What HIPAA means in practice
The Health Insurance Portability and Accountability Act governs the handling of Protected Health Information by US covered entities and their business associates. AI implications: any vendor processing PHI must execute a Business Associate Agreement, prompts to a cloud LLM that contain PHI are a controlled disclosure, and audit-trail expectations apply to model outputs that influence care. HIPAA permits cloud LLM use under a BAA in principle, but the BAA-review timeline at most covered entities has stretched to multiple quarters, which is why MindMap's US healthcare deployments are increasingly on-premise — by the time the cloud BAA closes, the on-prem deployment is already in production.
Related terms
Sovereign AI →
An architecture where customer data never leaves the network perimeter, model weights run on customer-controlled hardware, inference logs stay in the customer's SIEM, and the entire stack can operate air-gapped.
GDPR →
The EU's General Data Protection Regulation — sets the rules for processing personal data of EU residents, with significant implications for AI systems that touch that data.
Evaluation (evals) →
Systematic testing of an AI system against a curated set of inputs to measure quality on the dimensions the business cares about — accuracy, faithfulness, safety, format.
More in this category
The Sovereign AI Playbook.
Enterprise generative AI that runs on your servers.
- 01Definition. The four non-negotiable properties of a sovereign deployment — and the three patterns that look sovereign but aren't.
- 02Why now. Three forces that converged in 2026: regulator pressure, the open-weights capability gap closing, and unit economics flipping.
- 03Reference architecture. The five-layer stack we deploy: applications → agent runtime → sovereign LLM → RAG + KB → data stores. With model and tooling choices for each.
- 04The regulators. SAMA · RBI · UK ICO · EU AI Act · DPDP · HIPAA — what each requires and how it maps to architecture.
All 62 terms, in plain language
Sovereign AI, RAG, agentic AI, IDP, MLOps and the regulations that shape enterprise AI.