A HIPAA-compliant AI assistant inside a hospital’s Azure environment

Context and role

The problem

A hospital cannot treat an AI assistant like a consumer chatbot. Patient data has to stay inside an approved environment, access has to be authenticated, and activity has to be auditable.

The models were already deployed in Azure AI Foundry. The open question was the application layer: how to integrate them correctly, handle the interaction, and make the whole system operate inside a HIPAA-compliant boundary.

The customer needed a technical contact who could discuss requirements and security constraints directly, not a ticket queue between the hospital and the engineering team.

Approach

• Worked as the hospital’s primary technical point of contact for the AI and application scope: requirements, technical discussions, security discussions and delivery communication.
• Integrated the already-deployed Azure AI Foundry models into the application, and made the application changes needed for correct and secure operation.
• Implemented the application so that it operated with HIPAA-compliant data isolation, authentication and audit trails, inside Azure Container Apps.
• Kept the system inside a controlled enterprise environment rather than a public deployment.
• Collaborated with a supervising colleague and one other teammate. I was the AI and application expert alongside that supervisor, not the sole owner of the solution.

What I did not claim

The boundary of a project is part of its evidence. These are the claims this work does not support.

• Not deployment or DevOps ownership. A separate part of the team handled deployment.
• Not sole ownership of the solution. This was team delivery with a supervisor and one other teammate.
• Hugging Face Transformers was not used on this project. The models were pre-deployed Azure AI Foundry models.
• The hospital is not named on this public page. A reference can be provided under NDA.

Results

• The AI and application layer operated inside a HIPAA-compliant Azure environment, with data isolation, authentication and audit trails.
• The hospital had a single technical point of contact for the AI and application scope across requirements, security and delivery.
• The delivery stayed within a controlled enterprise environment, which is the constraint that made the project worth doing.
• No performance metrics are published: clinical and client data are confidential.

Stack

• Microsoft Azure
• Azure AI Foundry models
• Azure Container Apps
• HIPAA data isolation
• Authentication and audit trails

What this means for you

The useful part of this project is not the artifact. It is the method: define the measurement first, keep the scope honest, and hand over something your team can run. That method is what transfers to a new problem.

If your situation looks similar, the related services below are the place to start. If it does not, send a short description and I will tell you whether I am the right person.

Related services