Cloud AI services want a Business Associate Agreement and create breach exposure every time PHI moves. We'll build the whole system on your hardware instead: the agents, the orchestration, and the models that run your practice's work, and patient data never leaves your network.
Every deployment starts on-site, with the people who do the work.
HIPAA was built for a world where data stays within defined boundaries. Cloud AI breaks those boundaries by design. HHS levied $9.4 million in HIPAA penalties since 2024, with per-violation fines reaching $2.19 million for willful neglect. Every patient record processed through a cloud LLM is a transmission you cannot undo.
When a provider uses a cloud AI service to draft a clinical note, summarize a patient encounter, or write a prior authorization letter, the Protected Health Information in that prompt leaves the practice's network. It is transmitted to a cloud data center, processed on shared infrastructure, and returned over the public internet. Under HIPAA, this transmission makes the cloud AI provider a business associate. A Business Associate Agreement (BAA) is required. The provider's data handling practices become your compliance responsibility.
Some cloud AI providers now offer "HIPAA-eligible" tiers with BAA support. This addresses the contractual requirement - but it does not eliminate the structural risk. PHI is still transmitted to, and processed on, infrastructure you do not control. A breach at the cloud provider is a breach of your patient data. Under the HIPAA Breach Notification Rule (45 CFR 164.402), that disclosure may be reportable.
The distinction matters: "HIPAA-eligible" means a cloud provider has agreed to certain contractual obligations. "HIPAA-simpler" means the data never left your building in the first place, and the entire third-party compliance layer does not apply. Medical practices share this challenge with every data-sovereign industry we serve - the solution is the same infrastructure, applied to different compliance frameworks.
PHI stays within your physical infrastructure. The compliance path gets shorter.
AI models run on a physical server in your facility. Patient data travels from the workstation to the server over your internal network. No internet connection required for inference. No data packets leave your building.
When PHI never leaves your network, there is no third-party business associate. The BAA requirement, the vendor security assessment, and the ongoing compliance monitoring of the cloud provider - all of it goes away.
The server lives behind your firewall, under your physical access controls, governed by your security policies. You control who accesses it, how data is handled, and what stays logged. Your compliance posture. Your rules.
A general model knows textbook medicine and nothing about your clinic. It's never seen your note templates, doesn't know your referral network, can't tell your billing team's shorthand from a nurse's triage note. We build for the practice you run.
Island Mountain builds the agents and the orchestration that carry the work that eats your staff's day: intake and history, prior-auth drafting with the payer's own denial patterns in view, a clinical note from a dictated encounter, coding review against the documentation, the referral letter and the appeal. It runs on current open-weight models like Kimi K3, ZAI GLM 5.2, Qwen 3.8+, and Nous Hermes 4, served through Ollama or vLLM behind an OpenWebUI front end, or whatever open weights fit the task. All of it governed by our own agentic orchestration and the Woven Security Fabric, so every action carries an identity, an approval, and a receipt, and the credentials expire when the task is done. PHI never leaves the building to make any of it happen.
When the work needs a model that speaks your medicine, we'll build one. Reasoning models and small language models from scratch, trained to orbit your clinical ontology: your specialties, your order sets, your payer mix, the way your practice charts. It learns your abbreviations and your cadence, not a generic hospital's.
It air-gaps for the records that demand it, and reaches out only when a task genuinely needs to. You decide, workflow by workflow.
Then we hand it back. On-site onboarding, SOPs your staff can follow, the keys dropped into your team's hands so they run and rework the workflows without a support ticket. Want the upkeep off your practice's plate? We offer tiered support sized to your clinic, and we plug in wherever that's easiest. This is your practice's legacy. We build it alongside you, and we won't call it done until your people can run it without us.
These aren't chat prompts. They're agentic workflows the orchestration runs start to finish, each step carrying its own identity and receipt, and no PHI leaves your network.
Generate first drafts of SOAP notes, progress notes, and visit summaries from dictated or typed encounter descriptions. Providers review and finalize. The AI handles the documentation burden - the provider retains clinical judgment.
Draft prior authorization narratives with clinical justification language. Feed in the procedure, diagnosis, and clinical context - the AI produces a structured letter that addresses common payer denial patterns.
Generate plain-language patient education documents tailored to specific conditions, procedures, or medication regimens. Produce materials at appropriate reading levels for your patient population.
Review encounter documentation against coding requirements. Identify documentation gaps that could affect code selection or audit defensibility. Flag areas where additional clinical detail would support the billed level of service.
Draft referral letters, insurance appeal letters, patient recall correspondence, and internal communications. Consistent formatting and professional tone across all practice communications.
Draft patient communications, translate education materials, and produce discharge instructions in your patients' languages. A second model runs these in parallel while the primary handles clinical drafting, all on your own hardware.
