UTHealth Houston builds IA generativa compatible with HIPAA in scale: iDFax's 2 year journey with Amazon Bedrock

UTHealth Houston, one of the largest academic health institutions in the United States, has completed a two-year journey to build a generational AI platform compatible with the Act of Portability and Responsibility for Health Insurance (HIPAA). The solution, named iDFax and based on Amazon Bedrock, automates the processing of hundreds of thousands of faxes received annually — drastically reducing the manual work of the administrative team and releasing time for direct patient care.

How Generating AI Solves the Health Fax Gargal

Prior to implementation, UTHealth faced an operational bottleneck: each medical reference fax, examination report or insurance form needed to be read, sorted and forwarded manually. With a volume exceeding 300,000 documents per year, the process was slow, subject to errors and consumed hours of professionals who could be focused on clinical activities. iDFax uses language models (LLMs) hosted on Amazon Bedrock to automatically extract key information, categorize content and insert it into the electronic health registration system (EHR) — all in accordance with the strict privacy requirements of HIPAA.

HIPAA compatibility with Amazon Bedrock: key to health AI

Bedrock's choice was strategic. AWS’ managed service allows organizations to run generational AI models — such as Anthropic Claude and Amazon Titan — without patient data leaving the controlled environment. UTHealth has configured Bedrock in a Virtual Private Cloud (VPC) with end-to-end encryption, ensuring that no protected health information (PHI) is exposed. In addition, integration with AWS PrivateLink and custom security policies ensured that only authorized endpoints could access the models, eliminating leak risks.

2 year results of AI generativa at UTHealth

The numbers speak for themselves: the processing time of a fax dropped from minutes to seconds, and the rate of correctness in the automatic classification exceeded 95%. The previously overloaded administrative staff now only operates in exceptional cases — which reduced the hours devoted to repetitive tasks by 80%. More importantly, patients' waiting time for authorizations and scheduling decreased significantly, increasing satisfaction rates. As the official AWS blog highlighted, UTHealth has proven that it is possible to innovate in AI without compromising regulatory compliance. Source

UTHealth Lessons for AI in Brazilian Health

The UTHealth case is a replicable model for hospitals and clinics in Brazil, which face similar challenges with system interoperability and document management — as well as close regulations such as LGPD. The combination of managed services (Bedrock) with cloud security practices can be adapted to local environments, reducing costs and accelerating digital transformation. For those who seek to understand how the explanatory AI can improve the accuracy of risk models, it is worth checking the article on End of the black box in health? Microsoft Explainable IA REVOLUCIONEs risk adjustment, which addresses another innovation front in the sector.

Future of Generating AI at UTHealth

With iDFax consolidated, the UTHealth team already plans to expand the use of generativa AI to other areas, such as automatic summary of medical records and support for clinical decision. The success of the project shows that, with the right architecture and technological partners like AWS, it is possible to overcome the barriers of privacy and scale that historically hinder the adoption of AI in health.

Frequently Asked Questions about Generating AI in Health

What is iDFax?

IDFax is a generative AI platform developed by UTHealth Houston that automates the processing of medical faxes, extracting data and integrating them into the electronic health system with full HIPAA compliance.

How did the solution become HIPAA compatible?

UTHealth used Amazon Bedrock running on an isolated VPC, with data encryption in transit and at rest, and restricted access via AWS PrivateLink, ensuring that no protected health information was exposed or violated.

Can I replicate this solution in Brazil?

Yes, the AWS managed service-based architecture is replicable, provided that you adapt security policies to LGPD and use language models available in the region. See the official AWS documentation for compliance details.