Global Regulatory Alignment
Aligned with UNESCO, WHO and NIST AI frameworks
UNESCO 2021
AI Ethics Recommendation
WHO 2021/2024
AI for Health Guidelines
NIST AI RMF
Risk Management Framework
FDA GMLP
Good Machine Learning Practice
VHT Pillars of Ethical AI
Our framework aligns with UNESCO AI Ethics Recommendation and WHO guidance for responsible AI in healthcare settings.
Human Rights & Autonomy
Every user maintains complete control over their healthcare AI interactions
- • Informed consent with clear policy versioning
- • Right to explanation for all AI recommendations
- • User agency over data sharing and AI preferences
- • Direct grievance mechanism for concerns
Human Oversight
Healthcare professionals maintain oversight with complete audit trails
- • Automatic escalation to healthcare providers
- • Complete audit trail with correlation IDs
- • Accountable ownership for all AI outputs
- • Clinical review for high-risk interactions
Safety & Harm Prevention
Crisis signals route to emergency resources
- • Suicide ideation and self-harm detection
- • Medical emergency recognition and routing
- • Drug interaction and safety warnings
- • Immediate connection to crisis resources
Transparency
Clear AI identification with source attribution and reasoning
- • "Why this?" explanations for all recommendations
- • Medical literature source attribution
- • Confidence scores and uncertainty indicators
- • Clear AI role disclosure and limitations
Privacy & Security
Zero PHI exposure with purpose-limited data collection
- • Protected health information with row-level security
- • Pseudonymized logging with correlation IDs
- • Purpose-limited data collection and retention
- • GDPR- and HIPAA-aligned privacy by design
Fairness & Inclusion
Continuous bias monitoring across all demographic groups
- • Real-time bias detection and correction
- • Equal performance across age, gender, ethnicity
- • WCAG 2.1 AA accessibility compliance
- • Multi-language and cultural adaptation
VHT Platform Real-Time Patient Safety Pipeline
Every interaction passes through our comprehensive safety system with response times under 50ms.
Input Analysis
Advanced NLP patterns detect crisis indicators, medication queries, and medical emergencies in real-time.
Risk Assessment
Messages are classified as critical, high, medium, or low risk based on content analysis and user context.
Smart Intervention
Based on risk level: crisis escalation, safety disclaimers, or standard AI response with appropriate safeguards.
Audit & Learning
Complete interaction logging for compliance, bias monitoring, and continuous system improvement.
Crisis Response Example
How ECHNA handles mental health emergencies
🚨 Crisis Detected
"I'm having thoughts of hurting myself"
⚡ Immediate Response (<30s)
- • Block harmful AI interaction
- • Display crisis resources immediately
- • Connect to 988 Suicide & Crisis Lifeline
- • Notify healthcare provider (if available)
📋 Documentation
Safety event logged for follow-up care coordination
Proven Safety Performance
Real-world metrics demonstrating our commitment to ethical AI
HIPAA Security Rule — Internal Self-Audit Record
VHT Platform maintains a continuous internal self-audit against the HIPAA Security Rule (45 CFR §164.308, §164.310, §164.312), reviewed by the VHT Security Office under the regulatory jurisdictions of the United States (HIPAA) and Canada (PHIPA equivalence mapping).
§164.308 — Administrative Safeguards
15 controls actively maintained
| § Reference | Safeguard | R / A | Status | VHT Implementation |
|---|---|---|---|---|
| 164.308(a)(1)(i) | Security Management Process | R | In Progress | Continuous compliance matrix, lifecycle audit trail, and immutable audit-log integrity snapshots. |
| 164.308(a)(1)(ii)(B) | Risk Management | R | In Progress | Documented incident log and periodic security round-checks with remediation tracking. |
| 164.308(a)(1)(ii)(D) | Information System Activity Review | R | In Progress | Append-only lifecycle event stream covering authentication, role, and consent activity. |
| 164.308(a)(2) | Assigned Security Responsibility | R | In Progress | Named HIPAA Security Officer and Privacy Officer per internal registry. |
| 164.308(a)(3)(ii)(A) | Authorization & Supervision | A | Implemented | Server-side role validation via dedicated user_roles table; client-side role checks prohibited. |
| 164.308(a)(4)(i) | Information Access Management | R | In Progress | Row-level security on every patient data table; hard-delete coverage probe enforced. |
| 164.308(a)(4)(ii)(B) | Access Authorization | A | Implemented | Role-based gates in every edge function combined with database row-level security. |
| 164.308(a)(4)(ii)(C) | Access Establishment & Modification | A | In Progress | Quarterly access review process tracked via lifecycle audit events. |
| 164.308(a)(5)(ii)(B) | Protection from Malicious Software | A | Vendor-managed | Managed by Database infrastructure and Apple iOS app sandboxing. |
