PhiClaw White Paper: A HIPAA-compliant AI employee for medical practices

PhiClaw is the HIPAA-compliant build of OpenClaw, the open-source AI agent. It is sold to medical practices as an AI employee: software that signs a Business Associate Agreement (BAA, the HIPAA contract a vendor signs before it may handle patient data), runs on HIPAA-eligible infrastructure, and does the administrative work of a practice end to end. This paper explains how it is built, what it runs today, what it costs, and where its limits are.

1. Executive summary

Most AI tools tell doctors the same thing: they cannot touch patient data. The model provider will not sign a BAA, and the moment a staff member pastes a chart note into the tool the practice is exposed.

PhiClaw was built to remove that barrier. It signs a BAA with every customer. It runs on HIPAA-eligible infrastructure with subprocessor BAAs in place for AWS (including Amazon Bedrock), Convex, and its voice, fax, and e-prescribing partners. It ships its own HIPAA EHR and CRM and connects to the ones a practice already uses. When an EHR offers no API, the agent logs in with its own credentials on its own computer and works inside the screen, the way a new staff member would.

The result is a single AI employee that answers the phone, books appointments, runs intake, drafts SOAP notes, routes prescriptions to the clinician for signature, submits claims, sends faxes, collects signatures, and maintains the website and social channels. It is priced as a hire: $1,500 a month, or $5,000 a month with a dedicated forward-deployed engineer attached.

2. The problem: AI that cannot touch patient data

HIPAA does not certify software. It requires that any vendor handling protected health information (PHI, meaning names, dates, diagnoses, billing codes, or anything else that identifies a patient) sign a BAA with the practice and operate under appropriate safeguards.

That creates a chain. The vendor uses a cloud host, a database, and an AI model provider. Each of those is a subprocessor, and each one that touches PHI must also be under a BAA. If any single link is missing, the whole pipeline is non-compliant.

This is why general AI chatbots and raw, self-hosted OpenClaw fail the test. An open-source project has no legal entity to sign a BAA. A consumer AI API usually will not sign one either, and some retain inputs or train on them. The burden of closing every gap falls on whoever self-hosts the software, which for a medical practice is a serious engineering and legal undertaking. Background: HIPAA-eligible AI infrastructure explained.

3. What an AI employee is (and is not)

A chatbot answers questions. An AI employee moves work forward. PhiClaw has tools, logins, a schedule, memory, and a computer, and is accountable for outcomes rather than replies.

A practice owner delegates in plain language and the agent does the job across whatever systems it takes. "Move Thursday to next week" becomes an updated appointment in the EHR and a confirmation text.

What it is not: it is not a medical device, and it does not make clinical decisions. Diagnosis, treatment, and prescribing stay with the licensed clinician. PhiClaw handles the workflow around those decisions, not the judgment inside them.

4. Architecture

PhiClaw has five layers: the agent, the HIPAA infrastructure, the AI models, the EHR and CRM systems it reads and writes, and the voice and messaging channels.

4.1 The agent

The core is OpenClaw, an open-source agent runtime that plans multi-step tasks, calls tools, browses the web, reads documents, and remembers context across sessions. PhiClaw wraps that engine in the controls a healthcare deployment needs.

Each practice gets a private, HIPAA-secured virtual machine with Chrome. The agent can open any website or portal, read the screen, click, and type like a person, and every action it takes is recorded. Tasks can be one-off requests, recurring scheduled jobs, or triggered by events such as a new web form or an inbound fax.

A second, non-HIPAA agent handles work that never touches patient data: marketing copy, research, website edits, social posts. PHI stays on the HIPAA agent, which keeps the compliant boundary small.

4.2 The HIPAA infrastructure layer

PhiClaw runs on AWS under the AWS Business Associate Addendum, which covers the compute, storage, networking, and Amazon Bedrock services it uses. Its application database is Convex, under a fully executed BAA. Each practice's data is logically isolated from every other practice. The contracting entity on these agreements is You Squared LLC, and the executed documents are published at /BAAs/.

An on-premises deployment is available for enterprise customers with strict data-residency requirements.

4.3 Models

The model layer is where most healthcare AI stacks break, because the model provider is usually the uncovered link. PhiClaw solves it two ways and keeps both inside the BAA boundary.

• The Amazon Bedrock catalog. Bedrock is AWS's managed model service and is HIPAA-eligible under PhiClaw's AWS BAA. That gives PhiClaw the models Bedrock serves, including Anthropic Claude, Meta Llama, Mistral, and Amazon's Nova and Titan families. Bedrock's terms state that customer inputs are not used to train the base models.
• Open-weight models on PhiClaw's own HIPAA servers. Open-weight models publish their weights, so they can run on infrastructure PhiClaw operates rather than behind someone else's API. PhiClaw runs the Qwen, GLM, and Gemma families this way, so patient context never leaves the environment PhiClaw controls.

