Industries · Healthcare

Redact PHI in flight. Keep the record an auditor asks for.

Clinical copilots, ambient documentation, and patient messaging send records to a model. Meilynx redacts protected health information before the request leaves your perimeter and records what reached which model, under which configuration, and who reviewed the output.

See a demo Request a sample examination package

Outcomes

Use AI in care with the evidence in hand.

HIPAA Security Rule01

PHI redacted before it reaches a model

PHI detection with in-flight redaction, per workflow and provider. The record keeps placeholders only.

Business associates02

The provider list your BAAs must cover

An inventory of the LLM providers in use, generated from traffic.

State AI laws03

Clinician review on the record

Clinician-review records sit in the same tamper-evident chain as the AI output they cover.

OCR audit04

A record ready for a breach assessment

A hash-chained record of every AI request answers the first question an investigator asks.

Proof

Evidence your reviewers can check.

Request a sample examination package

Audit

SOC 2 Type I

Report issued for Security, Availability, and Confidentiality. The Type II observation period is underway.

Verification

Open-source verifier

Reviewers check the audit chain themselves, offline, with no Meilynx system in the loop.

Coverage

5 frameworks

Each ships as a preset, with a control mapping and the examination package it produces.

Isolation

Single-tenant

An isolated data plane for each organization, in every deployment mode.

Trust Center →How verification works →

Frameworks that apply

HIPAA HHS §1557 ONC HTI-1 Healthcare AI FDA AI Lifecycle

For the CCO For the CISO

FAQ

Common questions.

Which healthcare frameworks ship as presets?

HIPAA Security Rule, HHS Section 1557 patient care decision support, ONC HTI-1 decision support transparency, Healthcare AI Governance for the Texas, California, and Colorado laws with the Joint Commission / CHAI guidance, and an optional FDA AI lifecycle readiness preset. SOC 2 Type II applies as it does everywhere.

We are a payer, not a provider. Which applies?

Section 1557 and the Colorado utilization-review law reach payers directly; HIPAA applies to the health plan as a covered entity; HTI-1 applies where the plan deploys certified health IT. The Healthcare AI Governance preset covers the utilization-review safeguards as readiness ahead of Colorado's 2027 effective date.

Reference

The HIPAA Security Rule and AI Workloads, ExplainedWhat the HIPAA Security Rule requires when covered entities and business associates route electronic PHI through AI tools: business associate agreements, risk analysis, audit controls, minimum necessary, breach notification, and the pending update.HHS Section 1557 and Patient Care Decision Support Tools, ExplainedWhat 45 CFR 92.210 requires of covered entities that use clinical algorithms and AI: identify tools with protected-class inputs, mitigate the risk of discrimination, and where enforcement stands in 2026.ONC HTI-1 Decision Support Interventions, ExplainedThe 31 source attributes and the risk management practices 45 CFR 170.315(b)(11) requires for predictive decision support, what deploying organizations should ask their developer for, and where HTI-5 stands.FDA's AI-Enabled Device Guidance: PCCP and Lifecycle, ExplainedWhat FDA's final predetermined change control plan guidance (December 2024) and draft lifecycle guidance (January 2025) recommend for AI-enabled device software functions, and what a deploying organization can prepare.State Healthcare AI Laws: Texas, California, Colorado, ExplainedWhat Texas SB 1188 and HB 149, California AB 3030, SB 1120 and AB 489, and Colorado HB 26-1139 and SB 26-189 require of providers and payers using AI, with the Joint Commission and CHAI guidance.Healthcare AI compliance in 2026: the five questions and the evidenceWhat HIPAA, HHS Section 1557, ONC HTI-1, and the Texas, California, and Colorado laws ask of clinical AI, and the evidence that answers.

Get started

See the evidence on your own traffic

A 15-minute walkthrough of inline enforcement, the audit chain, and the examination package.