Fixed Fee • $1,000 • 5 Business Days

Private AI Exposure Review

Discover where sensitive information may be entering AI tools, document the risks, and get a practical plan to bring those workflows under control.

Your employees may already be using ChatGPT, Microsoft Copilot, Gemini, and other AI tools with organizational information. This review identifies where sensitive information may be entering AI systems, documents the associated risks, and gives your organization a practical plan for bringing those workflows under control.

What’s included

1. AI Use Discovery

We identify how AI is currently being used across the organization, including:

Public AI chatbots
Personal versus organization-managed accounts
AI features embedded in existing software
AI-assisted documentation and communication
File and document uploads
AI-generated summaries and analysis
Unapproved or informal “shadow AI” workflows

This review covers up to five employees or stakeholders selected by the organization.

2. Sensitive-Data Exposure Review

We examine where employees may be entering or uploading:

Protected health information
Personally identifiable information
Patient correspondence
Internal policies and procedures
Financial or billing information
Employee information
Proprietary business information
Credentials, code, or internal technical details

The purpose is to identify exposure paths — not to blame employees for attempting to work more efficiently.

3. AI Data-Flow Map

You receive a visual map showing:

Where information originates
Which AI tools receive it
Whether the tool is internally or externally hosted
Which third parties may process or store it
Where organizational control is reduced
Which workflows require additional investigation

This gives leadership a clear picture of where information goes when AI is used.

4. AI Workflow Risk Register

Each discovered workflow is documented and assigned a practical risk level:

Lower risk: Suitable for continued use with basic safeguards
Managed risk: May continue after account, policy, or data-handling changes
High risk: Sensitive information should not enter the current system
Unverified: Additional vendor or technical information is required

Each entry includes tool and workflow, information involved, potential exposure, existing safeguards, recommended action, and priority level. This is an operational risk register, not a formal legal determination or HIPAA compliance certification.

5. Approved, Restricted, and Prohibited Use Matrix

You receive a plain-English guide employees can actually follow:

Classification	Meaning
Approved	The workflow may continue under documented conditions
Restricted	Requires de-identification, managed accounts, approval, or other safeguards
Prohibited	Sensitive information should not be processed through the current tool
Under review	Vendor terms, data handling, or technical controls must be verified

This becomes the foundation for an internal AI acceptable-use policy.

6. Cloud Versus Private AI Recommendations

We identify:

Workflows that can reasonably remain cloud-based
Workflows that require stronger vendor or account controls
Workflows that should use de-identified information
Workflows that may be appropriate for local or sovereign AI
Cases where AI should not be used at all

HIPAASafeAI does not recommend private infrastructure where a simpler safeguard adequately addresses the risk.

7. Prioritized 30-Day Action Plan

The final report includes a practical sequence of actions divided into:

Immediate: Exposure paths to stop or contain now
Within 7 days: Account, access, policy, and staff changes
Within 30 days: Vendor reviews, technical controls, and workflow redesign
Future planning: Private AI opportunities requiring additional evaluation

Every recommendation includes an owner, priority, and expected outcome whenever the necessary information is available.

8. Employee Quick-Reference Guide

You receive a concise, printable guide covering:

What employees may enter into public AI
What must never be entered
When information should be de-identified
How to recognize sensitive documents
What to do after an accidental disclosure
Who should approve a new AI tool

This can be distributed immediately while longer-term controls are being implemented.

9. Leadership Findings Brief

At completion, HIPAASafeAI conducts a 45-minute findings meeting covering:

The most important exposure paths
The highest-priority actions
Quick improvements
Recommended policy changes
Potential private AI use cases
Leadership questions

The organization receives the report and supporting documents after the review.

Final deliverables

The client receives:

Executive findings summary
Current AI use inventory
AI data-flow map
Workflow risk register
Approved/restricted/prohibited use matrix
Cloud-versus-private recommendation matrix
Prioritized 30-day action plan
Employee AI safety quick-reference guide
45-minute leadership findings meeting

Deliverables are provided electronically in PDF format, with supporting worksheets where appropriate.

The process

Intake

The organization completes a short questionnaire covering current AI tools, known employee use, sensitive-data categories, existing AI policies, relevant vendors and software, and primary concerns.

Discovery meeting

A 60-minute remote meeting is conducted with the primary contact and selected stakeholders.

Staff input

Up to five staff members complete a short questionnaire or participate in brief interviews.

Analysis

HIPAASafeAI maps the identified workflows, classifies exposure risks, and develops practical recommendations.

Delivery

Within five business days of receiving the required information, the organization receives its findings package and leadership briefing.

Client time required

Approximately:

30 minutes for intake
60 minutes for the discovery meeting
10–15 minutes per participating employee
45 minutes for the final briefing

What this review is not

The Private AI Exposure Review is not:

A formal HIPAA Security Risk Analysis
A HIPAA compliance certification
Legal advice
A penetration test
A vulnerability scan
Forensic analysis
Continuous network monitoring
A complete review of every organizational vendor
A guarantee that no disclosure or breach has occurred
Remediation or implementation work

If the review uncovers evidence suggesting an actual breach, legal violation, or active security incident, the client may be advised to contact qualified legal counsel, compliance personnel, or an incident-response provider.

Scope limits

The $1,000 fixed fee covers:

One legal organization
One primary location or shared technical environment
Up to five participating employees
Up to ten identified AI workflows
One discovery meeting
One revision for factual corrections
One leadership findings meeting

Additional locations, departments, workflows, interviews, or technical environments may require a separate scope.

What we need from the client

The client agrees to:

Provide accurate information about known AI use
Designate one primary contact
Make selected staff available
Provide relevant policies, screenshots, vendor names, or account details
Avoid submitting live patient records unless a secure and specifically approved method has been established
Review draft findings for factual accuracy

Importantly, HIPAASafeAI does not need copies of patient records to perform this review.

Price and payment

Fixed project fee: $1,000

Payment is due before the review begins.
Work begins once payment and the completed intake questionnaire are received.
Recommendations requiring implementation, policy development, hardware, deployment, or ongoing advisory services are quoted separately.

Ready to request your review?

Complete a short intake questionnaire to help HIPAASafeAI understand your organization's current AI use and determine whether the fixed-scope review is a good fit.

Request Your Private AI Exposure Review

Submitting the questionnaire does not obligate you to purchase the review. HIPAASafeAI will evaluate the request and contact you regarding fit, availability, and next steps.