Your clinicians want search that feels like ChatGPT. Your compliance officer wants nobody to lose their job. These two things are usually in tension — most modern search tools quietly stream your queries (and often your data) through someone else's AI model. If that "someone else" hasn't signed a BAA with you, congrats: you just had a breach.
Here's a short guide to building search that works for both teams.
Why search is a HIPAA blind spot
Everyone audits their database, their cloud, their email vendor. Search? Usually treated as "just an index" — even though that index now holds a copy of every patient note, every claim, every prescription. The moment you wire AI to it, every query also goes wherever the AI lives. If that's some random hosted endpoint, you have a problem.
The four things that actually matter
- The data stays where you control it. Your VPC or a cloud you have a BAA with. Plain SaaS without a BAA is out.
- The AI doesn't phone home. Natural-language search, semantic ranking, smart crawling — all must run against models in your BAA chain or models you host. No drive-by OpenAI calls.
- Tenants stay walled off. One org's API key can never see another org's data. Period.
- Everything gets logged. Who searched, when, what they got. Auditors will ask. So will lawyers.
Questions to ask any search vendor
- Will you sign a BAA? Does it cover AI features, or just the index?
- Where does the AI model actually run? Yours, mine, or a third party?
- Can I deploy this in my own VPC?
- What's logged, and how long is it kept?
- What happens to my data when I cancel?
If any answer is "uh, let me get back to you" — they're not ready for PHI.
How Lunexa fits
Lunexa was built to deploy in places with strict rules. A few specifics:
- Self-host it. On Enterprise, run Lunexa entirely in your VPC — AWS, GCP, Azure, on-prem. PHI never leaves your perimeter.
- Bring your own LLM. Point our AI features at your Azure OpenAI, your private Bedrock Claude, or a model you host. We don't have a shared inference pool.
- Hard isolation. Every collection is scoped to one org. API keys can't reach across.
- Full audit log. Every read, write, and admin action — exportable to your existing SIEM (Splunk, Datadog, S3).
- Agent-ready. Our MCP server lets clinical AI agents (running under your BAA) connect to scoped data, with metering and audits on every call.
What this looks like in practice
A hospital wants natural-language search across 12M clinical notes. The setup:
- Lunexa runs in their AWS VPC (covered by their AWS BAA).
- Notes are indexed nightly from the EHR's read-only API. Never leaves the VPC.
- NL search points at their Azure OpenAI (under Microsoft's healthcare BAA).
- Clinicians sign in via SSO. Queries scope to their patient panel.
- Every query lands in the hospital's SIEM.
To the clinician, it's just fast, smart search. To compliance, it's all inside the BAA chain.
The fine print
This is architecture talk, not legal advice. HIPAA compliance is a property of your whole system — your privacy officer, security team, and lawyers all need to weigh in. We're happy to share a reference architecture your auditors can review as a starting point.
Want to talk?
If you're scoping search for a healthcare app, ping sales@ailunexa.com. We'll walk through deployment options, the BAA process, and what fits your environment.