Privacy & Security Audit

The HIPAA local LLM checklist: (1) Never log raw prompts — scrub PHI first. (2) Encrypt model files at rest (AES-256) and verify SHA-256 checksums against model cards. (3) Prompt injection defense is mandatory — even local models follow injected instructions. (4) BAA (Business Associate Agreement) applies to cloud hosting of the LLM server even if the model is open-weight. (5) Audit logs of who queried what (without PHI content) are required.