Healthcare

HL7/FHIR tools for AI agents, audit by default

ArcaX mediates HL7 v2 and FHIR inside your perimeter and gives agents clinical tools instead of database access — per-agent identity, PII redaction before the model, and a sealed per-call audit trail your privacy officer can export.

HL7 + FHIRNative mediation
< 50msP99 per tool call
Per-callSealed audit
100%On-premise. Zero egress.

Clinical tools, not wire formats

Agents reason over "admissions for ward X in the last 24h" or "medication list for encounter Y" — narrow, reviewable surfaces that a privacy officer can approve one by one.

  • HL7 v2 + FHIR R4 native connectors
  • Purpose-built tools per use case
  • Minimum-necessary by design

PHI protection in depth

Per-agent mTLS identity, OPA policy evaluated on every call, and direct-identifier redaction at the gateway — before results ever reach a context window.

  • No shared service accounts
  • Fail-closed policy, outside the model
  • PII/PHI redaction per result
  • Per-session budgets + circuit breaker

Evidence for the HIPAA Security Rule

Unique identification, access control, audit controls, minimum necessary, transmission security — each control has a default artifact: per-call, exportable, verifiable.

  • Append-only hash-chained audit
  • Policy decision log with denials
  • Per-call data-flow records
  • Offline integrity verification

Fits hospital topology

Deploys on the hospital's own Kubernetes, mediates inside the perimeter, fits segmented clinical VLANs — including fully air-gapped research environments.

  • No cloud dependency of any kind
  • Interface-engine friendly
  • Air-gap deployment option
  • Live in one afternoon
Governance first

Start where the evidence builds fastest

Operational agents

Bed management, staffing forecasts, referral logistics — real value on mostly non-PHI operational data, no clinical-decision risk.

Documentation support

Drafting support for discharge summaries and encounter notes — the agent reads, the clinician reviews and signs.

Quality audits

Completeness and coding-consistency checks across encounters — high volume, low blast radius, measurable in weeks.

Full architecture pattern →

Aligned with the HIPAA Security Rule, by design

HIPAA-Aligned Architecture Unique Identification Audit Controls Minimum Necessary Air-gap Ready

All compliance references indicate architectural readiness and alignment with the applicable framework, not formal third-party certification. Validate your implementation with your privacy officer and counsel.

Request a Demo