Key facts
| Data boundary | PHI stays inside the perimeter; no internet path for inference or logs |
| Deployment | On-prem and air-gapped tiers alongside cloud and VPC options |
| Models | Open-weight models suitable for offline operation in the catalogue |
| API contract | OpenAI-compatible endpoints; application code unchanged across tiers |
| Safe scope | Summarisation, drafting, coding support and search; clinicians decide |
| Updates | Controlled intake with verification on your cadence |
| Audit | Access, key and inference events exportable to internal SIEM |
| Status | Live platform; enterprise deployment terms per engagement |
TL;DR
- PHI stays inside the health system network — no egress at all.
- Keep clinical judgement with clinicians; agents summarise and draft.
- Treat model updates as validated releases with staging and rollback.
- Log every access so investigations have evidence.
- Start with documentation workloads, not diagnosis.
How it works, step by step
- Confirm which workloads need a full air gap versus a VPC or on-prem deployment with controlled egress.
- Choose administrative and documentation use cases first: discharge summaries, referral letters, coding support and policy search.
- Size GPU capacity for clinical concurrency, including peak and failure headroom.
- Deploy the runtime and verified open-weight models inside the network, with an inventory of versions and provenance.
- Integrate SSO/SCIM for clinical and administrative staff, and scoped keys for services.
- Keep record-system tools read-only, routing drafts into clinician review queues rather than writing directly.
- Stream access, key and inference events to internal SIEM, and validate output quality with clinical reviewers before scaling.
Try it yourself
Open the AI data residency checklist →
Why healthcare considers air-gapped AI
Health systems hold data that cannot be casually moved: patient records, imaging metadata, clinical notes and billing detail. Even where a compliant cloud deployment exists, some organisations — or some workloads — require that processing never leaves the perimeter. Air-gapped Plugsky satisfies that requirement by running open-weight models and the runtime inside the network with no internet path.
The API stays OpenAI-compatible, so clinical applications, prompt libraries and evaluation harnesses built in a pilot environment transfer to the isolated estate unchanged. That continuity is what keeps a two-year compliance programme from becoming a two-year engineering project.
Safe workload design
Start where errors are cheap to catch and clinicians already review. Documentation summarisation, referral drafting, coding suggestions with citations, patient-message triage and internal policy search all fit. Nothing the agent produces reaches the record or the patient without human review, and every draft records model version, prompt version and reviewer.
- No autonomy: diagnosis, prescribing and triage decisions stay with licensed staff.
- Minimise: even inside the perimeter, strip identifiers the task does not need.
- Review metrics: track acceptance, edit distance and override reasons to prove the workflow helps.
Updates, audit and investigation readiness
Air-gapped estates need disciplined refreshes. Treat model and runtime updates as validated releases: checksums, scanning, staging on a mirror of production, evaluation against clinical test cases, then promotion with rollback ready. A version manifest prevents the silent drift that makes quality regressions impossible to explain.
Audit is the other half of safety. Export access, key and inference events to internal SIEM so any incident can be reconstructed: who accessed what, which model produced which draft, and who reviewed it. Combined with short retention for sensitive material, this gives privacy officers a defensible position without external dependencies.
Honest comparison
| Healthcare requirement | Plugsky air-gapped | Cloud AI service | DIY open-source stack |
|---|---|---|---|
| PHI boundary | Never leaves the perimeter | Requires DPA and controls | Depends on your build |
| Clinical safeguard | Human review enforced in your application | Varies | You implement |
| Update validation | Controlled, staged, rollback-ready | Provider-scheduled | Your process |
| Audit | Events export to internal SIEM | Vendor logs | Your pipelines |
| API compatibility | OpenAI-compatible offline | Vendor API | You define it |
| Effort | Deployment and pipeline | Lowest | Highest |
Frequently asked questions
Does any PHI leave the hospital?
No. In an air-gapped deployment, inference, embeddings and logs remain inside the perimeter with no external network path. Minimisation still applies as defence in depth.
Can agents write to the medical record?
They should not write directly. Keep record-system tools read-only and route drafts into clinician review queues, with the final entry made by a person.
How are model updates validated?
As staged releases: checksums, scanning, validation on a production mirror using clinical test cases, then promotion with a tested rollback path.
What should we log?
Access events, key lifecycle changes and inference metadata such as model and prompt version plus timestamps. That lets privacy officers reconstruct any incident from evidence.
Which workload should come first?
Documentation and coordination: discharge summaries, referral letters, coding support and policy search. They save time without touching clinical judgement.
How do we measure clinical value?
Track draft acceptance, edit distance, override reasons and time saved per case. Review a clinical sample monthly and before expanding scope.
How do we start?
Prototype on de-identified data, then move the same code path into the isolated estate. Enterprise engagements cover deployment review and support terms.