| 164.308(a)(5)(ii)(C) | Log-in Monitoring | A | In Progress | Failed-login threshold detection with soft lockout (5 attempts / 15 min). |
| 164.308(a)(5)(ii)(D) | Password Management | A | In Progress | Documented Password Policy enforced via Database Auth. |
| 164.308(a)(6)(i) | Security Incident Procedures | R | In Progress | Published Incident Response Runbook with severity tiers and response SLAs. |
| 164.308(a)(7)(ii)(A) | Data Backup Plan | R | Vendor-managed | Nightly backups plus point-in-time recovery managed by Database. |
| 164.308(a)(8) | Evaluation | R | In Progress | Periodic security round-check audits with public summary records. |
| 164.308(b)(1) | Business Associate Contracts | R | In Progress | Business Associate Agreement registry maintained for all sub-processors handling PHI; executed with our primary AI provider, in progress with other core vendors. |
§164.310 — Physical Safeguards
5 controls actively maintained
| § Reference | Safeguard | R / A | Status | VHT Implementation |
|---|---|---|---|---|
| 164.310(a)(1) | Facility Access Controls | R | Vendor-managed | Database hosting provider holds a SOC 2 Type II report; BAA in progress. |
| 164.310(a)(2)(i) | Contingency Operations | A | Vendor-managed | Database-managed disaster recovery infrastructure. |
| 164.310(a)(2)(iii) | Access Control & Validation | A | Vendor-managed | Vendor-controlled physical access validation (Database). |
| 164.310(d)(1) | Device & Media Controls | R | In Progress | iOS Data Protection, app sandboxing, and full-disk encryption on workstations. |
| 164.310(d)(2)(iv) | Data Backup & Storage | A | Vendor-managed | Encrypted backups managed by Database. |
§164.312 — Technical Safeguards
12 controls actively maintained
| § Reference | Safeguard | R / A | Status | VHT Implementation |
|---|---|---|---|---|
| 164.312(a)(1) | Access Control | R | Implemented | Row-level security on every PHI table plus JWT-validated edge functions; controlled hard-delete pathway. |
| 164.312(a)(2)(i) | Unique User Identification | R | Implemented | Every member assigned a unique cryptographic identifier via Database Auth. |
| 164.312(a)(2)(ii) | Emergency Access Procedure | R | In Progress | Time-boxed emergency-access grant system (max 24h) with mandatory post-event review. |
| 164.312(a)(2)(iii) | Automatic Logoff | A | In Progress | Idle session timeout: 30 minutes for members, 15 minutes for administrators. |
| 164.312(a)(2)(iv) | Encryption at Rest | A | Vendor-managed | AES-256 encrypted storage managed by Database plus iOS Data Protection on device. |
| 164.312(b) | Audit Controls | R | Implemented | Durable lifecycle event log plus PHI audit trail with anonymization on account deletion. |
| 164.312(c)(1) | Integrity | R | Implemented | Append-only audit tables with daily checksum snapshots and automated tamper alerting. |
| 164.312(c)(2) | Authenticate ePHI | A | In Progress | Cryptographic checksum integrity verification on the audit-log chain. |
| 164.312(d) | Person or Entity Authentication | R | Implemented | Database Auth (email/password, Apple Sign-In, Google) with server-side session validation. |
| 164.312(e)(1) | Transmission Security | R | Implemented | TLS 1.2+ enforced on every network endpoint; HTTPS-only within the iOS WKWebView. |
| 164.312(e)(2)(i) | Integrity Controls (in transit) | A | Implemented | TLS protocol-level integrity verification on all data in transit. |
| 164.312(e)(2)(ii) | Encryption in Transit | A | Implemented | TLS 1.2 or higher on every Database and edge-function endpoint. |
Public-record disclosure
This is a member-facing summary of our internal HIPAA Security Rule self-assessment. Full evidence queries, owner names, review timestamps, and incident records are maintained in our private security registry and made available to enterprise partners under NDA. VHT.ai voluntarily applies HIPAA Security Rule controls and equivalent safeguards for Canadian PHIPA jurisdictions. This is an internal self-assessment, not an independent audit or certification. Vendor-managed rows rely on our infrastructure providers' own controls; Business Associate Agreements are executed with our primary AI provider and in progress with our other core vendors, tracked in our BAA registry.
Continuous Ethical Evolution
Our ethics framework evolves with advances in AI safety, regulatory updates, and stakeholder feedback to maintain the highest standards.
Monthly Safety Reviews
Regular assessment of safety metrics and incident analysis
- • Crisis escalation effectiveness
- • Bias detection and mitigation
- • User safety feedback analysis
- • System performance optimization
Quarterly Governance
Ethics board oversight and policy updates
- • Policy review and enhancement
- • Regulatory compliance assessment
- • Stakeholder consultation
- • External audit preparation
Red Team Testing
Adversarial testing for safety vulnerabilities
- • Edge case scenario testing
- • Safety bypass attempt detection
- • Bias injection resistance
- • Emergency response validation