How a care-coordination startup rolled out AI workflows inside HIPAA constraints

The security lead was not being difficult; he was being asked to do the impossible. Eight separate AI tool requests sat in the review queue, each needing its own BAA, its own data-flow review, and its own prompt-injection assessment. So everything stayed frozen, and the freeze created exactly the risk it was meant to prevent: an internal check found eleven personal AI accounts being used for work, some with pasted chart-note fragments.

The VP of Product needed the productivity and the security lead needed the perimeter. Neither was getting either.

The pitch to security was structural: review one platform once, then let every workflow inherit that review. Second Axis ran its session isolation, encryption, access boundaries, and no-training posture through the full assessment in six weeks, BAA included. Sentinel's screening then became the per-workflow gate: a new workflow now clears in about three days instead of joining an eight-week queue.

Shadow usage ended without a crackdown. Once the sanctioned workspace was faster than a personal account, the eleven shadow accounts went quiet on their own; the follow-up check two months later found zero.