Key facts
| Healthcare fit | Minimum-necessary scopes per key; consent enforced in your app |
| API auth | Bearer API keys, scoped per environment and revocable on rotation |
| Workforce identity | SSO with SCIM provisioning for console and admin access |
| Authorization | RBAC with least-privilege scopes per key |
| Retention | Configurable prompt retention; review the DPA for your terms |
| Audit | Authentication, key lifecycle and admin events exportable to SIEM |
| Residency | Region-locked planes plus VPC, on-prem and air-gapped |
| Free plan | plugsky-micro and plugsky-lite, no card; 14-day full-access trial |
TL;DR
- Treat clinician identity and patient delegation as separate problems with separate owners.
- Issue minimum-necessary scoped keys per clinical service, never shared team keys.
- Minimise or de-identify PHI before it reaches the model; keep the mapping in your systems.
- Export auth, key and admin events to the SIEM and join them with model metadata.
- Pin workloads to a region or deploy on-prem where patient data must stay put.
How it works, step by step
- Map the workflow to a narrow clinical task — discharge summary drafting, coding support, inbox triage — and define who reviews the output.
- Federate your identity provider to Plugsky SSO and map clinical and administrative groups to RBAC roles.
- Give each service a minimum-necessary scoped key in an approved secrets store; review scopes quarterly and rotate on schedule.
- Keep patient consent and delegated access in the EHR or your own authorization layer, and pass only de-identified or minimised text to the model.
- Route calls through a gateway that enforces model allow-lists, quotas, redaction and logging before the OpenAI-compatible endpoint.
- Stream authentication, key, admin and inference events to your SIEM, and set retention to the minimum your policy allows.
- Pilot behind human review with an evaluation set, then expand only when accuracy and safety metrics hold.
Try it yourself
Open the AI data residency checklist →
Clinician identity and patient delegation are different jobs
Clinicians and administrators need federated sign-in with lifecycle automation, so departure from the roster removes access quickly. Plugsky supports SSO with SCIM for that plane, mapped to RBAC roles for console and administrative functions. Services — the triage summariser, the coding assistant — should not act as a person; they get minimum-necessary scoped keys instead.
Patient delegation is a third concern. Consent, treatment relationships and authorisation to share data are recorded and enforced in the EHR or your own authorization layer. Keep the Plugsky key server-side and let a broker decide what a session may do; the model provider never becomes the consent store.
Controls you can evidence
Healthcare reviews ask for specificity, so design for it. Minimise and redact before prompting, and keep identifiers and their mappings inside your systems. Scope every key to one service and environment, rotate it on a defined schedule, and revoke immediately when a vendor or staff member leaves.
- Access: RBAC roles for people, scoped keys for services, no shared credentials.
- Retention: configurable prompt retention, set to the minimum your records policy permits.
- Audit: authentication, key lifecycle, admin and inference events exported to the SIEM.
- Residency: region-locked planes or on-prem and air-gapped deployment.
Plugsky publishes security documentation, deployment options and a DPA you can assess. Whether your specific use satisfies HIPAA or another regime depends on configuration, contracts and your policies — decide that with your compliance team rather than assuming a vendor checkbox covers it.
Piloting clinical AI safely
Start with documentation support and back-office workflows, where a clinician or coder reviews every output. That keeps value measurable and risk bounded while you build evidence: accuracy on a held-out set, escalation rates, and the percentage of outputs edited before use. Models with different strengths can run behind one endpoint — 30+ models, one OpenAI-compatible API — so you can move a task between small and frontier tiers as evidence changes.
Keep the funnel honest for staff: if the model is drafting rather than deciding, say so in the UI. Review terms on the live pricing page, and confirm endpoint status in the docs — chat, streaming, JSON mode, function calling and embeddings are live, while audio, images and files remain coming soon.
Honest comparison
| Concern | Plugsky | Consumer AI tools | Hospital-built platform |
|---|---|---|---|
| Staff identity | SSO with SCIM and RBAC | Personal accounts | Reuse hospital IdP |
| Service access | Minimum-necessary scoped keys | Unmanaged keys | Internal credential service |
| Patient consent | Enforced in the EHR or your app | Out of scope | EHR-owned |
| Residency | Region-locked, VPC, on-prem, air-gapped | Vendor cloud only | Hospital data centre |
| Audit | Auth, key and inference events to SIEM | Limited logs | Hospital SIEM integration |
Frequently asked questions
Is Plugsky HIPAA compliant?
Plugsky provides security documentation, scoped authentication, configurable retention, audit export and deployment options you can assess. Compliance depends on your configuration, contracts and policies — determine applicability with your compliance team.
Should PHI ever go into a prompt?
Minimise it first. Use de-identified or redacted text wherever the task allows, and keep the identifier mapping inside your own systems rather than in the model call.
How do clinicians sign in?
Through your identity provider with SSO, provisioned and deprovisioned with SCIM, and authorised with RBAC roles. Services use scoped keys instead of clinician accounts.
Where can patient data be processed?
Pin the workload to a region-locked plane, or deploy in your VPC, on-prem or air-gapped. Keep keys and logs in the same jurisdiction as the data.
What audit evidence is available?
Authentication, key lifecycle, administrative and inference events can be exported to your SIEM, giving reviewers a joined view of who accessed what and which model ran.
Can we start small?
Yes. Prototype on the free plan with plugsky-micro and plugsky-lite and synthetic data, then move to a paid plan or the 14-day full-access trial when the pilot expands.
Does Plugsky make clinical decisions?
No. Use it for drafting, extraction and triage support with a human reviewer in the loop; clinical judgement and accountability stay with your staff.