Most agencies treat HIPAA as a change order
PHI handling decided after the architecture is locked means re-architecture, not compliance. We design data boundaries, encryption, anonymization, and access controls into the first spec — our team has run HIPAA-compliant ML on a 2.5-petabyte clinical dataset.