Lab.Hipaa.Technology

Doctors want to use AI. They are not sure how it works within HIPAA. This is a WebMCP enabled site to help them get started with the help of their AI agent and staying HIPAA compliant.

Comment

Inspiration

My main inspiration came from knowing doctors who have no idea how to use AI. I just met with a dentist from NYC who makes $400,000 a year and never heard of Codex.

Then when I learned about WebMCP I realized this was the perfect technology to help doctors figure out how to deploy AI in their practices and be assured they're not letting the AI run loose and they stay HIPAA compliant.

HIPAA.technology gives a doctor and an AI agent one shared workspace, where the doctor sees everything the agent does and keeps control of everything that matters.

What it does

A physician or medical-practice leader can:

  • Learn three essential boundaries: minimum necessary data, the vendor path, and human clinical judgment.
  • Compare four realistic healthcare AI workflows.
  • Assess whether a workflow is ready for a bounded synthetic rehearsal.
  • Prepare a 21-day AI adoption mission.
  • Review and personally approve - or refuse - the mission's policy gates.
  • Enter a public practice domain for a website debrief that never touches portals, private pages, or PHI.

The AI agent can inspect the workspace, focus lessons, select workflows, assess readiness, stage and revise a mission, deliver a public-site debrief, and update the contextual guide.

How I used WebMCP

The live webpage registers ten structured JavaScript tools using document.modelContext.registerTool():

  1. inspect_adoption_workspace
  2. focus_learning_lesson
  3. select_clinical_ai_use_case
  4. assess_use_case_readiness
  5. stage_21_day_adoption_mission
  6. revise_adoption_mission
  7. prepare_practice_website_review
  8. deliver_practice_website_debrief
  9. set_contextual_guidance
  10. focus_mission_week

Without WebMCP, an agent has to guess what your app means from pixels and click targets. With WebMCP, it gets real tools with real schemas - bounded inputs, safety annotations, structured results. No guessing.

And when the agent focuses a lesson, assesses a workflow, or stages a mission, the doctor sees the interface change immediately. Same workspace, same screen, both of them.

Human authority is engineered - expert in the loop.

The most important capability is one I intentionally did not build.

The AI cannot:

  • Accept organizational policy.
  • Approve the adoption mission.
  • Launch a live-patient-data workflow.
  • Make clinical or compliance decisions.
  • Enter or request PHI.

The agent can inspect, explain, focus, assess, stage, and revise. The doctor keeps every decision that matters.

Practice Website Debrief

A doctor can enter their public practice domain and the agent looks at the public pages and comes back with:

  • What the practice already does well.
  • What could be clearer or more useful.
  • One safe AI opportunity to explore next.

This is educational, not a compliance audit. No patient portals, no credentials, no private pages, no PHI.

How I built it

HIPAA.technology is a React and TypeScript application I created with ChatGPT and Codex, built with Vinext and Vite, and hosted with ChatGPT Sites on the custom domain lab.hipaa.technology.

Each WebMCP tool has:

  • A narrow, descriptive name.
  • An explicit JSON input schema.
  • Additional properties disabled.
  • Bounded and validated inputs.
  • Clear descriptions of its effects and limitations.
  • WebMCP safety annotations.
  • Structured results.
  • A visible shared-interface update when applicable.

The healthcare model came from a ChatGPT Deep Research paper, Middleware Encryption for HIPAA-Compliant Use of Frontier LLMs in U.S. Healthcare. Its central lesson is baked into the whole experience: encryption is one layer, but you have to govern the entire information path - minimum necessary data, the exact vendor and feature path, logs, agent capabilities, and a human making the calls.

Challenges

The HARDEST Problem by far was figuring out that my version of Codex wasn't Web Tool enabled. This took hours and hours to figure out. Codex was no help figuring it out. I finally upgraded tonight after midnight and lo and behold, the tools were there.

The other challenge was explaining a brand-new browser technology to doctors who aren't technical. So the site includes a dedicated WebMCP judge guide with plain-language setup instructions, the complete tool directory, implementation evidence, and both ChatGPT and Chrome testing paths.

Accomplishments

  • Ten state-aware WebMCP tools.
  • A complete clinician-facing product, not a registration proof of concept.
  • Real browser discovery and execution through document.modelContext.
  • A human authority gate that agents cannot bypass.
  • A synthetic-first 21-day adoption mission.
  • A privacy-bounded public-practice website debrief.
  • A contextual AI guide that follows the doctor through the experience.
  • A research-informed workflow visualization.
  • Deployment through ChatGPT Sites on a custom HIPAA.technology domain.
  • A public MIT-licensed repository.

What I learned

WebMCP is awesome! I can do sites like this all day with Codex. I can't believe this is even real. :)

Also: the best tool surface is the smallest one. Ten tools that each do one clear thing, so the doctor and the agent both always know exactly what's happening.

What's next

Over the next 21 days, I plan to:

  • Test guided sessions with physicians and practice administrators.
  • Add organization-owned workflow templates and evidence capture.
  • Expand the public-site debrief into a structured readiness intake.
  • Add versioned governance playbooks for approved tools and feature paths.
  • Measure whether each team leaves with one bounded workflow, one accountable owner, and one verifiable next action.
  • Sell this site for $50,000+

Built With

Share this project:

Updates

Submission history