Stop Patient Data from Reaching AI Tools Unprotected
Clinicians, administrators, and health IT teams interact with AI tools daily. Sonomos detects patterns consistent with protected health information locally, before any data is transmitted to third-party services.
Start Protecting Patient DataWhat Sonomos Detects
Sensitive data patterns relevant to healthcare that Sonomos identifies in real time.
Medical Record Numbers (MRNs)
Patterns consistent with medical record numbering formats, detected in proximity to healthcare-related keywords.
Contextual pattern matchingPatient Names & Demographic Identifiers
Named entity recognition identifies person names and location data. Contextual matching detects dates of birth, admission dates, and other demographic patterns in healthcare contexts.
NER + contextual matchingDiagnosis & Procedure Codes
Patterns consistent with ICD-10, CPT, and HCPCS code formats detected in proximity to clinical keywords.
Contextual pattern matchingInsurance & Billing Identifiers
National Provider Identifiers (NPIs), health plan beneficiary numbers, and insurance policy numbers with structural format validation where applicable.
Structural + contextual matchingGovernment-Issued Identifiers (SSNs)
Social Security Numbers with checksum validation, frequently present in patient intake and billing workflows.
Structural validationPrescription & DEA Numbers
Patterns consistent with DEA registration numbers (structural validation of check-digit algorithm) and prescription identifiers.
Structural validationWhether data constitutes Protected Health Information (PHI) under HIPAA requires that it both identifies an individual and relates to a health condition, treatment, or payment. Sonomos identifies pattern matches consistent with these data types. It does not determine PHI status.
Regulatory Relevance
Sonomos identifies pattern matches, not compliance status. The following frameworks may be relevant when detected data types are transmitted unprotected.
HIPAA
When data matching medical-record patterns is transmitted unprotected to an AI tool or unrecognized external service, Sonomos flags a HIPAA relevance signal. This signal indicates a pattern match, not a determination that PHI was disclosed or that a HIPAA violation occurred.
CCPA
When personal identifiers are transmitted to a third-party AI tool, Sonomos flags a CCPA relevance signal.
Signal requirements: A relevance signal requires that (1) data in a specific category was flagged, (2) that data was transmitted unprotected, and (3) the destination matches a relevant classification (AI tool, healthcare provider, or unrecognized external service). Blocked or remediated transmissions do not trigger signals.
Sonomos does not determine whether data constitutes PHI, whether a covered entity or business associate relationship exists, or whether a BAA is in place. Users can configure known BAA-covered destinations in their compliance profile. Sonomos does not replace a compliance program, privacy officer, or legal counsel.
How It Works
Detect
Sonomos scans page content locally for MRNs, patient names, diagnosis codes, insurance identifiers, and other patterns consistent with health data. All processing happens in your browser.
Alert
Flagged data appears with a traffic-light overlay. Red for structurally validated matches (SSNs, DEA numbers). Yellow for contextual matches (MRNs, diagnosis codes near clinical keywords).
Block or Mask
Outbound transmissions containing flagged data can be intercepted and masked or blocked before reaching an AI chatbot, external form, or API endpoint.
Report
Events are logged locally. Export PDF snapshots for compliance documentation, incident response, or audit preparation.
Why Local-Only Matters for Healthcare
HIPAA requires covered entities and business associates to implement safeguards for PHI. A privacy tool that transmits patient data to its own cloud for analysis creates a new disclosure event and may require a BAA with the tool vendor. Sonomos eliminates this problem by processing everything locally. No patient data touches Sonomos servers. No new business associate relationship is created. No additional disclosure risk.
Patient data belongs in the chart, not in a chatbot's training set.
Get Sonomos for Your Organization