HIPAA compliance and AI governance in one program, from Backsplice LLC.
Backsplice is made by Backsplice LLC. It gives a healthcare organization one place to register the systems it uses, assess its program and each system for HIPAA and for AI governance, keep the security risk analysis and the breach and privacy records, and take each AI system through review and approval.
Compliance and governance work should leave a record someone can check.
An organization that handles health information needs to know where its ePHI is, what threatens it and whether its safeguards hold. One that uses AI needs to know which systems it runs, which models and vendors sit behind them, what risk each one carries and who agreed to accept it. Backsplice keeps both in one register of systems, runs HIPAA and AI governance assessments at two levels (the organization's program and each system), and records every review decision with the approver and the reason.
It supports a HIPAA and AI governance program. It does not decide whether your organization meets a law or a standard; that judgment stays with your organization and its advisers.
What we hold to
Named approvers decide
Approve, approve with conditions, reject and send back are decisions a named approver makes, with a reason. Watney, the AI assistant, drafts cards, suggests triage and answers questions; it does not approve, set a risk tier or publish.
Records you can check
Publishing a model or system card freezes that version with a tamper-evident seal, and the audit log is hash-chained, so a later change to either is detectable unless it is made by someone holding the application's signing key and database access.
Health information under a BAA
An organization that says it is a covered entity or a business associate signs a business associate agreement with us before it keeps records that may hold protected health information. Sign-in takes MFA with authenticator apps or passkeys on every plan and, with a paid plan, SAML single sign-on, with SCIM provisioning accounts from your identity provider; and roles separate admins, contributors and auditors.
Plain pricing
A Free plan to start on, and two paid plans with the same features. The paid plans differ in how many AI systems and systems that handle ePHI you register, both include Watney within a fair-use limit that scales with the plan, and neither charges per seat.
How we protect the platform
What we do to protect your account and the governance records you keep here:
HTTPS everywhere
Every page is served over HTTPS, with HSTS so browsers keep to HTTPS on every later visit.
Locked-down sessions
Session cookies are Secure, HttpOnly and SameSite=Strict.
Multi-factor sign-in
Authenticator apps (TOTP) and passkeys on every plan; SAML single sign-on and SCIM provisioning with a paid plan.
Access you control
Roles for admins, contributors and auditors, and a per-organization IP allowlist.
Secrets encrypted
TOTP secrets, and the payment-processor API keys we store, are encrypted with AES-256-GCM; card numbers go to Stripe and never reach us.
Tamper-Evident Audit Log
Every entry is hash-chained to the one before it, so a later change to a recorded entry is detectable unless it is made by someone holding the application's signing key and database access.