PHI-Safe AI for Healthcare Operations | CercaLabs

AI in healthcare operations

The question isn’t whether to use AI. It’s where patient data goes.

Most healthcare organizations have not banned AI. They have banned an unanswered question: which system sees a patient record, under what agreement, and who can prove it afterwards. Answer that and the tooling debate mostly resolves itself.

Book a teardown See the exposure review

What is already happening

A Policy Against AI Is Not A Control

Blocking a domain on the corporate network does not stop a biller from pasting a denial letter into a consumer chatbot on their phone to draft an appeal. That is not a discipline problem. It is a signal that the sanctioned path is slower than the unsanctioned one.

The exposure is real and it is invisible: no log, no agreement with the provider, no record of what left. If it were to come up in an audit or a breach investigation, you would have no way to establish scope, which is usually worse than the disclosure itself.

Our position is unglamorous: find where staff are already reaching for AI, then make the compliant route the fast one. Restriction without a faster alternative just pushes the same work somewhere you cannot see it.

Where it shows up first

Appeal letter drafting

Denial text and clinical rationale pasted in to get a first draft faster than the template library allows.

Payer policy lookups

Asking a model to interpret a coverage policy, with the member’s specifics included for context.

Summarizing chart notes

Condensing documentation to assemble a prior authorization packet, the highest-PHI-density habit of the three.

The mechanism

De-identify Before Inference, Re-identify After

The pattern is old and it is boring, which is why it holds up in review. Identifiers are stripped and tokenized inside your environment. Only the de-identified text crosses the boundary to a model. The mapping stays with you, and re-identification happens on your side of the line.

Inside your boundary

Strip and tokenize

Names, member IDs, dates, and account numbers are replaced with tokens. The map lives in your systems and never leaves them.

At the model

Reason on de-identified text

Contracted terms with no training on your data, a named region, and request logs you hold rather than the vendor.

Back inside your boundary

Re-identify and route to a human

Tokens resolved locally, output attached to the account, and a person approves before anything is submitted.

Where this does not work, we say so. Free-text clinical narrative resists reliable de-identification. A note can identify a patient through circumstance alone, with no explicit identifier in it. For those workflows the answer is a model inside your tenancy, or not using a model at all. See safe harbor de-identification and business associate agreement.

Judgment, not enthusiasm

Where A Model Earns Its Place

Good fit

Reading unstructured payer correspondence

Denial letters and policy PDFs vary endlessly in format. Rules break on them; a model reads them and hands back structure.

Drafting an appeal a human then edits

Assembling argument and citations into a first draft is genuine work. Approval stays with the specialist.

Triaging a queue by likely cause

Grouping denials by probable root cause so the team works the pattern instead of the pile, one account at a time.

Wrong tool

Deterministic eligibility checks

A 270/271 transaction returns a defined answer. Putting a model in front of it adds cost, latency, and a failure mode you did not have.

Anything submitted without review

A confidently wrong claim or authorization request is worse than a slow one. If no human approves it, it should not be model-generated.

Compensating for a broken upstream process

If registration captures bad demographics, a model that cleans them up hides the defect and makes it permanent. Fix the intake.

Free · 45 minutes

The Shadow AI Exposure Review

Forty-five minutes, one operational area, no system access. We talk to the people doing the work, map where AI tools are already in use, and identify which of those paths move patient data outside an agreement. You get a written map and a ranked list of what to sanction, what to replace, and what to shut off. It is free, and yours whether or not we ever work together.

It is deliberately not an AI strategy engagement. The output is a factual picture of current exposure and the two or three workflows where a sanctioned tool would be faster than the workaround staff invented. If the review finds nothing meaningful, we tell you that and you have documentation saying so.

It is the biggest ask of the four ways to start, not in money, but because it only works if the people actually doing the work are in the room.

What you get

A use map

Every AI-touching step in the area, named, with the data class that passes through it.

An exposure list

Which paths lack a BAA or a log, ranked by how much patient data they carry.

A sanctioned alternative for the top two

Specific enough to build: where the boundary sits, what gets logged, who approves output.

Something to hand your security team

Written in questionnaire language, so review starts from a document rather than a discovery call. Our security positions.

What we will not claim

Straight Answers About Our AI Work

Do you have a large AI reference client we can call?

Not in generative AI at enterprise scale. Our named engagements are automation and document-processing work, and our current-generation AI work is in products we build ourselves. That is the honest state of it, see what we build and judge the work directly.

Will a model replace our billing staff?

No, and anyone promising it is selling. What changes is the mix: less retyping and status-checking, more exception handling and payer escalation. The teams that get value redeploy people rather than plan reductions.

Which model do you use?

Whichever your agreements and region requirements already permit, including one hosted in your own tenancy. Model choice is the most replaceable part of the design and the least worth arguing about first.

What happens when the model is wrong?

It gets caught by a person, because every design routes output to review before submission. We instrument the disagreement rate too. If reviewers are overriding constantly, the workflow is wrong and we change it rather than tune prompts around it.

Related reading

Go Deeper

The mechanism

Agents in revenue cycle

What an agent does that a scripted bot cannot, and the four places they are not reliable enough to trust yet.

Read it →

For your reviewers

Security and compliance

The same positions written in questionnaire language, so security review starts from a document.

Read it →

The map

AI or plain automation?

One question decides which side of the line your workflow sits on. Most projects need both.

See the map →

Next step

Start With One Workflow

Bring the workflow your team most wants help with and we will tell you whether a model belongs in it. Sometimes the answer is a rule and a queue, and that is a useful answer to get for free.

Book a teardown Take the readiness check