectural rather than contractual.
Inference inside the perimeter. PHI in a prompt is PHI. If the model runs on your infrastructure there is no disclosure to govern, which is a materially different starting position from governing one well.
Entitlement resolution at query time. Retrieval must ask what this user may see in the source system, on every request, across every system involved — the SIS of healthcare being Epic, Oracle Health or athenahealth, plus whatever else holds the record.
Complete, exportable audit. Identity, fields retrieved, tool calls, model used, on your storage under your retention policy. Embeddings derived from PHI count, and they are the store most often forgotten.
A replaceable model layer. Clinical evaluation is expensive; being unable to change the model when a better or cheaper one appears means repeating it or living with the choice.
That is the shape of an ibl.ai deployment: self-hosted so PHI stays inside the clinical network, permissions-aware retrieval that honours each user's real entitlements, audit logging in systems the organization already examines, and model-agnostic routing so the clinical evaluation is not a one-way door.
The consolidation pressure that makes this urgent is covered in Healthcare AI Is Consolidating Into an Operating System, and the deployment architecture in HIPAA-Compliant AI: Keeping PHI on Your Own Infrastructure.
What should a health system ask a vendor?
Three questions that separate the information layer from the model.
At what point is minimum necessary enforced — retrieval or display? If the answer is display, the model has already read more than it should have.
Show me the audit record for one agent run. Not a dashboard. The identity, the fields, the tool calls, the model. If it cannot be produced on request, it will not exist when it is needed.
Where does the inference happen, and can it run with no outbound connectivity? This determines whether the first two answers are properties you can verify or assurances you are relying on.
A vendor with a real information layer answers all three concretely. A vendor selling a model answers the first with a roadmap.