One program for HIPAA compliance and AI governance
Backsplice runs HIPAA compliance and AI governance for healthcare organizations as one program. It keeps one register of the systems you run, each marked as handling ePHI, using AI, or both, with the devices, models and vendors behind them. It assesses your program and each system against NIST AI RMF 1.0, NIST AI 600-1 (Generative AI Profile), HIPAA Security and Breach Notification Rules (45 CFR 164 Subparts C–D, eCFR 2026-10-06), HIPAA Privacy Rule (45 CFR 164 Subpart E, eCFR 2026-10-06) and 24 other framework packs. It keeps the HIPAA records, from the security risk analysis to breach notifications and the disclosure log, and takes every system that uses AI through a review whose approvers are set by its risk tier. Watney, the AI assistant, drafts cards, suggests how to triage a new system and answers questions from your records.
Framework packs for HIPAA, AI governance, security and law
Questions come from framework packs. Premium and Enterprise include every pack listed here. The Free plan includes them too, except the HIPAA Privacy Rule and the optional HIPAA packs: a HIPAA assessment on it asks the HIPAA Security and Breach Notification Rules questions only.
- NIST AI RMF 1.0. A question for each of its 72 subcategories, across Govern, Map, Measure and Manage.
- NIST AI 600-1 (Generative AI Profile). Its 12 generative AI risks. Asked of each system that uses generative AI, and in the program assessment while any live system does.
- NIST Cyber AI Profile (IR 8596 initial preliminary draft). NIST's draft Cybersecurity Framework 2.0 profile for AI, which NIST may change before it is final. A crosswalk of its Secure focus area: questions on 50 of its 106 CSF subcategories, not a complete assessment.
- UK AI Cyber Security Code of Practice (2025). The voluntary code published by the UK Department for Science, Innovation and Technology in January 2025: questions covering every one of its 72 provisions.
- OWASP Top 10 for LLM Applications 2026. Its 10 entries, the security risks OWASP lists for applications built on large language models. When an assessment selects this pack, it is asked of each system that uses generative AI, and in the program assessment while any live system does. The OWASP Top 10 for LLM Applications is voluntary security guidance (2026 edition, published by the OWASP GenAI Security Project on 4 August 2026), not law.
- MITRE ATLAS 2026.09. A crosswalk of MITRE's catalog of mitigations (defenses) against attacks on AI systems: questions on 37 of its 40 mitigations, not a complete assessment. MITRE ATLAS is a voluntary knowledge base of adversary behavior against AI systems (release 2026.09, published 15 September 2026), not law.
- NIST COSAiS Predictive AI (built from NIST's January 2026 outline). A crosswalk: questions on 11 of its 59 controls, not a complete assessment. When an assessment selects this pack, it is asked of each system that uses predictive AI or has not recorded whether it does, and in the program assessment while any live system does. Built from NIST's January 2026 annotated outline of NISTIR 8605A, a discussion draft that is not a public draft, not a final publication and not a requirement. NIST notes that its control list is not complete.
- ISO/IEC 42001:2023. Questions citing 66 of its clauses or sections by identifier; its text is not reproduced. When an assessment selects this pack, its questions are asked at the level each belongs to: in the program assessment, or of the AI system being assessed.
- ISO/IEC 42005:2025. Questions citing 41 of its clauses or sections by identifier; its text is not reproduced. When an assessment selects this pack, its questions are asked at the level each belongs to: in the program assessment, or of the AI system being assessed.
- ISO/IEC 23894:2023. Questions citing 30 of its clauses or sections by identifier; its text is not reproduced. When an assessment selects this pack, its questions are asked at the level each belongs to: in the program assessment, or of the AI system being assessed.
- EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744). A crosswalk: questions on 77 of the provisions it cites, not a complete assessment. When an assessment selects this pack, it is asked of each system with a recorded link to the EU, and in the program assessment while one exists. 59 of its 69 questions assess obligations that apply from a date the pack states, on its reading of the law: 2 August 2026, 2 December 2027 or 2 August 2028, depending on the question and the system's risk class.
- EU AI Act GPAI model obligations (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744). A crosswalk: questions on 27 of the provisions it cites, not a complete assessment. When an assessment selects this pack, its question on whether your organization provides a general-purpose AI model is asked in the program assessment while any live system has a recorded link to the EU. Its other questions are asked of each system recorded as built on a general-purpose AI model with a link to the EU, and in the program assessment while one exists, and its model-provider questions only where such a system is recorded as placed on the market or put into service in the EU, unless its page records that another organization provides the model.
- NYC Local Law 144 of 2021 (AEDT). A crosswalk: questions on 32 of the provisions it cites, not a complete assessment. When an assessment selects this pack, it is asked of each system recorded as reaching New York City for employment decisions.
