Clinical reasoning on PHI without ever decrypting it outside the CPU.
Protected Health Information processed in a CPU-encrypted enclave, meeting the HIPAA Security Rule technical safeguards for encryption at rest, in transit and in use (§164.312). Clinical data extraction, ICD-10 coding validation, care-gap detection and discharge summary analysis, all sealed inside Intel TDX hardware. Built for organizations that need clinical reasoning without the breach-notification risk.
Built for: Hospitals, telehealth networks, clinical research organizations, health insurers, pharma
HIPAA PHI cannot be sent to ChatGPT, Claude or any general-purpose AI without entering breach territory. EHR data residency rules, GDPR Article 9 (special categories), 42 CFR Part 2 for substance abuse, all force healthcare teams into manual workflows that take 60-90 minutes per chart review.
Extract diagnoses, medications, lab values and care gaps from a complete chart in under 90 seconds, with PHI never leaving the encrypted enclave.
What the Medical Records Analyst does on every document, sealed inside an Intel TDX hardware enclave.
Diagnoses with ICD-10 codes, medications with dose/route/frequency, lab values with reference ranges and flags, vitals trends, procedure history. Output is a structured table you can pipe into Epic, Cerner or a research database.
Surfaces coding errors that drive claim denials and audit findings. Suggests the correct code with the supporting clinical evidence quoted from the chart.
Checks the chart against USPSTF, AHA, ADA and specialty-society guidelines. Flags missing screenings, overdue follow-ups and contraindicated medications without making clinical recommendations.
Pulls follow-up actions, medication reconciliation tasks and pending lab results from discharge documents. Designed for transitional-care and readmission-reduction programs.
Validates inclusion/exclusion criteria against patient charts, identifies endpoints, surfaces ICH-GCP compliance gaps. Used by sites screening for enrollment.
Evaluates whether a dataset meets HIPAA Safe Harbor or Expert Determination. Flags residual re-identification risk, useful before sharing data with research partners.
Four steps from upload to export. Your document is decrypted only inside the CPU-encrypted enclave.
Progress notes, discharge summaries, pathology reports, insurance claims or clinical trial protocols. TLS in transit, decrypted only inside the Intel TDX enclave.
The model runs in CPU-encrypted memory. The cloud operator cannot access PHI during computation, satisfying HIPAA §164.312(a)(2)(iv) and §164.312(e)(2)(ii) at the hardware layer.
Patient profile, primary conditions with ICD-10, structured data tables, care gaps and a clinical summary with an explicit "not for direct clinical care" disclaimer.
Markdown for clinical review, JSON via API (Pro tier) for EHR integration, de-identified extracts for research consortiums.
Every output cites the specific article, section or control. The Intel TDX hardware boundary handles the data-protection side; the agent handles the analytical side.
Real prompts from healthcare teams.
Extract all diagnoses with ICD-10 codes and supporting evidence from this discharge summary.
Identify care gaps in this diabetic patient chart against ADA guidelines.
Validate the inclusion/exclusion criteria for this oncology trial against the chart.
Assess whether this de-identification meets HIPAA Safe Harbor.
Prompt: Find medication interactions and contraindications in this chart.
Output: CRITICAL: Patient on warfarin (Coumadin 5mg daily) AND amiodarone (started 3 days ago), major CYP2C9 interaction, INR likely to climb to 4-6 within 7-10 days. Recommend INR check and warfarin dose reduction. MODERATE: Metformin 1000mg BID with eGFR 42, within FDA guidance but warrants monitoring per ADA Standards of Care 2025.
Prompt: Score this for re-identification risk under HIPAA Safe Harbor.
Output: PARTIAL Safe Harbor. Pass: name, SSN, MRN, full DOB removed. FAIL: ZIP code retained at 5 digits (Safe Harbor permits only 3); admission date retained (must be year-only); rare diagnosis combination (Erdheim-Chester + BRAF V600E) is itself a quasi-identifier. Recommend either Expert Determination methodology or k-anonymity ≥ 5 review before release.
Every tier runs inside Intel TDX hardware enclaves. Plans stay in sync with /pricing.
1,000 requests/month, 1 seat. For solo clinicians, fractional clinical informaticists.
3 seats, 2,000 requests/month, 100 MB uploads, HIPAA-aligned audit log.
10 seats, 5,000 requests/month, 500 MB uploads, API access for EHR integration, 12-month audit log retention.
Unlimited seats, fine-tuning on your specialty corpus, SSO/SAML, dedicated TDX capacity. BAA planned after SOC 2, not offered yet.
Honest comparison. Hardware-rooted confidentiality is what most alternatives are missing.
| Alternative | Pros | Cons vs VoltageGPU |
|---|---|---|
| Hippocratic AI |
|
|
| Microsoft Nuance DAX |
|
|
| ChatGPT Enterprise |
|
|
No. Inference runs on an open-weight model deployed inside an Intel TDX hardware enclave, under a French controller. PHI is decrypted only inside CPU-encrypted memory and never reaches OpenAI, Anthropic or any third-party model provider. No PHI is used for training.
The architecture is designed to satisfy §164.312(a)(2)(iv) (encryption and decryption of ePHI) and §164.312(e)(2)(ii) (encryption of ePHI in transit), including the encryption-in-use guarantee provided by Intel TDX memory encryption. A Business Associate Agreement is planned after SOC 2 Type I and is not offered yet.
Not yet. A BAA is planned once SOC 2 Type I is complete; until then we do not accept PHI under a BAA and say so in writing. The current status is on the Trust Center.
No, and the system prompt explicitly forbids it. The agent is positioned as an analytical and administrative tool, for clinical informaticists, coders, compliance teams and researchers. Every output carries the disclaimer "Clinical decisions must be made by licensed healthcare providers."
The same hardware boundary applies, but Part 2 imposes stricter consent and re-disclosure rules. We recommend Enterprise deployment with audit log retention extended to your Part 2 retention requirement and a custom DPA covering re-disclosure prohibitions.
Yes, via the OpenAI-compatible API on the Pro tier. Customers use it to batch-process discharge summaries pulled via FHIR R4, then write the structured extraction back into the EHR via standard SMART-on-FHIR flows.
Article 9 health-data processing requires a specific lawful basis (consent, public health, medical care, etc.) plus appropriate safeguards. The Intel TDX enclave and EU operator location satisfy the safeguard requirement; the lawful basis remains your responsibility as Controller. Our DPA documents the Processor role.
Yes, on the Enterprise tier. Fine-tuning runs inside a confidential VM with PHI-grade isolation; the resulting weights stay private to your tenant. Typical use cases: specialty-specific coding, custom care-gap rule sets, institutional discharge templates.
Intel TDX attestation, EU jurisdiction, French operator (VOLTAGE EI). Cancel anytime.