Tasks are routed to the right model: a fast local model for routine work such as reminder texts, a larger Bedrock model for harder reasoning such as a chart summary. The same safeguards apply on every route. Details: local AI models on HIPAA servers.

4.4 The EHR and CRM layer, and closed-EHR operation

PhiClaw ships with its own HIPAA EHR (charting, scheduling, billing, e-prescribing) and its own HIPAA CRM (leads, pipelines, follow-ups). A practice with no system, or that wants out of its current one, can start there, and migration is included.

A practice that wants to keep its EHR keeps it. PhiClaw connects to more than 30 EHRs, including Epic, Oracle Health, athenahealth, eClinicalWorks, NextGen, ModMed, DrChrono, and Healthie, plus the major CRMs. Connections use direct APIs where the vendor offers them, the FHIR and HL7 standards where supported (FHIR is the modern web standard for exchanging health records; HL7 is the older messaging standard most hospital systems still speak), and a Keragon partnership for healthcare automation. The full list is at /ehr-crm-integrations/, and developers can build on the PhiClaw REST API.

The important case is the closed EHR: no API, no FHIR endpoint, no sanctioned way in. Here PhiClaw does what a new hire does. The practice creates a user account for the agent, and the agent logs in from its own computer and works through the same screens staff use. No integration project is required, every screen it touches is logged, and the practice can revoke that login at any time.

4.5 Voice and messaging

Inbound and outbound calls run through PhiClaw's voice partner Retell AI, on Twilio telephony, under BAA. The agent picks up around the clock, answers questions like "Do you take Aetna?", books the visit, and calls back missed calls. For everyday non-PHI requests, staff reach PhiClaw on WhatsApp, iMessage, Slack, or Telegram; anything involving PHI runs inside the PhiClaw app on iOS, Android, and web, which is BAA-backed, encrypted, and audit-logged.

5. Security and compliance controls

A signed document is the start of compliance, not the end. The operational controls:

• BAA chain. PhiClaw signs a BAA with the practice before any PHI moves. Below it, BAAs are in place with AWS (covering Bedrock), Convex, Retell AI for voice, SRFax for fax, and Weno for e-prescribing. There is no uncovered link between the practice and the model.
• Encryption. All traffic between staff devices, patients, PhiClaw services, and subprocessors is encrypted in transit with TLS 1.2 or higher. PHI at rest in AWS and Convex is encrypted with AES-256, with keys managed separately from the data.
• Access control. Role-based permissions are enforced server-side, not just in the interface. A front-desk coordinator sees scheduling and messaging but not clinical notes; a physician sees the full chart.
• Audit logging. Every PHI touch, by a staff member or by the agent, is logged with a timestamp, the identity of the actor, and the action taken. Logs are tamper-evident and available for internal reviews or a regulator's audit.
• PHI minimization. Before any model call, direct identifiers such as names, dates of birth, and record numbers are stripped or masked when the task can be completed without them. When PHI must reach a model, it reaches only BAA-covered infrastructure, and it is never used to train shared models.
• Human in the loop for clinical decisions. The agent drafts; the clinician decides. Prescriptions are routed to the prescriber for review and signature. SOAP notes are drafts until signed. The agent also asks before spending money or taking any action it is unsure about.

6. Workflows it runs today

These are the jobs practices hand over most often. Each counts as one task against the plan allowance.

• Front desk. Answers and places calls 24/7, replies to texts, emails, and social DMs, confirms every visit, and chases no-shows.
• Scheduling. Books, moves, cancels, and confirms appointments in the practice's EHR or in PhiClaw's own. Runs recurring jobs such as a 7am confirmation pass.
• Intake. Sends pre-visit forms, collects digital intake, and moves the approved context into the right chart or queue.
• Scribe and SOAP notes. Listens to the visit and drafts the SOAP note for the clinician to edit and sign. Unlimited use for every provider on every plan.
• E-prescribing, including controlled substances. Through Weno, PhiClaw's DEA-audited e-prescribing partner, with EPCS support (Electronic Prescribing of Controlled Substances, the DEA-regulated process for Schedule II to V drugs). The agent prepares; the clinician reviews and signs every order.
• Insurance claims via Stedi. Electronic claim submission to insurers in the network through Stedi, a healthcare clearinghouse API, with eligibility checked in payer portals and denials followed up.
• Fax. Sends and receives HIPAA fax through SRFax under BAA, and routes inbound faxes to the right person.
• E-sign. Collects signatures on consents and agreements through Docunvex, with unlimited users and documents on the PhiClaw package (see section 9 for activation requirements).
• Website and marketing. Builds and edits the practice website, writes blog posts, cuts video into clips, and posts to Instagram, Facebook, and TikTok. Hosting and unlimited edits are included.