- Colorado ADMT Act (C.R.S. 6-1-1701 to 6-1-1709, SB 26-189). A crosswalk: questions on 79 of the provisions it cites, not a complete assessment. When an assessment selects this pack, it is asked of each system recorded as reaching Colorado for education, employment, housing, financial or lending services, insurance, health-care services, or essential government services or public benefits decisions. 18 of its 27 questions assess obligations that apply from 1 January 2027, on the pack's reading of the law.
- California CCPA Regulations on ADMT and Risk Assessments (2025). A crosswalk: questions on 49 of the provisions it cites, not a complete assessment. When an assessment selects this pack, it is asked of each system recorded as reaching California for education, employment, housing, financial or lending services, or health-care services decisions. Where an assessment selects it, it is also asked of a system recorded as reaching California with any CCPA regulations § 7150(b)(4)–(6) processing activity recorded. 10 of its 21 questions assess obligations that apply from 1 January 2027, on the pack's reading of the law.
- California Civil Rights Council Regulations on Automated-Decision Systems (2025). A crosswalk: questions on 20 of the provisions it cites, not a complete assessment. When an assessment selects this pack, it is asked of each system recorded as reaching California for employment decisions.
- Illinois Human Rights Act (775 ILCS 5), as amended by P.A. 103-0804 (HB 3773). A crosswalk: questions on 13 of the provisions it cites, not a complete assessment. When an assessment selects this pack, it is asked of each system recorded as reaching Illinois for employment decisions.
- Texas Responsible Artificial Intelligence Governance Act (H.B. 149, 2025). A crosswalk: questions on 38 of the provisions it cites, not a complete assessment. When an assessment selects this pack, it is asked of each system recorded as reaching Texas.
- Utah AI Laws (Utah Code 13-72, 13-72a, 13-77 and 58-60-118, as amended through 2026). A crosswalk: questions on 38 of the provisions it cites, not a complete assessment. When an assessment selects this pack, it is asked of each system recorded as reaching Utah.
- Singapore Model AI Governance Framework (2nd ed., 2020). Questions citing 54 of its clauses or sections by identifier; its text is not reproduced. When an assessment selects this pack, its questions are asked at the level each belongs to: in the program assessment, or of the AI system being assessed.
- Singapore Model AI Governance Framework for Generative AI (2024). Questions citing 8 of its clauses or sections by identifier; its text is not reproduced. When an assessment selects this pack, it is asked of each system that uses generative AI, and in the program assessment while any live system does.
- Singapore Model AI Governance Framework for Agentic AI (v1.5, 2026). Questions citing 11 of its clauses or sections by identifier; its text is not reproduced. When an assessment selects this pack, it is asked of each system that uses generative AI, and in the program assessment while any live system does.
- HIPAA Security and Breach Notification Rules (45 CFR 164 Subparts C–D, eCFR 2026-10-06). Questions on 90 of its provisions. Asked in a HIPAA program assessment and of each system that handles ePHI, at the level each question belongs to. Questions only a covered entity, or only a business associate, owes follow your organization's answer on whether it handles protected health information.
- HIPAA Privacy Rule (45 CFR 164 Subpart E, eCFR 2026-10-06). Questions on 89 of its provisions. Asked in a HIPAA program assessment and of each system that handles ePHI, at the level each question belongs to. Questions only a covered entity, or only a business associate, owes follow your organization's answer on whether it handles protected health information.
- 42 CFR Part 2 (Substance Use Disorder Patient Records, eCFR 2026-10-05). A crosswalk: questions on 32 of the provisions it cites, not a complete assessment. When an assessment selects this pack, it is asked in a HIPAA program assessment and of each system that handles ePHI, at the level each question belongs to. Its questions that only a program owes are asked unless your organization answers No to whether it runs a federally assisted substance use disorder program, and those that bind anyone holding Part 2 records unless it answers No to that and to whether it receives or holds such records.
- HHS 405(d) HICP (2023 Edition). A crosswalk: each of its 10 controls is mapped onto questions, its own or another pack's, not a complete assessment. When an assessment selects this pack, it is asked in a HIPAA program assessment. HHS 405(d) HICP is voluntary guidance, not law. In its own words: "Use of this document is neither required by nor guarantees compliance with federal, state, or local laws."
- NIST SP 800-66 Rev. 2 (February 2024). A crosswalk with no questions of its own: each of the 22 Section 5 subsections it keys is mapped onto the HIPAA packs' questions. When an assessment selects this pack, it asks nothing more. NIST SP 800-66 Rev. 2 is voluntary guidance on implementing the HIPAA Security Rule, not law: the Security Rule's own text is what binds.
- ONC Information Blocking (45 CFR 171, eCFR 2026-10-06). A crosswalk: questions on 2 of the provisions it cites, not a complete assessment. When an assessment selects this pack, it is asked in a HIPAA program assessment.
