Data platforms
On-Premises & Hybrid Clinical AI
Running inference on hospital hardware answers latency, bandwidth, availability and data residency. It does not stop the data moving: updates still have to arrive, and performance evidence, audit records and the cases needed to monitor the model still have to leave. This paper is the map of that boundary. It sets out the five places the inference can run and where the regulated device boundary falls in each, inventories all eleven paths across the boundary with the authority and the standard behind every one, and works through the de-identification profile, the change control mechanism and the contract clauses that decide how a hybrid deployment actually behaves. Written from the standards and the regulators’ own documents, with every profile status and guidance date current as at October 2026 and every Trial Implementation and draft identified as one.
What’s inside
- Five deployment topologies, from a model inside the modality to cloud behind a site gateway, with where the device boundary falls and how each one fails
- The boundary inventory: eleven inbound and outbound paths, each with its identifiability, frequency, legal basis and the standard that carries it
- Why the results path is standardised and the update path is not, and what follows from there being no healthcare standard for distributing a model
- The line inside 45 CFR 164.501: why monitoring this site’s model is health care operations and improving the vendor’s model for every site may not be
- IHE AIR at Revision 1.3, the transactions it actually introduces, and why the commonly cited numbers are wrong
- IHE AIRA, the profile for the disagreement-case path, and the sentence where it stops short of defining the assessment
- DICOM PS3.15 Annex E: the six action codes, the sequence behaviour inside their definitions, and the two options an AI pipeline has to decide about
- Federated learning and gradient inversion, at the strength the literature supports, with the threat-model distinction that decides exposure
- FDA §524B and §515C, the August 2025 change control reissue, the February 2026 cybersecurity guidance, and the lifecycle guidance that is still draft
- Health Canada’s per-site change provision, which is the clearest official statement that a model may behave differently at one hospital by design
- The PHIPA roles, why agent and electronic service provider are mutually exclusive, and why using a non-agent provider is not a disclosure
- Shadow mode as a four-step protocol, site-caused drift, outbound-only connections and what happens when the buffer fills
- Five contract clauses that decide the deployment, including the one where the generalizable-knowledge boundary gets crossed silently
- Twenty checks, ten for a manufacturer shipping a model and ten for a hospital accepting one, each naming what settles it
- A glossary of the acronyms this field runs on, and a full source list separating standards from regulators from literature
Request this resource
Related insights
- Article · Data platforms
On-Premises & Hybrid Clinical AI Framework
Running the model on hospital hardware answers latency, bandwidth and residency. It does not stop the data moving. The inference stays; the evidence, the updates and the accountability travel.
· 16 min read - Article · Applied AI
Imaging AI: six handoffs between the scanner and the chart
An imaging AI deployment is not one integration. It is six, each governed by a different standard, and the two nobody scopes are the last two: what the radiologist did with it, and who pays.
· 9 min read
