Runtime disclosure control for healthcare AI.
Three Gates sits in the data path between your workforce and the AI they use. On every request it detects sensitive data, tokenizes it before the model is invoked, withholds what policy disallows, and records the decision in an audit trail built for the questions your auditor, your carrier, and your board will ask.
Built for hospitals, health systems, large practices, and digital health companies. PHI detection, purpose-bound authorization, tokenization before model invocation, BAA-covered routing, and an audit trail designed for HIPAA-derived analysis.
For security and compliance leaders
See the architecture in action
For security and compliance leaders asking: how does this actually enforce policy at runtime?
Watch the control plane enforce policy on a real clinical request, then step through it yourself.
81% of U.S. physicians now use AI in their practice.
AMA Physician Survey on Augmented Intelligence, 2026. More than double the 38% adoption rate reported in 2023.
Shadow AI isn't a future problem. It's happening now. Common physician use cases include clinical documentation, chart summarization, and assistive diagnosis. Workflows that by definition involve patient data. Staff are using ChatGPT, Copilot, and other consumer AI tools because nobody gave them a governed alternative.
And the gap between what staff are doing and what the organization's AI policy actually enforces keeps widening. Three Gates is built to close that gap at runtime, not in a document.
Why identity controls are not enough
Epic controls who can open the chart. Three Gates controls what an AI acting for that user is allowed to receive.
Identity and access management answers whether a person may see a record. It does not answer what an AI working on that person’s behalf should be given to complete a task. A scheduling request does not need the diagnosis. A discharge summary does not need the Social Security number. A coding question does not need the patient’s name.
Access control is a decision about people. Disclosure control is a decision about content, made per request, at the moment the data is about to leave your boundary for a model. Three Gates makes that second decision, and records it, without replacing the identity stack you already have.
Access decides who may see the record. Disclosure decides what leaves with the request.
Before the incident
A BAA establishes the basis for the disclosure. It does not decide what is exposed when the vendor is breached.
Most healthcare AI programs rest on a business associate agreement with the model provider. That agreement matters: it is the contractual basis for sending PHI to the vendor at all. It is also, for most programs, the whole defense, right up until the day the vendor notifies you of an incident.
On that day the questions change. What did the vendor actually hold? Why did the model receive the full record for a task that needed three fields? Can you show, per request, what was disclosed and under which policy? A BAA does not help with those. A disclosure-control layer does, because it limited what left in the first place and recorded what did.
Three Gates does not change your notification obligations, and it does not make tokenized data “secured PHI” under the breach notification rule. What it changes is the risk assessment: a vendor that held typed placeholders with no rehydration key is a different incident from a vendor that held charts.
Permission is what the BAA gives you. Exposure is what you control.
Platform guardrails and Three Gates
Your cloud provider’s guardrails are a good start. Here is where they stop.
Bedrock Guardrails, Azure AI Language PII redaction, and Microsoft Purview each detect sensitive information in AI traffic and can block or mask it. If your organization runs one model on one platform for one purpose, that may be enough. Most healthcare organizations do not.
Tokenize, don't destroy
Platform guardrails
Mask or block. A masked value becomes a generic tag or a redaction mark, and nothing maps it back, so the workflow loses the value.
Three Gates
Detected values are replaced with typed tokens the model can reason over, and rehydrated on the return path, so the clinician gets a usable answer and the model never held the detected value.
Authorize the purpose and the tool, not just the text
Platform guardrails
Evaluate the text of a prompt or a response. None of them evaluates the request against a declared purpose, and none authorizes the tools an agent may call.
Three Gates
One policy evaluated per user, purpose, and destination across every provider you route to, with tool calls authorized against the purpose's scope.
Record the decision, not just the filter
Platform guardrails
Record the filter's assessment for the invocation, and in Purview's case the prompt and response themselves.
Three Gates
A record per supported invocation of what was detected, what was decided, what was transformed, where it went, and which policy decided it, with eligible FHIR workflows projected on demand as AuditEvent and Provenance.
Keep the platform guardrails on. Put the disclosure decision in front of them.
What governed AI actually looks like
A clinician asks an agent to prepare a patient for discharge. The control plane detects sensitive identifiers, tokenizes them before any AI sees the raw values, gates tools that fall outside the configured scope, and routes the approved actions through human review where required. Every step is in the audit trail. Here's a 90-second walkthrough.
Demo Theater
Clinical discharge request
What enforcement actually means
Three Gates is one runtime that enforces policy across every AI surface your organization uses. Each capability below is a category of policy that runs on every request, not a feature your team has to remember to apply.
What you can see
PHI Detection
A multi-layer cascade scans text and images for detected PHI, PII, and clinical identifiers in real time.
What's allowed
Authorization
Org-aware access controls and purpose-of-use binding determine which users, intents, and tools are allowed on each request.
Where it runs
Secure AI Chat
A governed chat surface applies detection, tokenization, policy checks, and BAA-covered routing before AI invocation.
What's recorded
Audit Logging
A structured audit trail records policy decisions, routing, review steps, and risk events for incident reconstruction.
How it stays current
Compliance Automation
Scheduled reports, policy versioning, risk event detection, and executive summaries help teams keep controls reviewable.