Runtime controls in your stack
PHI redaction, consent verification, scope-of-use limits, content filtering — the controls your AI committee specified now execute and emit signed evidence at runtime.
For Healthcare Organizations Deploying AI
Ambient scribes, CDSS, clinical chatbots, agent workflows — the AI committee approved them, but no one can show what they actually do at runtime. Glacis runs inside your infrastructure, instruments one deployed workflow with runtime controls, and produces signed evidence your AI committee, HIPAA security officer, and 42001 auditor can verify — with zero clinical payload egress.
Three weeks, one deployed clinical AI workflow, zero clinical payload egress.
The reality
Clinical AI is already in your environment. In the ambient scribe your clinicians use. In the CDSS your radiology team relies on. In the chatbot your front desk handed to patients. In the agent workflows procurement approved two quarters ago.
Most oversight today is paper — AI committee minutes, vendor questionnaires, quarterly attestations. None of it shows what your deployed workflow actually does on a Tuesday afternoon, or which guardrails fired when a clinician asked the model an off-label question.
The Sprint closes that gap on one deployed clinical AI workflow in three weeks — runtime controls instrumented in your stack, signed evidence receipts, and an evidence pack your AI committee and HIPAA security officer can verify.
How the sprint runs
Glacis runs beside your existing safety stack — instrumenting runtime controls, signing each control outcome, and packaging evidence your AI committee and auditors can verify without seeing protected health information.
PHI redaction, consent verification, scope-of-use limits, content filtering — the controls your AI committee specified now execute and emit signed evidence at runtime.
PHI, clinical notes, prompts, and responses stay inside your environment. Only signed hashes and verification metadata leave — designed to minimize BAA scope.
Timestamped, third-party notarized, cryptographically signed receipts assembled into a packet your AI committee, HIPAA security officer, and external auditors can verify on their own.
What the auditor gets
Each control execution emits a signed receipt. Receipts assemble into evidence packs an AI committee or 42001 auditor can verify against the issuer’s public key, offline.
import { attest } from '@glacis/runtime'; const receipt = await attest({ workflow: 'scribe.note', policy: 'health.scribe.phi.v3', decision: 'REDACT', rules: ['phi.redact', 'consent.ok'], }); // → signed OVERT receipt; PHI never leaves the box
What changes for your team
Stop reconstructing what happened from logs and interviews. Every AI interaction that passes through your controls generates verifiable evidence automatically. Audit prep becomes report generation, not archaeology.
Answer “how do we know our AI is safe?” with evidence, not assurances. A dashboard of verified control executions, not a policy document. Confidence backed by cryptographic proof.
No workflow changes. Glacis observes your existing controls — it doesn’t replace them. Your clinicians keep working exactly as they do today. Evidence generation is invisible to end users.
Give them what they actually want: proof that your governance isn’t just documented, it’s operational. Evidence they can verify without trusting your word. Third-party verifiable, not self-attested.
If consent hasn’t been verified, the request doesn’t proceed. If PHI detection fails, the pipeline stops. Glacis enforces your policies — it doesn’t just report on them.
EU AI Act classifies most clinical AI as high-risk. Colorado, Texas, and CMS are watching. Regulators want evidence governance happened — not documentation it was planned.
Architecture, not policy
PHI, clinical notes, prompts, and responses are hashed locally inside your infrastructure. Only signed hashes and verification metadata cross the boundary.
Related guides
Fixed scope. Three weeks. One deployed clinical AI workflow. Runtime controls instrumented inside your stack, evidence mapped to HIPAA, the AI committee charter, and emerging state AI laws. No clinical workflow disruption.
Or learn how continuous attestation works →