Protect health information and govern AI in one compliance program
Backsplice gives healthcare organizations one place to run HIPAA compliance and AI governance. Register each system once and mark whether it handles ePHI, uses AI, or both. Assess your program and each system against the HIPAA and AI governance framework packs. Keep the security risk analysis, business associate agreements, incidents and breach notifications, and take every AI system through a recorded review and approval. Watney, the AI assistant, drafts cards, suggests how to triage a new system and answers questions from your records.
Free plan, no time limit · No card needed · Unlimited team members
What the program keeps for HIPAA and for AI
Each system's record shows whether it handles ePHI and how that ePHI is protected, and whether it uses AI and who approved it. Assessments, reviews and the HIPAA records attach to that same record.
One register of systems
Every system your organization builds, buys or runs, entered once and marked as handling ePHI, using AI, or both. Link the devices that run each one, and record the models and vendors behind it.
HIPAA and AI governance assessments
Assess your organization's program, and each system on its own: HIPAA questions where ePHI is handled, AI governance questions where AI is used. Questions come from the framework packs, and each kind of assessment has its own score.
Policies and training
Adopt HIPAA and AI governance policies from templates and track who has acknowledged each one. Assign courses to your workforce, keep the record of who completed them, and record workforce sanctions alongside.
The security risk analysis
A dated, approved risk analysis of the ePHI you hold, built from threat scenarios rated for likelihood and impact. Add any scenario to the risk register with its likelihood and impact ratings, where your HIPAA and AI risks are managed together, each categorized by HIPAA safeguard area or by AI trustworthiness characteristic.
Review and approval by risk tier
A system that uses AI moves into use through a recorded review. Its risk tier sets who must approve it and whether any, a majority or all must agree. Each approver can approve, approve with conditions, reject or send back, and each decision carries a reason.
Incidents and breach notification
An incident asks whether PHI was involved and whether an AI system was. PHI opens the breach risk assessment, and a breach of unsecured PHI lists each notice it owes, to individuals, HHS, the media or the covered entity, with its deadline and the date it was given.
Impact assessments and monitoring
Write an AI impact assessment for a system, and a fundamental rights impact assessment where the EU AI Act may call for one, each signed when it is published. Set a monitoring plan for the metrics to watch, and open an incident or a re-review when one passes its action threshold.
Business associates
A vendor that handles PHI for you is listed as a business associate, with the state of its business associate agreement and a reminder before the agreement expires. Keep your due diligence on every vendor and send it security questionnaires.
Model and system cards
Write a card for each model and each system. Publishing a card freezes that version with a tamper-evident seal, and on a paid plan your published system cards can be listed on a public transparency page.
Requests and the disclosure log
One inbox for requests from individuals: access, amendment, an accounting of disclosures, restrictions and confidential communications, beside requests about AI decisions. Log each disclosure of PHI as it is made, and produce an accounting from the log.
Watney, the AI assistant
Watney drafts cards, suggests how to triage a new system and answers questions grounded on your organization's records. Approving a system, setting a risk tier and publishing stay with your people. An organization admin opts in before Watney reads your data.
Evidence and an audit trail
On a paid plan, assemble the HHS Office for Civil Rights (OCR) audit package or a system's approval dossier, export your registers as CSV or PDF, and give an auditor a link. Every change is written to a hash-chained audit log, so a later change to an entry is detectable unless it is made by someone holding the application's signing key and database access.
Four steps to a program you can show an auditor
Register your systems
Record each system once and mark whether it handles ePHI, uses AI, or both. Add the vendors that supply it, with your due diligence on each and whether it is a business associate, and the models it uses with their versions.
Assess the program and each system
Write the security risk analysis and run the HIPAA and AI governance program assessments, then each system's, with the questions that apply at each level. Attach evidence as you go.
Fix gaps and record approvals
Turn findings into remediation tasks with an owner and a due date. Approve the risk analysis, and submit each system that uses AI for review, where its risk tier sets the approvers and every decision is recorded with its reason.
Keep it current
Log incidents and requests as they arrive, with the deadlines the law sets. Renew business associate agreements before they expire, publish model and system cards, and re-review each AI approval on the date its risk tier sets.
Framework packs, breach deadlines and review decisions
Framework packs included
NIST AI RMF 1.0, NIST AI 600-1 (Generative AI Profile), HIPAA Security and Breach Notification Rules (45 CFR 164 Subparts C–D, eCFR 2026-10-06), HIPAA Privacy Rule (45 CFR 164 Subpart E, eCFR 2026-10-06) and 24 other framework packs. The Free plan includes them too, except the HIPAA Privacy Rule and the optional HIPAA packs: a HIPAA assessment on it asks the HIPAA Security and Breach Notification Rules questions only. Questions are asked for your program and for each AI system and each system that handles ePHI.