13 packs are drawn from law (statutes and regulations); the others are voluntary guidance or standards. They are not legal advice: whether and from when a law applies to your organization is for it to settle, with counsel where needed. Questions are asked at the level they belong to: governance questions once, in your organization's program assessment, and system questions for each AI system and each system that handles ePHI you register. Every AI governance assessment asks the NIST AI RMF 1.0 and NIST AI 600-1 (Generative AI Profile) questions (the generative AI ones only where generative AI is in use). Every HIPAA assessment asks the HIPAA Security and Breach Notification Rules (45 CFR 164 Subparts C–D, eCFR 2026-10-06) and HIPAA Privacy Rule (45 CFR 164 Subpart E, eCFR 2026-10-06) questions on Premium and Enterprise; on the Free plan it asks the HIPAA Security and Breach Notification Rules (45 CFR 164 Subparts C–D, eCFR 2026-10-06) questions only. Any other pack is asked only by an assessment of its kind that selects it. Adding a framework adds a pack: its own questions or, for a crosswalk with none, its mapping onto other packs' questions. On a paid plan, Watney can suggest where an answer you have already given also covers a control in another pack, for an admin to approve.
UK AI Cyber Security Code of Practice (2025). Contains public sector information licensed under the Open Government Licence v3.0. Source: Department for Science, Innovation and Technology, Code of Practice for the Cyber Security of AI (31 January 2025), © Crown copyright 2025. Its use here does not imply official status or endorsement by DSIT. Open Government Licence v3.0 · Source
OWASP Top 10 for LLM Applications 2026. OWASP Top 10 for Large Language Model Applications (version 2026), OWASP GenAI Security Project, © OWASP Foundation, Inc. Licensed under CC BY-SA 4.0. Only the entry identifiers and names are reproduced, unmodified. The questions and guidance are written for this assessment and are not OWASP text. OWASP is a registered trademark of the OWASP Foundation, named here only to identify the source and not to suggest endorsement. CC BY-SA 4.0 · Source
MITRE ATLAS 2026.09. MITRE ATLAS™ data, content release 2026.09, Copyright 2021-2026 MITRE (The MITRE Corporation). Licensed under the Apache License, Version 2.0. Only the mitigation identifiers and names are reproduced, unmodified. MITRE ATLAS is a trademark of The MITRE Corporation, named here only to identify the source and not to suggest endorsement. Apache License 2.0 · Source
Every system once, with what it does with health information and with AI
Both programs start with knowing what you run. Backsplice keeps one register of systems, and the obligations each one carries attach to that one record:
-
Handles ePHI, uses AI, or both. Each system carries two marks. A system that uses AI, whether you build it, buy it, or get it inside other software, has a risk tier and a lifecycle stage and goes through review; a system that handles ePHI is asked the HIPAA system questions and keeps the devices it runs on beside it.
-
Models, with versions. The models each system uses, recorded by version, so a model change shows in the record.
-
Vendors and business associates. Your due diligence on each vendor, including whether it trains on your data. A vendor marked as handling PHI for you is listed as a business associate, with the state of its business associate agreement; one that supplies a system that handles ePHI, and is not marked either way, is listed for you to confirm.
-
Data flows and devices. Map where data moves, with each data asset's PHI classification, and keep the workstations, phones and media that hold ePHI, with their location and disposal.
-
Intake triage. Watney can suggest how to triage a newly registered system. The suggestion is yours to accept or change.
Two kinds of assessment, for the program and for each system
An assessment is of one kind, HIPAA or AI governance, and has one subject: the organization, or one system. Backsplice assesses both:
- The program assessment. The questions about your policies, roles and oversight, answered for the organization as a whole: the HIPAA program assessment, the AI governance program assessment, or both.
- System assessments. The questions that apply to one system, answered for that system: HIPAA questions for a system that handles ePHI, AI governance questions for one that uses AI, with the generative AI questions asked only where they apply.
- Two scores, kept separate. Each kind is scored on its own, so your HIPAA posture and your AI governance posture can each be read for itself.
- Evidence. Attach evidence files to answers. Watney can review an answer against its evidence or summarize a file, and a person decides what to do with the result.
- Scoped by the question's own level. Each question is asked at its own level, so a system assessment collects only system answers.
The HIPAA security, privacy and breach records
The records the HIPAA rules call for are kept in the same registers as the rest of the program, and each flow asks what it involved: PHI, an AI system, or both.
- The security risk analysis. A dated, approved risk analysis of the ePHI you hold, built from threat scenarios rated for likelihood and impact. Add any scenario to the one risk register, whose entries are categorized by HIPAA safeguard area or by AI trustworthiness characteristic.
