ClovieClinical and patient-facing agents, with a clinician in the loop.
The healthcare pack holds health data tools until an agent is approved for them, holds clinical actions in production for a person, keeps patient-facing agents rated and keeps each health agent to its approved models.
Healthcare AI governance
| Policy | Decision | Mode |
|---|---|---|
| Health data needs an exemption | Deny | Enforce |
| Clinician approval | Approval | Enforce |
| Patient-facing agents rated | Deny | Enforce |
| At most ten tools | Deny | Enforce |
| Approved models only | Deny | Monitor |
| A model list for every health agent | Deny | Enforce |
- Model
- On the allowlist
- Health data
- Masked in trace
- Requested
- 5 min ago
Health data and clinical decisions leave no room for guesswork.
Health data everywhere
Agents that summarize notes or answer patients see protected health information in every request.
Clinical actions
Agents that draft orders or triage patients act on care, and a clinician has to answer for each one.
Too much access
Agents collect tools over time and end up with far more access than their task needs.
The rules behind the healthcare pack
The rules and guidance that shape how AI is controlled in healthcare, each linked to its official source.
- HIPAA Security RuleUS Department of Health and Human ServicesAdministrative, physical and technical safeguards for electronic protected health information. (official source, opens in a new tab)
- 45 CFR 164.312US Department of Health and Human ServicesTechnical safeguards: access control, audit controls, integrity and transmission security. (official source, opens in a new tab)
- Minimum necessary requirementUS Department of Health and Human ServicesUse and disclose only the protected health information a task needs, under 45 CFR 164.502(b). (official source, opens in a new tab)
- Clinical decision support softwareUS Food and Drug AdministrationGuidance on which clinical decision support software functions FDA treats as medical devices. (official source, opens in a new tab)
- HTI-1 final ruleAssistant Secretary for Technology Policy (ONC)Transparency requirements for decision support interventions in health IT built to ONC criteria. (official source, opens in a new tab)
Clovie maps its controls to these texts to help your teams; it is not legal advice, and using Clovie does not on its own make an organization compliant with any of them.
Controls in the healthcare pack
6 controls, each a policy you install from the Policy Hub. Every one starts in monitor mode and changes nothing until you promote it after a simulation on your own traffic.
Healthcare AI governance
Seven technical safeguards enforced at the gateway; administrative and physical safeguards stay with you.
- Blocked
Health data needs an exemption
Blocks agents with health data tools or permissions until a second policy admin grants a time-bound exemption.
Healthcare pack · mapped to 45 CFR 164.312(a)(1) - A person approves
Clinician approval
Clinical agents in production need a person to approve before they act on a request.
Healthcare pack · mapped to 45 CFR 164.308(a)(3) - Blocked
Patient-facing agents rated
Patient-facing agents must carry a high or critical risk level and be ready for production.
Healthcare pack · mapped to FDA clinical decision support - Blocked
At most ten tools
Blocks an agent with health data permissions that holds more than ten tools, a simple cap on excess access.
Healthcare pack · mapped to 45 CFR 164.502(b) - Blocked
Approved models only
Healthcare agents can use only the models on their allowlist, such as those under your BAAs.
Healthcare pack - Blocked
A model list for every health agent
Blocks an agent with health data permissions that has no declared list of allowed models.
Healthcare pack · mapped to 45 CFR 164.314(a)
How a clinical agent's request is governed.
Where your health data lives
Run Clovie as SaaS, or install it in your own cloud account or data center so prompts, traces and the audit log stay inside your environment.
- SaaS
- Customer VPC
- On-premises
- Air-gapped
Personal data masked
Mask personal data in prompts, tool calls and answers before it reaches a model or a user.
Every request recorded
The gateway records every request and policy decision for every agent, with no per-agent setup.
Your own perimeter
Self-hosted installs keep every request and trace inside the network your security team runs.
Controls mapped to the frameworks you answer to
- NIST AI RMF: NIST AI Risk Management Framework
- ISO/IEC 42001: ISO/IEC 42001 AI management system
- EU AI Act: EU Artificial Intelligence Act
- OWASP Top 10: OWASP Top 10 for LLM applications and agentic AI
Questions
Does Clovie make us HIPAA compliant?
No product can do that on its own. The pack enforces technical safeguards at the gateway; administrative and physical safeguards, business associate agreements, breach notification and patient rights stay with your compliance program.
What happens to agents that use health data tools?
Once you enforce the policy, every agent with health data tools or permissions is blocked until a policy admin grants it a time-bound exemption, approved by a second policy admin. Review each agent, then grant the exemption for the ones you approve.
Will the pack block anything on day one?
Every policy installs in monitor mode, records what it would have done, and changes nothing until you promote it.
Can we keep health data on our own network?
Yes. Install Clovie in your own cloud account or data center, and use self-hosted models next to the providers you have agreements with.
See the healthcare pack on your own agents.
We'll run the controls on your own agents in monitor mode and show what they would have held and blocked.