Defensible AI in healthcare. With the audit to prove it.

A vendor pilot graduated. Or an innovation team’s AI-mediated symptom checker shipped to production. Or your patient portal added an AI summary feature. Now your privacy officer has a question — what’s our exposure? — and the answer is some combination of “the vendor said it’s HIPAA-compliant,” “we have a BAA somewhere,” and “we ran axe-core once.” Those answers may not be sufficient under OCR enforcement scrutiny, malpractice discovery, or class-action proceedings. The audit produces evidence-backed documentation calibrated to those scrutiny lenses.

PHI plus AI is ghost-summoning with regulatory teeth. Your privacy officer didn’t approve a vendor relationship; the innovation team summoned a powerful pattern-completion engine into a system that holds protected information, and the OCR doesn’t care that nobody briefed your CCO. The audit is the exorcism, the BAA chain is the warding, and the regulatory grounding — 45 CFR 164.302–164.318, FDA AI/ML SaMD screening, breach-notification mechanics — is what makes the deployment defensible instead of a malpractice theory waiting for discovery.

Generic compliance audits don’t fix this. Most run a checklist scored from interviews; they don’t read the code, don’t enumerate the BAAs, don’t screen for SaMD exposure, and don’t model the agentic-attack threat surface against your environment specifically. The findings are advisory. The privacy officer’s job is not advisory.

You need an engineering audit. Specific to AI. Specific to healthcare. Specific to your system. BST is the operator that built HELiX — our open-source healthcare component library shipping at WCAG 2.1 AA — and runs an active engagement at one of the largest health systems in the country. The Compliance Review is not a healthcare-curious security firm doing a side project; it is a healthcare-credentialed engineering audit run by the principal who already lives inside the regulatory and accessibility constraints your system has to meet.