Days from discovery, the outer limit to notify individuals of a breach of unsecured PHI
Set by the Breach Notification Rule. A law enforcement delay under § 164.412 can extend it, and state laws can set their own deadlines. When an incident is assessed as a breach of unsecured PHI, Backsplice lists each notice it owes and the date it is due.
Decisions open to each approver of an AI system
Approve, approve with conditions, reject or send back. Each is recorded with its reason, and each approval opens a re-review when its review date arrives.
What a spreadsheet leaves out
A list of systems cannot show where your ePHI is, how it is protected, or who approved each AI system and why. Backsplice keeps that record as you work.
Works with your identity provider and security tools
Connect sign-in, user provisioning, your SIEM and your own systems through standard protocols. Single sign-on, SCIM provisioning, the API and MCP server, webhooks and SIEM forwarding come with a paid plan; MFA and the IP allowlist are on every plan.
A Free plan, and two paid plans with the same features
Start on the Free plan, no card needed. The paid plans differ in how many AI systems and systems that handle ePHI you register, and Watney's fair-use limit scales with the plan.
Free
No card, no time limit
Set up your register of systems, run HIPAA and AI governance assessments and approvals, and invite the people who review and approve.
- ✓ 1 AI system
- ✓ 1 system that handles ePHI
- ✓ Every AI governance framework pack, assessments, approvals and cards
- ✓ HIPAA assessments of the Security and Breach Notification Rules
- ✓ Unlimited team members
- Watney, exports and scheduled report emails, auditor and guest links, the transparency page and public badge, the API and MCP server, webhooks and SIEM forwarding, and SAML single sign-on and SCIM provisioning come with a paid plan; the download of all your organization's data works on every plan.
Premium
or $999/year, about two months free
For a team running its first AI system and its first system that handles ePHI, adding systems as it goes.
- ✓ 1 AI system (more at $49/month or $499/year each)
- ✓ 1 system that handles ePHI (more on request)
- ✓ Watney, the AI assistant, within fair-use limits
- ✓ Every framework pack, assessments, approvals, model and system cards, and the registers
- ✓ Exports, auditor and guest links, and the public transparency page
- ✓ API, MCP, webhooks and SIEM forwarding
- ✓ SAML single sign-on, SCIM and unlimited team members
Enterprise
or $4,999/year, about two months free
For an organization with many systems that use AI or handle ePHI.
- ✓ Unlimited AI systems
- ✓ Unlimited systems that handle ePHI
- ✓ Watney, the AI assistant, within fair-use limits
- ✓ Every framework pack, assessments, approvals, model and system cards, and the registers
- ✓ Exports, auditor and guest links, and the public transparency page
- ✓ API, MCP, webhooks and SIEM forwarding
- ✓ SAML single sign-on, SCIM and unlimited team members
Premium and Enterprise have the same features, Watney and every framework pack included; they differ in how many AI systems and systems that handle ePHI you register, and Watney's fair-use limit scales with the plan. Every system counts except rejected, suspended and retired ones. A new organization starts on the Free plan, with no time limit. If a paid plan ends, the organization moves to the Free plan; nothing is deleted because a plan ended, and the organization itself is deleted only when an organization admin closes it.
Frequently asked questions
Why run HIPAA compliance and AI governance together? +
They concern the same systems. An AI tool that handles protected health information belongs in your HIPAA risk analysis and in your AI governance review, and its vendor is often a business associate. Backsplice records each system once, marked as handling ePHI, using AI, or both, and the HIPAA and AI governance questions follow those marks. Each kind of assessment has its own score, and the two are never combined into one number.
Does it cover the HIPAA security risk analysis? +
Yes. Build a dated risk analysis of the ePHI you hold from threat scenarios, each rated for likelihood and impact, and approve it. Approving it records your own review; whether it is the analysis the rule requires is for your organization to decide. Add any scenario to the risk register with its likelihood and impact ratings, its decision and its recommended controls, where your HIPAA and AI risks are managed together, each categorized by HIPAA safeguard area or by AI trustworthiness characteristic.
How is this different from tracking compliance in a spreadsheet? +
Backsplice keeps the structure a program needs as you work: which systems handle ePHI and which use AI, the risk analysis and its risks, each business associate and the state of its agreement, assessment answers with their evidence, incidents with their breach notification deadlines, AI reviews with approvers set by policy and a reason for every decision, and an audit trail of who changed what.
