Regulation (shared across verticals)

HIPAA 45 CFR 164 — Privacy, Security, Breach Notification

Applies to any AI system touching Protected Health Information (PHI). Governs how the AI's inputs, outputs, and decision records must be retained + secured + disclosed. Six-year minimum on documentation of policies + AI-decision records tied to a covered function.

What the regulation actually says

"A covered entity must retain the documentation required by this subpart for six years from the date of its creation or the date when it last was in effect, whichever is later." 45 CFR 164.316(b)(2)(i) — Security Rule policies + procedures + records

"A covered entity must implement policies and procedures to protect electronic protected health information from improper alteration or destruction … and must maintain a record of any action, activity, or assessment required by this subpart." 45 CFR 164.312(c)(1) + 164.316(b)(1)

What this means in plain English (for AI systems)

If an AI touched a decision that affected a patient's care, coverage, admission, discharge, prescription, priority, or scheduling, then the record of what the AI did (input, output, model version, timestamp) is subject to HIPAA retention.

Standard six-year minimum. State malpractice tail typically pushes this to 7-10 years for clinical AI. "The vendor keeps it" is not a defensible answer when the covered entity is the accountable party.

Input snapshot at decision-time (not "current DB state")
Model version at decision-time (not "current model")
Output + follow-on lane / routing / recommendation
Retention pipeline distinct from the production model (independence)
Ability to reproduce the decision under legal process

What the $499 Snapshot shows against this rule

Snapshot layer #7 (executable action ledger) + layer #8 (time-of-decision knowledge snapshot) capture exactly the records HIPAA + investigation-response demands: model version pinned, input hash bound, decision hash cryptographically bound, output + lane recorded, retention pipeline demonstrably independent of the production model family.

The counterparty-question rehearsal section in your Snapshot ("reproduce this AI-generated decision from Day 47 as a defensible record") demonstrates the retention discipline works. If it does not, the Snapshot says so plainly.

See counterparty-question rehearsal in the healthcare sample →

How does this help me?

The rule is the framing. The reason you'd pay $499 to know is the follow-on cost of NOT having the retention discipline before a request lands.

Read: HIPAA retention -- what it saves you if a request lands →

Continue to your vertical's sample

Healthcare Legal Insurance Banking Pharma RIA / Wealth Education Housing Energy Federal

$499 Snapshot. 3 business days.

Independent-verifier determination on ONE of your AI systems + 3 fix-first items + counterparty-question rehearsal + signed declaration.

Buy $499

Snapshot credit applies to Baseline ($2,500) or Enterprise Attestation ($35-55K) upgrade within 30 days.