- Incidents that branch. An incident asks whether PHI was involved and whether an AI system was. PHI opens the breach risk assessment, kept with every earlier version, and the notification deadlines worked out from discovery; an AI system asks whether it may be a serious incident under the EU AI Act, and states the Article 73 deadline where one applies.
- Breach notifications. For a breach of unsecured PHI, the notices it owes, to individuals, HHS, the media or the covered entity, as the breach requires, each with its deadline and the date it was given, and the letters to individuals drafted from the record.
- Requests in one inbox. Access, amendment, an accounting of disclosures, restrictions and confidential communications sit beside requests about AI decisions. The legal basis you record sets the outer deadline where the rule sets one.
- The disclosure log. Disclosures of PHI recorded as they happen, and an accounting produced from the log for the six years before the request was received.
- Business associates and workforce sanctions. Every business associate with the state of its agreement, and each workforce sanction, with every corrected reading kept.
A named approver and a reason behind every AI system
A system that uses AI moves into use only through a recorded review:
- Submit for review. The system's risk tier decides who reviews it, under your tier policy; a weaker per-system policy needs an organization admin and a reason.
- Any, a majority, or all. The risk-tier policy also decides how many of the approvers must agree.
- Every decision carries a reason. Approve, approve with conditions, reject or send back. Conditions attached to an approval must be met before the system moves on.
- Approvals come due for re-review. Each approval carries a review date set by its risk tier; when it arrives a re-review opens automatically, and the system keeps its stage until that review decides.
Cards that say what a system is, frozen when you publish
A card is the plain description of a model or a system that a reviewer, an auditor or the public can read:
- Model cards and system cards. One for each model you record and each system you run.
- Drafted by Watney, edited by you. Watney can draft a card from the records you have kept. You decide what it says.
- A sealed version on publish. Publishing freezes that version with a tamper-evident seal. A later edit makes a new version and leaves the published one as it was.
- A public transparency page. On a paid plan, list your published system cards on a public page.
Watney, the AI assistant
Watney does not approve a system, set a risk tier, or publish anything; those stay with the people your policy names.
- Drafts cards. A first draft of a model or system card from the records you have kept.
- Suggests intake triage. A suggested starting point for a newly registered system, for you to accept or change.
- Reviews answers and summarizes evidence. Reads an assessment answer against its evidence, or summarizes an uploaded file.
- Answers questions from your records. Answers are grounded on your organization's own records.
An organization admin must opt in before Watney reads the organization's data. Watney is included with Premium and Enterprise.
Watney sends the model provider only what a task needs: the records you typed, documentation you paste in, and the contents of uploaded evidence files (or its earlier summaries of them) when it reviews or drafts an answer or summarizes evidence. When it researches a model card or looks up a public model, it also runs web searches through the provider's search tool, written by the model from your request, the model's registry record and the card as it stands on screen. Watney's own system card names the provider and the models.
The rest of the program, next to the systems it concerns
The registers hold what happens between reviews, for HIPAA and for AI governance alike, so the record stays current.
Risk Register
Record the risks your systems carry, by HIPAA safeguard area or AI trustworthiness characteristic, and what is being done about each one.
Incidents
Log what went wrong, say whether PHI or an AI system was involved, and follow it through to a close.
Vendors
Every vendor, with your due diligence and its agreements, the business associate agreement among them, and questionnaires to send it.
Policies
Adopt policies from HIPAA and AI governance templates, and keep the ones your program runs on where your team can find them.
Training
Assign HIPAA and AI courses to your workforce and keep the record of who completed them.
System Changes
Log changes to your systems as they happen. A material change to a system that uses AI can prompt a new review.
Access Reviews
Run periodic reviews of who has access, and keep each one as a dated record.
Audit Log
Changes are written to a hash-chained, tamper-evident audit log: a later change to a recorded entry is detectable unless it is made by someone holding the application's signing key and database access.
Show what your program did, when someone asks
Exports and access links come with a paid plan.
HHS OCR Audit Package
The HIPAA records the Office for Civil Rights asks to see when it investigates, assembled from your program as a document to hand over. It shows what is on record and makes no attestation.
Approval Dossier
Export the record of a system's approval: the review, the approvers, their decisions and the reasons given.
CSV and PDF Exports
Export your registers and assessments as CSV or PDF.
Share with an Auditor
Give an auditor read access to your records through an account of their own or a link.
Guest Links
Let someone outside your organization answer a question or complete a task through a link, without an account.
Transparency Page
A public page listing the system cards you have published.
Works with your identity provider and security tools
Connect sign-in, user provisioning, your SIEM and your own systems through standard protocols. Single sign-on, SCIM provisioning, the API and MCP server, webhooks and SIEM forwarding come with a paid plan; MFA and the IP allowlist are on every plan.
See the API reference and webhook event catalog for details.