Which frameworks are included? +
Premium and Enterprise include these framework packs: NIST AI RMF 1.0, NIST AI 600-1 (Generative AI Profile), NIST Cyber AI Profile (IR 8596 initial preliminary draft), NIST COSAiS Predictive AI (built from NIST's January 2026 outline), ISO/IEC 42001:2023, ISO/IEC 42005:2025, ISO/IEC 23894:2023, EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744), EU AI Act GPAI model obligations (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744), NYC Local Law 144 of 2021 (AEDT), Colorado ADMT Act (C.R.S. 6-1-1701 to 6-1-1709, SB 26-189), California CCPA Regulations on ADMT and Risk Assessments (2025), California Civil Rights Council Regulations on Automated-Decision Systems (2025), Illinois Human Rights Act (775 ILCS 5), as amended by P.A. 103-0804 (HB 3773), Texas Responsible Artificial Intelligence Governance Act (H.B. 149, 2025), Utah AI Laws (Utah Code 13-72, 13-72a, 13-77 and 58-60-118, as amended through 2026), UK AI Cyber Security Code of Practice (2025), Singapore Model AI Governance Framework (2nd ed., 2020), Singapore Model AI Governance Framework for Generative AI (2024), Singapore Model AI Governance Framework for Agentic AI (v1.5, 2026), OWASP Top 10 for LLM Applications 2026, MITRE ATLAS 2026.09, HIPAA Security and Breach Notification Rules (45 CFR 164 Subparts C–D, eCFR 2026-10-06), HIPAA Privacy Rule (45 CFR 164 Subpart E, eCFR 2026-10-06), 42 CFR Part 2 (Substance Use Disorder Patient Records, eCFR 2026-10-05), HHS 405(d) HICP (2023 Edition), NIST SP 800-66 Rev. 2 (February 2024) and ONC Information Blocking (45 CFR 171, eCFR 2026-10-06). The Free plan includes them too, except the HIPAA Privacy Rule and the optional HIPAA packs: a HIPAA assessment on it asks the HIPAA Security and Breach Notification Rules questions only. Assessments are of two kinds, HIPAA and AI governance, and run at two levels: your organization's program, and each AI system and each system that handles ePHI.
Will Backsplice sign a business associate agreement with us? +
Yes. An organization that says it is a covered entity or a business associate signs a business associate agreement with us before it answers assessments, attaches evidence or keeps any record that may hold protected health information; setting up the organization, registering its systems and starting an assessment do not wait. Our standard agreement, which you can read on our site, is signed by Backsplice in advance and takes effect when you sign it; or you can provide your own, which we review and countersign.
Who makes the approval decision? +
A system is submitted for review, and its risk tier sets who must approve it and whether any, a majority, or all of them must agree. Each approver can approve, approve with conditions, reject, or send it back, and each decision carries a reason. Each approval carries a review date set by its risk tier; when it arrives a re-review opens automatically, and the system keeps its stage until that review decides. Watney does not approve a system, set a risk tier, or publish anything.
Will our data be safe? +
Every page is served over HTTPS with HSTS, and session cookies are Secure, HttpOnly and SameSite=Strict. Sign-in supports multi-factor authentication with TOTP or passkeys and a per-organization IP allowlist on every plan, and SAML single sign-on and SCIM provisioning on a paid plan. Access is role-based (admin, contributor, auditor). The audit log is hash-chained and tamper-evident: a later change to a recorded entry is detectable unless it is made by someone holding the application's signing key and database access. TOTP secrets, and the payment-processor API keys we store, are encrypted with AES-256-GCM; card numbers go to Stripe and never reach us. An organization admin accepts our data processing agreement for the organization before any governance records can be created or changed. Organization setup (profile, members, sign-in and integration settings) can be done first. See the security page for more.
What does Watney send to the model provider? +
Only what a task needs: the records you typed, documentation you paste in, and the contents of uploaded evidence files (or its earlier summaries of them) when Watney reviews or drafts an answer or summarizes evidence. When Watney researches a model card or looks up a public model, it also runs web searches through the provider's search tool, written by the model from your request, the model's registry record and the card as it stands on screen. An organization admin must opt in before Watney reads your organization's data. Its own system card names the model provider and the models it uses.
Is Watney included on every plan? +
Watney is included on Premium and Enterprise at no extra charge, within fair-use limits. It is not part of the Free plan.
Can we try it before we buy? +
Yes. Start on the Free plan, with no card and no time limit. Watney, exports and scheduled report emails, auditor and guest links, the transparency page and public badge, the API and MCP server, webhooks and SIEM forwarding, and SAML single sign-on and SCIM provisioning come with a paid plan; the download of all your organization's data works on every plan. The Free plan includes 1 AI system and 1 system that handles ePHI, and a HIPAA assessment on it asks the HIPAA Security and Breach Notification Rules questions only; the Privacy Rule questions and the optional HIPAA packs come with a paid plan, and answers already given are kept.
Does using Backsplice mean we meet a law or a standard? +
No. Backsplice supports your HIPAA and AI governance program: it keeps the register of systems, runs the assessments, records who approved what and why, and produces the evidence. Whether your organization meets a law or a standard is a judgment for your organization and its advisers.
More on plans and data handling in our pricing FAQ, security overview and Watney's system card.