--- title: "Stop patient data from reaching AI tools unprotected" description: "Clinicians and health IT teams use AI daily. Locke detects patterns consistent with protected health information locally, before any data is transmitted." url: "https://sonomos.ai/who-its-for/healthcare/" source: "https://sonomos.ai/who-its-for/healthcare/" --- # Stop patient data from reaching AI tools unprotected Locke flags patterns consistent with PHI on your device and can mask or block them before the prompt reaches the AI. [Download Locke](https://sonomos.ai/downloads/)[See how it works](https://sonomos.ai/locke/#demo) ## What Locke detects ### Medical record numbers (MRNs) Patterns consistent with MRN formats, near healthcare keywords. Contextual pattern matching ### Patient names and demographics Named entity recognition finds names and places. Contextual matching catches dates of birth, admission dates and other demographics in clinical text. NER + contextual matching ### Diagnosis and procedure codes Patterns consistent with ICD-10, CPT and HCPCS codes, near clinical keywords. Contextual pattern matching ### Insurance and billing identifiers NPIs, health plan beneficiary numbers and insurance policy numbers, format-validated where possible. Structural + contextual matching ### Social Security numbers SSNs with checksum validation. They turn up often in intake and billing. Structural validation ### Prescription and DEA numbers Patterns consistent with DEA registration numbers (check digit verified) and prescription identifiers. Structural validation To be PHI under HIPAA, data must both identify an individual and relate to a health condition, treatment or payment. Locke finds patterns consistent with these data types. It does not determine PHI status. ## Frameworks that may apply to flagged data Locke reports pattern matches, not compliance status. These frameworks may be relevant when detected data is sent unprotected. ### HIPAA Locke flags a HIPAA relevance signal when data matching medical-record patterns is sent unprotected to an AI tool or unrecognized external service. The signal is a pattern match, not a finding that PHI was disclosed or that HIPAA was violated. - [45 CFR Part 164, Subpart E: the HIPAA Privacy Rule](https://www.ecfr.gov/current/title-45/part-164/subpart-E) - [45 CFR Part 164, Subpart C: the HIPAA Security Rule](https://www.ecfr.gov/current/title-45/part-164/subpart-C) ### CCPA Locke flags a CCPA relevance signal when personal identifiers are sent to a third-party AI tool. - [California Privacy Protection Agency: CCPA regulations](https://cppa.ca.gov/regulations/) Signal requirements: A relevance signal requires (1) flagged data in a specific category, (2) sent unprotected, (3) to a destination matching a relevant classification (AI tool, healthcare provider, or unrecognized external service). Blocked or remediated transmissions don't trigger one. Locke does not determine whether data is PHI, whether a covered entity or business associate relationship exists, or whether a BAA is in place. You can add BAA-covered destinations to your compliance profile. Locke does not replace a compliance program, privacy officer or legal counsel. ## Four steps, all on your device ### Detect Locke scans for MRNs, patient names, diagnosis codes, insurance identifiers and other patterns consistent with health data. It all runs on your device. ### Alert Each match is color-coded by confidence: red for structurally validated matches like SSNs and DEA numbers; yellow for contextual ones, like an MRN or diagnosis code near clinical keywords. ### Block or mask Locke can mask flagged data or block the request before it reaches a chatbot, an external form or an API endpoint. ### Report Events are logged on your device. Export PDF snapshots for compliance files, incident response or audit prep. ## Patient data never reaches our servers HIPAA requires covered entities and business associates to safeguard PHI. A privacy tool that sends patient data to its own cloud creates a new disclosure, and may need its own BAA. Locke works on your device, and Sonomos receives only your account, licence status and settings. Our position is that this creates no new business associate relationship. Leave the MRN in the chart. Ask the AI the clinical question. [Get Locke for your organization](https://sonomos.ai/downloads/) Or [try the interactive demo](https://sonomos.ai/locke/#demo) first. ## Reading for healthcare - [HIPAA-Compliant AI: A Complete Checklist for Healthcare Organizations in 2026](https://sonomos.ai/blog/hipaa-compliant-ai-checklist-2026/) - [Is Perplexity AI HIPAA Compliant? A 2026 Guide for Healthcare Teams](https://sonomos.ai/blog/is-perplexity-ai-hipaa-compliant-2026/) - [Is Microsoft Copilot HIPAA Compliant? M365, GCC, and the Real Answer for 2026](https://sonomos.ai/blog/is-microsoft-copilot-hipaa-compliant-2026/) - [Is Gemini HIPAA Compliant? Workspace, Vertex AI, and the BAA in 2026](https://sonomos.ai/blog/is-gemini-hipaa-compliant-2026/) See also [Legal](https://sonomos.ai/who-its-for/legal/)[Financial Services](https://sonomos.ai/who-its-for/financial-services/)[Technology](https://sonomos.ai/who-its-for/technology/)[Individuals](https://sonomos.ai/who-its-for/individuals/) Related concepts [What is PHI?](https://sonomos.ai/glossary/protected-health-information/)[What is PII?](https://sonomos.ai/glossary/personally-identifiable-information/)[Data masking](https://sonomos.ai/glossary/data-masking/)[Redaction](https://sonomos.ai/glossary/redaction/)[Zero-knowledge processing](https://sonomos.ai/glossary/zero-knowledge-processing/) [Compare Locke with cloud DLP and enterprise privacy platforms](https://sonomos.ai/compare/).