Patient identity stays protected. Only necessary clinical information moves forward.
Our submission to Australia’s AI standards consultation
The Governance Control Plane
Your data. Your rules.
Every AI under your control.
Protect patient identity. Govern every authorised AI relationship.
Your authority determines which AI receives what information, with evidence you retain.
How it works
One independent governance layerbetween your healthcare data and your approved AI.
The AI provider does not decide what it is allowed to receive. Your organisation does.
- Australian-hosted control plane and governance evidence
- Governs medical imaging releases to approved AI destinations today
- Governed decisions and releases preserved in an immutable audit trail
Why Now
AI is moving into the centre of care.Integration scales faster than accountability.
From December 2026 through 2027, binding AI, health-data, and underwriting mandates converge across Australia, the United States, and Europe - placing legal proof squarely on the data custodian. Transparency is the obligation; governability is the capability.
| Statutory Cliff Date | Jurisdiction & Instruments | Custodian Accountability Shift |
|---|---|---|
| 10 December 2026 | Australia - Privacy Act APPs 1.7–1.9 & ACL [2025] FCA 1224 | Automated-decision transparency commences across private health (clinician review does not exempt AI), backed by Federal Court precedent holding external vendor monitoring alone fails reasonable steps. |
| 1 January 2027 | United States - CMS-0057-F, State ADMT, ONC HTI-1 & HIPAA | Federal FHIR and state clinical ADMT duties join active ONC HTI-1 model rules while 42% cyber AI exclusions and Chapter 11 vendor insolvencies expose cloud-only 6-year HIPAA logs. |
| 26 March 2027 | Europe - EHDS Reg. 2025/327, EU AI Act Art. 26 & EDPB 01/2025 | EHDS governance rules commence ahead of Dec 2027 EU AI Act high-risk deployer logs, backed by EDPB 01/2025 and €12M DPA fines requiring hospital-held re-identification keys. |
10 Dec 2026· APPs 1.7–1.9 · ACL FCA
Privacy Act automated-decision rules commence across private health - clinician review does not exempt AI - after the Federal Court (ACL, A$5.8M) ruled vendor monitoring alone fails “reasonable steps.”
01 Jan 2027· ONC HTI-1 · HIPAA
Federal FHIR and state ADMT duties join active ONC HTI-1 model rules - just as 42% cyber AI exclusions and vendor Chapter 11 insolvencies expose cloud-only 6-year HIPAA logs.
26 Mar 2027· EHDS · EU AI Act
EHDS health-data governance commences ahead of Dec 2027 EU AI Act Art. 26 deployer logs - backed by EDPB 01/2025 and €12M DPA fines requiring hospital-held keys.
Independent by Design
Your AI ecosystem will change.Your governance shouldn’t.
Keep governance authority on your side of every AI vendor, marketplace, and model.
| Custody Pillar | What Changes on the External Ecosystem Side | What Remains Constant on Your Side |
|---|---|---|
| 01 Your Policy | Imaging AI vendors, clinical marketplaces, and foundation models rotate, consolidate, or change commercial terms. | Purpose, scope, and destination rules are defined once at your sovereign coupler and applied consistently across every authorised module. |
| 02 Your Boundary | External AI endpoints snap in, upgrade, or decouple on the ecosystem turret, and unapproved models attempt connection. | Patient identity and re-identification keys remain permanently on your side of the sapphire boundary, never crossing into external clouds. |
| 03 Your Evidence | Third-party AI vendors rebrand, deprecate versions, consolidate, or exit the market. | One continuous, immutable record of governed AI interactions accumulates inside your custody across statutory retention windows. |
Define purpose, scope, and destination rules once. Apply the same standard across every AI vendor, marketplace, and model.
Patient identity and re-identification keys remain inside your environment, so adding, swapping, or severing external AI never exposes custody.
Retain one continuous, immutable record of governed AI interactions - even as external vendors consolidate, upgrade, or exit.
Sovereign Control Plane
Global AI.Local governance authority.
Built for a world where AI knows no borders, but healthcare accountability does. SECUVA keeps governance authority local while opening access to frontier AI globally. Faster adoption. Lower governance overhead. Earlier return on your AI investment.
Sovereign statutory governance authorities
United States · HIPAA inline boundary authority
One governance platformOne control plane.
One control plane.
Across healthcare data modalities.
Live today with PixelIQ™ for Medical Imaging – built to scale across every clinical modality.
PixelIQ™Medical Imaging AI Governance & De-identification
Available nowSlideIQ™Digital Pathology AI Governance & De-identification
GenomeIQ™Genomic AI & Data Governance
CardioIQ™Cardiovascular AI Governance & De-identification
ClinicalIQ™Clinical AI & Data Governance
SignalIQ™Physiological AI Governance & De-identification
One policy architectureOne evidence modelModality-specific protection at the edge
Built for the people who carry the accountability
One platform. Different questions.
Board & Risk Committee
Can management demonstrate how healthcare AI relationships are governed?
Visibility into governed destinations, authority, policy and evidence gives executive governance a defensible view beyond policies and spreadsheets.
Outcome
Assurance that governance exists operationally, not only on paper.
Governance that records intent is GRC.Governance that enforces authority is infrastructure.