Short answer: Arun Kalaiselvan says about 70% of Arya's infrastructure is self hosted, vendors sign HIPAA specific agreements, customer data is separated, and AI is used only through cloud providers: Anthropic via Amazon Bedrock and Gemini via Google Vertex AI.
Watch this answer from Episode 24 (starts at 8:59) · Episode 24 notes and transcript
From Episode 24: This AI Fills Healthcare Shifts in Minutes, starting at 8:59.
Jordan Metzner [8:58]: Well, let's get into the good stuff. It's all about, I think, as Anand mentioned, about compliance, right, and patient privacy and HIPAA. Right? And so, you can't just, push this thing to some firebase or some supabase or some amplify project and run away with it like you can on some, other vibe coded projects. So I think, this is probably a good time where we talk to you guys about, obviously, there's a lot of model development. There's a bunch of new models coming out on a weekly basis from a coding perspective. Obviously, like, we're deep on all of them. I mean, obviously, Opus 4.5 has just been insane so far. But, I wanna talk to you guys about how you use AI in a privacy forward focus where you obviously, some of these new hosted models come out, next week. But, how easy is it to be able to adopt those models in a privacy, environment where patient, privacy is like number one?
Arun Kalaiselvan [9:52]: Yeah. It's I think that is the most complicated bit of this whole ecosystem. It's it's not as simple as just, like, hopping on chat.openai and starting talk starting the conversation with ChatGPT. Right? So one of the things that we care about deeply at Arya is security and compliance. So much so that pretty much I wanna say about 70% of our infrastructure is completely hosted by us. And then the bits that's not hosted by us is primarily the communication pieces, which is our phone calls, SMSs, and that kind of stuff, which we have direct sort of agreements with our vendors. So if we work with Bland, if we work with Twilio, we work with Amazon's Pinpoint, we have agreements in place that are completely, specific to HIPAA regulations, and that sort of covers most of our use cases. But then we go beyond that. Every customer gets almost a physically separate location where their data is stored and there's definitely logical separations among everywhere.
Arun Kalaiselvan [10:59]: There is never a case where any data will ever leak from one customer into another customer's ecosystem. At Arya and speaking about AI, we only use AI through our cloud providers. So we work with Amazon and Google. So with Amazon, we work with Bedrock. We talk to Anthropic through Bedrock. And then on Google, we work with the Vertex AI, and we talk to Gemini through Vertex AI. And they make it possible for us to build HIPAA compliant workflows just because that we have those contractual relationships with Amazon and Google, and then they cover all of the all the data at rest as well as in transit, and they cover that under our security policies. The cool thing about Google is Anand actually advises them on how to build their agent development kits. They're on our Slack. We have conversations pretty much almost every day, and they're you know, we are huge fans. They're huge fans. It's good. It's been fun.
Anand Chandrasekaran [12:02]: Yeah. I wouldn't call it advice, but yeah. Some words like, we Share not. Yeah. I can talk a Little bit about that. So so the thing is, if you look at it, right, like AI and security, they are still not going hand on hand. There are so many tools available, but if you see which of them is HIPAA compliant to the extent of to be used by PHA, there's it's very limited. So from the first, our model has been, like, you can only use the models that's available in our cloud provider because only that is giving us the utmost security. That means that, like, we will experiment quite a lot within what's available in that. Personally, what my process right now is I check the models that's available in cloud and other things constantly on a site. Whereas for our well, Arya workflows, we only use those that is available in cloud. And, like, sometimes we push them to make them available. I remember Bedrock, like, initially, they didn't have it. Like, we pushed them to get a particular version.
Anand Chandrasekaran [13:01]: A lot of them did, I guess, so we got that. With Google, we have great support. So if we need something, are more than willing to do that. And we have that relationship with them, and it's really worked out very well for us. One more point I wanna add, we are multi cloud. But even in multi cloud, the way we communicate between our clouds, we have a separate tunnel communication happening. Even in that level, the security is extremely yeah. I mean, it's not paranoia, but at the same time, we wanna make sure that security comes first. So we have a separate peering network going on between GCP and AWS, and only through that we communicate. So that's, like, the most biggest priority for us. So, yeah, that's how we handle that in today's world.
Jordan Metzner [13:42]: Okay. Cool. Yes. I understand. Like multi tenant kinda multi organization, to create kind of individual security layers.
