Client Workroom

Data mapping

PHI flow map

Each data stream mapped end to end: who sends health data, where it is stored, who can view it, and where the product generates inferences, so the right terms attach to the right flow.

Whether a given stream is PHI, a business-associate obligation, or consumer health data governed elsewhere depends on the customer relationship and the source of the records, analyzed per stream rather than assumed.

AI inputs

AI model-input checklist

A structured pass over what reaches any AI model, and on what terms:

• PHI vs de-identified data used as model input
• No-training / no-secondary-use terms
• Output, reliance, and human-review limits
• AI vendor / subprocessor handling of health data

These are conditional flags: they may apply depending on the tool and its use, and are routed for attorney review rather than decided here.

Vendor chain

BAA chain & subprocessor map

The business-associate relationship traced through the stack, so every party that touches health data is accounted for:

A subcontractor that creates, receives, maintains, or transmits PHI on behalf of a business associate is itself a business associate. A no-view, encrypted-only cloud vendor that cannot read the data can still be a business associate under HHS cloud guidance.

Review

Clause-level comments

Every clause in the live preview carries its own comment thread. Click a paragraph to leave a note, ask a question, or suggest exact wording, and see who changed what and when.

In a real matter your notes sync to me for review. In this demo they stay in your browser.

Revisions

Redline workflow

Word-style track changes across each draft, with up to three revision rounds in scope for the core package. Suggested edits stay visible until accepted, so nothing changes silently.

Drafts are marked for review, and attorney review controls the final documents.