What HIPAA means in practice
The Health Insurance Portability and Accountability Act governs the handling of Protected Health Information by US covered entities and their business associates. AI implications: any vendor processing PHI must execute a Business Associate Agreement, prompts to a cloud LLM that contain PHI are a controlled disclosure, and audit-trail expectations apply to model outputs that influence care. HIPAA permits cloud LLM use under a BAA in principle, but the BAA-review timeline at most covered entities has stretched to multiple quarters, which is why MindMap's US healthcare deployments are increasingly on-premise — by the time the cloud BAA closes, the on-prem deployment is already in production.
Related terms
Sovereign AI →
An architecture where customer data never leaves the network perimeter, model weights run on customer-controlled hardware, inference logs stay in the customer's SIEM, and the entire stack can operate air-gapped.
GDPR →
The EU's General Data Protection Regulation — sets the rules for processing personal data of EU residents, with significant implications for AI systems that touch that data.
Evaluation (evals) →
Systematic testing of an AI system against a curated set of inputs to measure quality on the dimensions the business cares about — accuracy, faithfulness, safety, format.
More in this category
All 62 terms, in plain language
Sovereign AI, RAG, agentic AI, IDP, MLOps and the regulations that shape enterprise AI.