AI in Regulated Industries: What HIPAA, SOC 2, and PCI-DSS Actually Require from Your Workflows

Introduction

The Scale of the Risk

IBM's 2025 Cost of a Data Breach Report puts the stakes in clear terms:

• 97% of organizations experiencing AI-related security incidents lacked proper AI access controls.

• 63% of breached organizations had no AI governance policies in place at all.

• The average U.S. data breach cost hit an all-time high of $10.22 million in 2025.

• U.S. agencies issued 59 AI-specific regulations in 2024 — more than double the prior year.

What HIPAA Requires from AI Workflows

HIPAA's Security Rule applies to any electronic protected health information (ePHI) — which means any AI workflow that touches patient data, appointment records, billing information, or clinical documentation is covered:

• Access controls: Only authorized personnel can view, modify, or interact with ePHI within the workflow.

• Audit controls: Hardware, software, and procedural mechanisms must record and examine access and activity in systems containing ePHI — AI systems included.

• Integrity controls: Measures must be in place to ensure ePHI isn't altered or destroyed without authorization — including by AI errors.

• Transmission security: ePHI must be encrypted whenever it's transmitted — including through API calls between AI systems and connected platforms.

What SOC 2 Requires from AI Workflows

SOC 2 applies to service organizations that store, process, or transmit customer data. The five Trust Service Criteria most relevant to AI workflows are:

• Security: Systems must be protected against unauthorized access, both physical and logical.

• Availability: Systems must be available for operation and use as agreed.

• Processing integrity: System processing must be complete, valid, accurate, timely, and authorized.

• Confidentiality: Information designated as confidential must be protected as committed.

• Privacy: Personal information must be collected, used, retained, disclosed, and disposed of in conformity with commitments.

The Architectural Approach That Works

Businesses in regulated industries can deploy AI workflows that meet their compliance requirements if those requirements are treated as design inputs:

• Data never leaves your infrastructure without encryption — workflows operate within your environment or isolated, SOC 2-aligned environments.

• Role-based access controls are configured from day one — not added after deployment.

• Full audit trails are built into every workflow, with timestamps, user attribution, and exportable records.

• Business data is never used to train AI models — strict isolation between your data and any vendor-side model training.

• Private deployment options are available for regulated industries that require data residency.

How Steele Nash Approaches Regulated Industries