Compliance Monitoring and Management for PII/PHI
planned
N
Nick E
We have clients in a variety of verticals and locations where the state has extensive consumer protection laws on consumer privacy. If a business is large enough, standard HR departments will be handling employee PII. We implement DLP solutions within MS365, firewall, Checkpoint Avanan for these clients and some clients have other point solutions in place that they manage.
We need to be able to monitor for compliance breaches in Ai prompts within Hatz Ai.
Feature options such as:
- Warn the end user for possible PII in real-time
- Alert a security officer or email distro while halting the user/Agent AI usage or process
- provide a compliance dashboard
- reporting mechanism
- full api access to the prompt and input txt
I am sure others are much more verse in other safeguards and actual regulation standards that must be met. However, we are getting these types of questions to provide our clients (outside of possible Hatz deal) to provide them with Prompt security to Copilot and Claude. It's still early in the industry, every vendor is just 6 weeks they claim from going GA on some new Ai security solution. One of our clients didn't understand that with SentielOne's recent Prompt Security platform, we couldn't just turn it on in the S1 agent.
Customers are seeking security solutions for AI, the more native and baked into Hatz the better.
Amy House
As a Registered Investment Advisor (RIA), we have additional compliance, supervision, and record-retention obligations that extend beyond simply preventing PII/PHI exposure. In addition to the excellent items already listed, we'd like to see capabilities that support regulatory recordkeeping, auditability, and eDiscovery use cases if they don't already exist.
Additional considerations:
Chat Retention & Archiving
Ability to retain and archive all user and agent conversations, prompts, responses, and generated artifacts for configurable periods (ideally 3-5+ years) to support compliance, supervision, examinations, and legal discovery requirements. Integration with common archiving vendors such as Patrina would be highly valuable.
Global Search & eDiscovery
Ability for authorized compliance personnel to search across all AI interactions by client name, account number, user, keyword, date range, or other metadata and produce reports of all associated conversations and activity.
Generated Content Preservation
In addition to retaining the chat history itself, preserve, link, and reproduce any documents, reports, summaries, emails, or other artifacts that were generated during the AI interaction. From a compliance standpoint, being able to reconstruct exactly what information was provided to the AI and what content was ultimately produced is critical.
Compliance Review & Audit Trail
Maintain a tamper-evident audit trail showing who initiated the interaction, when it occurred, what data was entered, what safeguards were triggered, and what output was generated. This would greatly assist firms operating under financial services, healthcare, and other regulated industry requirements.
Thanks!
J

Julia Carroll
updated the status to
planned
D
Dustin Rye
I second this. Anything DLP related or adjacent would be huge.
M

Mark Leeper
Merged in a post:
Redact Confidential Information before sending
Buddy Pitt
Including data such as PHI or structured data that contains SSN# DOB Medical diagnosis combined with PII
J

Julia Carroll
updated the status to
under review