Healthcare document AI that reads clinical paperwork and keeps patient data where it belongs
Healthcare document AI uses language models to read clinical notes, referrals, intake forms, prior authorizations and claims: extracting fields, summarising records and answering questions with a citation to the source page. When documents contain protected health information (PHI), HIPAA requires a business associate agreement (BAA) with every vendor that handles it, including the model provider, and not every AI product or feature qualifies. Sysvoy builds healthcare document AI on services that can be covered by a BAA, such as the OpenAI and Anthropic APIs with their HIPAA settings, AWS Bedrock, Azure and Google Cloud, or on open-weight models inside your own environment, with access controls and audit logs. When our team needs access to PHI, we sign a BAA with you.
The path a question takes
Documents are parsed and split, embedded, searched, and the answer cites the passages it came from.
- Ingest
- Chunk
- Embed
- Retrieve
- Answer
Where healthcare AI projects stall
And what we do differently.
A BAA on the model, not on the feature
Signing a BAA with a provider doesn't cover every endpoint. Batch jobs, file storage, code execution or web fetching can fall outside it, and the list differs by provider. We check each feature the design uses.
Real patient data in the prototype
Early experiments with live PHI create risk before there's anything to show. We prototype on de-identified or synthetic records.
Outputs nobody can verify
A summary without sources has to be re-checked against the full record. Ours cite the page for every field and statement.
What we build
Clinical document extraction
Referrals, intake forms, lab reports and faxed records turned into structured fields, exported to your EHR or practice system through its import or API, each with the page it came from.
Record summaries with citations
Long patient histories summarised for clinicians or reviewers, where every statement links back to the note that supports it.
Prior authorization and claims review
Checks submitted documents against payer criteria and flags what's missing, so staff review exceptions instead of every page.
Clinical knowledge assistants
Answers from your protocols, formularies and guidelines for staff, with the source section shown and no patient data involved.
De-identification pipelines
Removal of the identifiers HIPAA lists before data is used for analytics, testing or model evaluation.
How we deliver
From the first workshop to production. How we work
Map where PHI goes
Every service that touches PHI must sit under a BAA, and some features of covered APIs are excluded. We map the data flow and switch off what isn't covered. Where our team needs access to PHI, we sign a BAA with you first, and agree access rules with your compliance team before any real data is shared.
Prototype without real patients
We build and tune on de-identified or synthetic documents, so the first versions never need live PHI.
Evidence with every output
Each extracted field and summary sentence points to its source page, and low-confidence results go to a person for review.
Access control and audit logs
Users see only the records their role allows, and every view, query and model call is logged for your compliance team.
Ways to run AI on patient documents, compared
| Consumer AI app | Model API with a BAA | Open-weight model in your environment | |
|---|---|---|---|
| Use with PHI | No: consumer plans and ChatGPT Business are excluded | Yes, with the BAA signed and HIPAA settings on | Yes, under your own controls |
| Where data goes | Vendor's servers, consumer terms | Provider's cloud, under the BAA | Stays in your cloud or data centre |
| Model quality | High | Highest available | Good, depends on the model and hardware |
| Running cost | Per seat | Per token used | Servers, mostly fixed monthly |
| Best for | Nothing involving patient data | Most document AI that touches PHI | Strict data rules or very high volume |
A good fit when
- Staff spend hours re-keying data from faxes, PDFs and scanned forms.
- Clinicians or reviewers read long records to find a few facts.
- You're a health-tech company adding AI, and your customers' security reviews ask where patient data goes.
What we build with
- Python
- TypeScript
- OCR and layout parsing
- PostgreSQL
- OpenAI and Anthropic APIs with HIPAA settings
- AWS Bedrock
- Azure
- Google Cloud
- Open-weight models with vLLM
- Audit logging
Related work
PostureScreen
Clinical-grade posture assessment app used by practitioners to screen and track patients.
postureanalysis.com ↗midpage.ai
AI research platform that layers analysis over case law for litigators and legal teams.
midpage.ai ↗AI commerce assistant
Self-hosted AI shopping assistant, Typesense product search and HubSpot integration for a US B2B distributor.
US distributor
Common questions
Not answered here? Email contact@sysvoy.com.
Can we use ChatGPT or Claude with patient data?
Only specific offerings, under a signed BAA. As of November 2026, OpenAI covers its API with a BAA and its retention settings applied, ChatGPT Enterprise with the Regulated Workspace, ChatGPT for Healthcare and ChatGPT for Clinicians. Anthropic covers its API with HIPAA readiness enabled and Claude Enterprise with HIPAA turned on. Consumer plans are excluded, and so is ChatGPT Business. Check the provider's current terms before any PHI goes in. This is general information, not legal advice; confirm requirements with your compliance team.
Will Sysvoy sign a business associate agreement?
Yes. When our engineers will have access to PHI, we sign a BAA with you before any real patient data is shared, alongside the BAAs with the model and cloud providers in the design. Where we can, we build and test on de-identified or synthetic data so our team doesn't need PHI access at all.
If the model provider signs a BAA, is every feature covered?
No. Coverage is feature by feature. Anthropic's Batch and Files APIs fall outside its HIPAA configuration, for example, and OpenAI's list of eligible endpoints is published separately. We check each feature a design relies on and switch off the ones that aren't covered.
Can we avoid sending PHI to a model provider at all?
Yes, in two ways. De-identify documents first, using HIPAA's Safe Harbor method of removing 18 listed identifiers, or an expert determination. Or run open-weight models inside your own cloud or data centre, so patient data never leaves your environment.
How much does a healthcare document AI project cost?
Most projects for one document type, such as referrals or intake forms, cost $8,000–$20,000 and take 4–8 weeks. Work across several document types, with export into your existing systems, usually costs $20,000–$45,000. Self-hosted models add server costs. A 1–2 week discovery sprint turns this into a fixed quote.
Does the proposed HIPAA Security Rule update change anything?
Not yet. HHS proposed a rewrite of the Security Rule in January 2025, and it isn't final; the federal regulatory agenda now targets July 2027. The proposal would require AI tools that touch electronic PHI to appear in your asset inventory and risk analysis. We document every component that handles PHI, so you're ready either way.
What about UK and EU health data?
Under UK and EU GDPR, health data is special category data, so you need an Article 9 condition on top of a lawful basis. Suppliers with access to NHS patient data or systems must also complete the NHS Data Security and Protection Toolkit. Our GDPR guide covers how we set up projects with European data.
Can the AI make clinical decisions?
We build it to support people, not replace them. Outputs cite their sources and uncertain results go to a person for review. US healthcare providers that receive federal financial assistance also have a duty under Section 1557 to identify and reduce discrimination risks in patient care decision support tools, which includes AI.
Have something to build?
Tell us where things stand and what you need. A short message is enough to start.