Key facts
| Access control | Scoped API keys with rotation; enterprise SSO and RBAC options |
| Deployment | VPC, on-prem or air-gapped placement inside the hospital estate |
| Resilience | Multi-region and failover guidance for clinical availability |
| Auditability | Request, model and response logging for clinical review |
| Data grounding | Embeddings and RAG are live for pathways and operational policy |
| Models | 30+ models behind one OpenAI-compatible API |
| Pricing model | Flat monthly self-serve plans; no per-token billing on self-serve |
| Endpoint roadmap | Audio, images, files, batch, assistants and fine-tuning are coming soon |
TL;DR
- Classify clinical, operational and patient-communication data separately.
- Prefer in-estate deployment for anything touching patient records.
- Design for downtime: clinical workflows need a fallback path.
- Log requests, sources and model versions for clinical governance.
- Name the clinician accountable for every care-facing workflow.
How it works, step by step
- Inventory hospital AI use cases and classify the data each one touches.
- Choose deployment per class: region-selected cloud, VPC, on-prem or air-gapped.
- Issue per-application keys, store them in a secrets manager, and rotate on a schedule.
- Define availability requirements and a manual fallback for each clinical workflow.
- Define log fields and retention: request ID, model, sources, output, reviewing clinician.
- Approve a model allow-list with evaluation evidence, and re-test on version changes.
- Pilot on operational knowledge, then extend to clinical content with sign-off.
Try it yourself
Open the private LLM deployment estimator →
Clinical data scope and classification
Hospital data divides into clinical records, operational data such as scheduling and supply, workforce data, and public health information. Each class needs its own handling rule, and many hospitals add a fourth distinction between identified and de-identified clinical content.
Start with operational knowledge and published pathways, where leakage risk is low. Extend to identified patient content only on in-estate deployments where prompts, documents and embeddings never leave the hospital environment.
Keys, departments and least privilege
Issue a distinct API key per application, department and environment, and keep them in a secrets manager with a rotation schedule. Enterprise SSO and RBAC options keep console access aligned with clinical role changes, leavers and locum staff, which move faster than typical enterprise directories.
Never share a production key across departments, keep identifiers out of prompts where possible, and retrieve only the fields a workflow requires.
Residency, retention and audit trails
Decide explicitly where processing happens and how long records live. Region selection covers many cases; VPC, on-prem and air-gapped deployment keeps data inside the estate where policy demands it. Retention applies to prompts, outputs, logs and retrieval indexes, and clinical records rules usually outlast the AI system itself.
Log enough to reconstruct an answer: request ID, model and version, retrieved source identifiers, output and the reviewing clinician. See AI audit logs for a schema.
Model governance and clinician sign-off
Keep an approved model list with evaluation evidence and re-test when versions change. Ground clinical answers in current pathways and require citations so staff can verify. A qualified clinician remains accountable for care decisions, so the checklist should name the reviewer and define which outputs may be acted on without escalation. Plan availability as well: multi-region and failover guidance matters when a workflow supports ward operations.
Honest comparison
| Control area | Plugsky capability | Common gap | Owner |
|---|---|---|---|
| Identity | Scoped keys per department, rotation, SSO and RBAC options | Shared ward-level credentials | IT security |
| Data boundary | VPC, on-prem or air-gapped deployment in the estate | Prompts leave the hospital | Privacy officer |
| Resilience | Multi-region and failover guidance | No manual fallback | Clinical operations |
| Retention | Configurable logging of requests and responses | Transcripts kept without policy | Records management |
| Audit trail | Request, model and source logging | Answers not traceable | Clinical governance |
| Human sign-off | Citations and structured output for clinicians | Unreviewed AI summaries | Medical director |
Frequently asked questions
Does Plugsky make us compliant?
No. Compliance is your program. Plugsky provides deployable controls - scoped keys, private deployment, logging - that you document and audit against your own clinical and privacy obligations.
Can data stay inside the hospital estate?
Yes. VPC, on-prem and air-gapped deployments keep prompts, documents and embeddings inside your environment, and the API stays OpenAI-compatible.
What happens if inference is unavailable?
Design a manual fallback per workflow. Multi-region and failover guidance covers resilient deployments, but clinical operations should never depend on a single path.
What should we log?
Request IDs, model names and versions, retrieved source identifiers, outputs and the reviewing clinician, retained under your policy so care-facing answers can be reconstructed.
Can we summarise patient records today?
Summarisation works with retrieved content, but keep identified records on in-estate deployment and require clinician review. Files and batch endpoints are coming soon.
How do we evaluate clinical models?
Build question sets from approved pathways, score accuracy and citation quality, and re-run evaluations whenever a model version changes.
Where should a pilot start?
Pilot on operational policy and published pathways with the free plan, verify accuracy and logging, then extend to clinical content with sign-off.