7. Economics

PhiClaw is priced as a hire. The comparison that matters is not another software subscription but the front-desk position, the answering service, the marketing agency, the billing service, and the owner's own evenings.

Full-time AI employee: $1,500 a month. Includes 4,320 questions or tasks a month, unlimited users, unlimited locations, and unlimited practices under one price. The HIPAA CRM, website and hosting, AI scribe, and HIPAA team chat are included. There is a one-time $3,000 implementation fee that covers unlimited Zoom calls with an engineer during the first month. Add-ons such as the EHR, e-prescribing, claims, fax, and e-sign are priced separately on this plan.

Dedicated FDE plan: $5,000 a month. No implementation fee. Five times the usage, at 21,600 questions or tasks a month. Every add-on included. A fully dedicated forward-deployed engineer (an engineer assigned to the practice who builds automations inside its real workflows, rather than a support desk), with one Zoom call a week and 20 hours a week of custom engineering work included.

Enterprise is custom, for health systems and groups that need white-label onboarding, SSO, an SLA, or on-premises models.

An honest note on limits: usage caps exist. A task is any single job, big or small, and a scheduled job counts once each time it runs. Past the included allowance, packs of 50 refill automatically at $15 each. Phone minutes are metered separately and unused tasks do not roll over. Every plan carries a 60-day, no-questions-asked money-back guarantee. Current terms are always at /pricing/.

8. The product family and the headless EHR (Marrow)

PhiClaw is the flagship of a family of HIPAA products built by the same company, each designed to be operated by the PhiClaw agent. The full list is at /products/.

• Talkya (talkya.ai): the HIPAA AI phone receptionist, available as a standalone product.
• Voti (voti.ai): an on-device AI medical scribe, so visit audio is processed on the clinician's own device.
• Ratatui (ratatui.ai): a HIPAA tracker for peptide and GLP-1 programs.
• Skey (skey.ai): a custom HIPAA software studio for practices that need something built to order.
• Docunvex (docunvex.com): agent-first e-signatures, meaning the signing flow is designed to be driven by an AI agent through an API, not only by a person clicking through a web page.
• Marrow: a headless EHR, launching at $500 a month.

Marrow deserves its own explanation. A headless system is one with no front end: it exposes the data and the rules as an API and leaves the screens to whoever consumes it. Marrow is the chart as an API. There is no login page and no clinical interface to learn, because the intended user of the chart is an agent such as PhiClaw, or a custom interface the practice builds through Skey.

The thesis: most EHR cost and friction lives in the user interface. When an AI employee does the documentation, scheduling, and billing, the interface is overhead. Marrow keeps the part that matters: a correct, auditable, HIPAA-compliant record that any approved system can read and write.

9. Limitations and responsibilities

• Not a medical device. PhiClaw is software for healthcare providers. It does not diagnose or treat, and it is not cleared or marketed as a medical device.
• The clinician makes clinical decisions. Prescriptions, including controlled substances, are reviewed and signed by the prescriber. SOAP notes are drafts until a clinician signs them.
• Clinical decision support is a preview, not a product. The podiatry medication-safety preview runs on fictional patients only. Clinical activation is pending, and validated predictive risk scores are not available.
• E-sign PHI use requires activation. The Docunvex package is provisioned during onboarding. Until the provider requirements, the practice's applicable signed BAA, and workspace activation are complete, it should be used only for approved agreements that contain no patient information. Payment alone does not enable patient-data use.
• The practice keeps its own HIPAA obligations. The practice remains the covered entity, responsible for its own policies, staff training, and the logins it gives the agent.
• Integration scope depends on the system. What the agent can do in a connected EHR depends on that EHR's API, its permissions, and the workflow the practice approves.
• This paper is not legal advice. Practices should confirm their specific requirements with a healthcare attorney or compliance officer.

10. Roadmap

PhiClaw's direction is set by what customers hand over next, so specifics change. These are themes, stated as intent rather than commitment.

• Launching Marrow and making the headless chart the default record for practices that start fresh with PhiClaw.
• Deepening clinical decision support beyond the current fictional-patient preview, contingent on a maintained knowledge source and clinician validation.
• Expanding native EHR connections and adopting new models as they ship on Bedrock and in the open-weight ecosystem, within the same BAA boundary.

None of these should drive a purchasing decision. What is live is described in sections 4 through 7.

11. About PhiClaw

PhiClaw is built and operated from Miami, Florida, by You Squared LLC, the contracting entity on every BAA. It works directly with clinics, med spas, and medical practices across the United States, in English and Spanish.

The company was founded by John Gonzalez, who still takes the demo calls. Its Chief Medical Officer is Dr. Alexander Rios, one of PhiClaw's earliest customers and its first angel investor. The team is at /team/ and the reasoning behind the company is at /manifesto/.

Questions: [email protected].