Clinical Mode: a practical HIPAA-conscious AI pattern

A social worker types “James Smith, 28, in recovery from opioid use. Close relationship with his AA sponsor Mark, conflicted with his mother Diane…” into an AI tool. That string — with the real names — gets sent to the model provider. Even if the provider promises not to train on it, even if it’s encrypted in transit, the simple fact is that PHI has now traveled outside your network. For HIPAA-conscious work that’s a problem.

The obvious approach is “don’t use AI for clinical notes.” That’s a real choice, and for some practices it’s correct. But it leaves a lot of value on the table. The second obvious approach is “ask the user to anonymize before pasting.” In practice that gets done about as often as you’d guess. The third is “send everything to a self-hosted model.” Self-hosting frontier models isn’t practical for most organizations.

What we wanted: an architecture where the AI sees enough to be useful, but never sees identifying information, and the user never has to think about it.

The AI loses access to identifying specifics. It doesn’t know that the sponsor is named Mark or that the client is named James. What it keeps is the entire structure: the role of each person, the relationships among them, the line styles, the system categories. For most clinical AI use cases — generating an ecomap from a case description, suggesting an analysis, refining a draft — that structure is what matters. The names are decoration.

• Image inputs. AI image import is a paid feature (Professional and Clinical plans). Photos of hand-drawn ecomaps contain names, and we don’t (yet) auto-redact text inside images, so the image is sent as uploaded. The resulting ecomap then goes through the normal re-identification flow. For organizations that need image-side redaction we recommend pre-anonymizing with a marker.
• Ambiguous aliases. “The therapist” isn’t the same alias as “Mark.” The mapping has to be stable across a session so the AI can keep references consistent. We solved this by hashing the original name into a deterministic alias index within the session.
• Long sessions. If the user re-edits an ecomap an hour later, the mapping has to still be in memory. We hold it in sessionStorage for the canvas’s lifetime.

Clinical Mode is not a substitute for a Business Associate Agreement. Organizations operating under HIPAA still need the legal infrastructure — agreements with their vendors, documented policies, employee training. What Clinical Mode does is eliminate the most common architectural failure mode (PHI in AI prompts) so the rest of the compliance stack has less to worry about.

GenogramAI does not currently offer a BAA. The Clinical plan ($29/month) combines Clinical Mode’s pre-send de-identification with AES-256-GCM zero-knowledge encryption, secure offline storage in the native macOS app, and Clinical eco-maps that stay on the device. Organisations can contact us through the enterprise page; the full policy is on the HIPAA page.

The default in clinical-tech right now is to glue an AI feature onto an existing workflow and worry about privacy as an afterthought. We’d rather make the privacy architecture the load-bearing decision and design the AI feature around it. If you’re a clinician who’s been waiting for AI tools that take this seriously, this is what taking it seriously looks like.

More on this: Clinical Ecomap landing, AI ecomap generator, software for agencies.