OpenWebUI is a browser-based chat interface. It looks and operates like ChatGPT. Your staff open Chrome or Firefox on any device connected to your office network, log in with their credentials, and start typing. There is no software to install on workstations, no command-line interface, no technical configuration.
Administrative staff who draft correspondence, billing specialists who write appeal letters, and clinical support staff who prepare patient education materials can use the system immediately. The learning curve is the same as any chat-based AI tool they may have already tried at home.
OpenWebUI includes user management and access controls. You can create accounts for each staff member, track usage, and control which models are available to which users. Admin controls are built in.
25 total users: 15 providers plus 10 administrative and billing staff.
| Cloud AI (25 Users) | Island Mountain build | |
|---|---|---|
| Year 1 Cost | $9,000 - $45,000 | One-time purchase (quoted to the deployment) |
| Year 3 Cumulative | $27,000 - $135,000 | Electricity only (~$1,200 - $2,400/yr) |
| PHI Location | Cloud provider data centers | Your server room. Your control. |
| BAA Required | Yes - mandatory for HIPAA | No. Data never leaves your network. |
| Breach Exposure | Every session transmits PHI externally | Zero external transmission. |
| Per-User Fees | $30 - $150 per user per month | None. Unlimited users. |
| EHR Integration | Some platforms offer integrations | Not included. Standalone AI. |
| Vendor Compliance Monitoring | Ongoing - your responsibility | Not applicable. No vendor. |
| Staff Training | Platform-specific onboarding | Browser-based. Same day. |
Clarity on boundaries prevents bad purchasing decisions.
Island Mountain hardware does not connect to Epic, Cerner, Athenahealth, or any EHR system. The AI runs through OpenWebUI - a standalone browser-based interface. Moving data between your EHR and the AI is a manual copy-paste process.
This hardware is not FDA-classified, not a clinical decision support tool, and not a diagnostic system. It generates text based on what you provide. It does not access medical databases, imaging systems, or lab results. Clinical judgment remains entirely with the provider.
The system is a text generation tool, not a data analytics platform, so it performs no population health analytics, quality measure reporting, or clinical outcome tracking. It writes what you ask it to write - it does not analyze your practice data.
After the 30-day included support period, your practice or IT contractor handles OS updates, model updates, and general system maintenance. This is standard Linux server administration. Most managed service providers who support medical offices can handle it.
Power & Installation: All Island Mountain systems require a dedicated 208V/30A power circuit (NEMA L6-30R). Most medical offices with an existing server closet or IT room have this infrastructure or can add it for $500-$2,000 through a licensed electrician. The system fits in a standard 4U rack space. Average power draw under typical inference loads is 1.5-2.5 kW. Temperature requirements are standard office HVAC (64-80°F).
No. A Business Associate Agreement is only required under HIPAA when Protected Health Information (PHI) is shared with a third-party service provider. On-premises AI hardware processes PHI entirely within your facility - no data transmitted to any external service means no business associate relationship exists. The BAA requirement under 45 CFR Part 164 does not apply.
No. Island Mountain builds general-purpose AI infrastructure, not a medical device or clinical decision support tool. It is not classified under FDA regulations and does not provide diagnostic assistance or treatment recommendations. The system runs current open-weight models and custom models we build for your practice, all on your own hardware inside your facility.
Yes. The system runs OpenWebUI, a browser-based interface that works like ChatGPT. Staff open any web browser on the office network, log in, and start typing. No command line, no technical configuration, no software installation. Administrative staff, billing specialists, and clinical support staff can use the system on day one.
Cloud AI subscriptions for healthcare platforms typically cost $30 to $150 per user per month. For 25 users, that totals $9,000 to $45,000 per year with ongoing BAA management overhead and breach exposure on every query. An Island Mountain build is a one-time purchase, sized and quoted to your workload. No per-user fees. No BAA required.
Island Mountain is an engineering practice, not a compliance authority. References to HIPAA, the Breach Notification Rule, or Business Associate Agreement requirements on this page reflect factual descriptions of data handling mechanics - not legal or regulatory advice. Consult qualified counsel or your compliance officer for determinations specific to your practice.
Tribal health services department serving 12,000 patients. Patient data never leaves sovereign territory. Full HIPAA and OCAP compliance from day one.
Scenario: Tribal Health DepartmentMulti-site rural practice with no reliable broadband. Local AI runs clinical decision support without depending on internet connectivity.
Scenario: Rural Health NetworkBehavioral health clinic processing sensitive patient narratives. Zero risk of PHI exposure to third-party cloud providers.
Scenario: Behavioral Health PracticeNo sales pitch. Tell us about your practice and we will spec the right system for HIPAA-compliant local inference.
One conversation. No sales pitch. Tell us about your practice's AI needs and we will spec the right system.
Or call directly: 1-341-441-8740
See all eleven industries we serve or explore: Law Firms · Tribal Nations