Flow is in pre-release. Flow-Edge and the audit trail are part of the deployment offer (roadmap) — not capabilities marked live today. For status in writing: hello@theflow-ai.com.
PHI does not get to leave the boundary because a vendor's future plan says so. Masked secure cloud and fully local deployment are paths designed into the engagement (roadmap) — not live toggles today.
The constraint
Healthcare organizations are not short of automatable work: prior authorization packets, referral intake, claims correspondence, chart summarization for administrative review, cross-state licensure checks in telehealth. What they are short of is a way to automate any of it without routing protected health information through a system whose retention and subprocessor behavior cannot be fully accounted for in a BAA.
How Flow addresses it
- Fully local deployment (Flow-Edge) — roadmap. When policy requires that PHI not leave the network, this is the deployment path designed into the engagement — not a live cloud toggle today. It is the path for organizations whose policy prohibits external processing.
- Masking before processing — roadmap. In the masked-cloud model, identifiers are designed to be detected and masked before processing. Deployment status is closed in the engagement, not a live toggle today.
- Immutable audit trail — roadmap. For regulated deployments, an append-only log is planned: what was observed, what was proposed, who approved it, and what was executed. Not a live product toggle today; closed in the engagement. That record is the evidence base an OCR inquiry or an internal investigation would need.
- Human approval on high-risk actions. Clinical and billing consequences do not get automated away silently.
Research on healthcare deployment
- Compliance by Design: Architecting AI Workflow Automation Under HIPAA
- AI Automation in Telehealth: Cross-State Licensure, HIPAA, and the Post-Emergency Landscape
- AI Automation in Life Sciences: GxP Validation and 21 CFR Part 11 Electronic Records
- What Is Data Masking? De-Identifying Data Before It Reaches an AI Model
- Designing Human-in-the-Loop Systems People Actually Use
Evaluating AI automation under HIPAA?
Start with the architecture, not the demo.
Read the Security Page