← All posts

Industry Verticals

256 posts on industry verticals.

Is Grok HIPAA Compliant? The BAA and Zero Data Retention Gate

SpaceXSI publishes a BAA request path for customers using its APIs, and its Enterprise Terms require both an executed BAA and the Zero Data Retention-enabled API before protected health information is submitted. That public evidence establishes conditional API eligibility, not blanket HIPAA compliance for every Grok product. Healthcare teams must verify the executed agreement, order form, API route, ZDR status, subprocessors, customer controls, and exact workflow before sending PHI.

hipaaai-compliancegrokai-securitypolicy-enforcementaudit
Read post →

Is Zoom AI Companion HIPAA Compliant? A BAA and Feature Review

Zoom AI features can support a HIPAA-regulated workflow when the customer has a Business Associate Agreement with Zoom, the selected AI feature is available under that BAA, and the organization configures and governs the workflow. Availability can vary by feature. This guide separates the contract decision from the customer controls needed before protected health information enters a Zoom AI workflow.

hipaaai-compliancezoomai-securityphibusiness-associate-agreement
Read post →

Is Perplexity HIPAA Compliant? Verify the BAA and Service Scope

Perplexity publicly describes its Enterprise offering as HIPAA compliant and its security program as using HIPAA-aligned safeguards. Those statements do not replace a signed Business Associate Agreement or identify the exact services and features covered by it. A healthcare organization should keep PHI out until it has the executed BAA, covered-service schedule, account configuration, data-flow map, and customer control evidence for the intended workflow.

hipaaai-complianceperplexityai-securitypolicy-enforcementaudit
Read post →

AI Data Protection for Wealth Management Starts Before Transmission

Wealth-management AI requests should reduce household profiles to the fields an approved task needs, then verify the adviser, application, provider account and route before transmission. SEC Regulation S-P safeguards and FINRA guidance anchor this pre-transmission policy, while advice, supervision, records and provider-internal processing stay with their established owners.

ai-securityai-governanceai-compliancedata-loss-preventionpolicy-enforcementidentity-and-authorization
Read post →

Is Claude HIPAA Compliant? Four Gates Decide the Answer

Claude can support HIPAA-regulated workloads only when an eligible Anthropic commercial service is covered by an accepted Business Associate Agreement, HIPAA mode is activated where required, the chosen capability is included, and the healthcare organization applies its own access and audit controls. This guide follows one PHI-bearing request through those four gates and marks the exact limits of API enforcement.

hipaaai-complianceai-securityidentity-and-authorizationpolicy-enforcementaudit
Read post →

Is ChatGPT HIPAA Compliant? The Answer Depends on the Product Boundary

ChatGPT can support HIPAA-regulated work only inside an eligible OpenAI product, under a signed Business Associate Agreement, with covered features and the healthcare organization's own safeguards in place. Consumer access and a generic enterprise subscription are insufficient answers for a deployment review. This guide traces a PHI-bearing request through the product, contract, feature, minimum-necessary, and audit checks that determine eligibility.

hipaaai-complianceai-securitypolicy-enforcementauditdata-loss-prevention
Read post →

AI Governance for General Counsel: Turn Legal Duties Into Testable Decisions

AI governance gives General Counsel a traceable path between a legal obligation, the policy approved to address it, and the evidence produced when employees or agents use an LLM. The legal team should own the interpretation, decision rights, privilege rules, and escalation triggers while security and engineering implement the controls.

ai-governanceai-compliancecomplianceauditpolicy-enforcementidentity-and-authorization
Read post →

AI Governance for Procurement Leads: Buy the Evidence Before You Buy the Model

AI procurement should define the evidence, control access, incident duties, model-change notice, data-use limits, and exit rights the business needs before vendor selection. The procurement lead owns a repeatable gate that converts AI risk requirements into scored evidence and contract terms, then hands production monitoring to named control owners.

ai-governanceai-compliancecomplianceauditpolicy-enforcementnist-ai-rmf
Read post →

Shadow AI in Media and Publishing: Sources, Embargoes, and Unpublished Work

Shadow AI in media and publishing can move confidential source material and embargoed copy into unapproved LLM services. Unpublished manuscripts and licensed assets can follow, as can legal-review notes. This article defines the editorial data at risk, separates input control from output provenance, and sets out request-level enforcement for authenticated HTTP AI traffic.

shadow-aiai-securityai-governancedata-loss-preventionpolicy-enforcementaudit
Read post →

Shadow AI in Health Payers: Member PHI, Claims, and Utilization Management

Shadow AI in health payers can send member PHI, claims histories, utilization management records, and appeal narratives to unapproved model services. This article maps the exposure to HIPAA Privacy and Security Rule duties, Business Associate Agreement scope, and CMS payer data exchange requirements, then defines enforceable controls for outbound HTTP LLM traffic.

shadow-aiai-securityai-governancehipaapolicy-enforcementaudit
Read post →

FINRA AI Controls Mapping for Broker-Dealer Supervision

This FINRA AI controls mapping connects supervisory, communications, recordkeeping, vendor, and routed-request objectives to accountable owners, control points, repeatable tests, retained evidence, and explicit gaps. It separates FINRA source language from implementation choices and gives an HTTP gateway credit only for decision evidence on traffic that actually traverses it.

ai-complianceai-governancecomplianceregulationauditpolicy-enforcement
Read post →

AI Governance for Wealth Management Assigns an Owner to Every Use Case

AI governance for wealth management should separate research assistance, client communications, personalized advice, portfolio actions, and operations into distinct approval lanes. Each use case needs a business owner, supervisory owner, technical owner, approved client data, model route, authority ceiling, tests, and change triggers. Request-layer controls provide one evidence stream for firm-controlled HTTP traffic, while advisers and principals retain responsibility for advice, review, conflicts, records, and client outcomes.

ai-governanceai-compliancepolicy-enforcementauditidentity-and-authorization
Read post →