Peekr is HIPAA-compliant LLM observability built for healthcare engineering teams — PHI detection, diagnosis guardrails, and a tamper-evident audit log on every call. Two lines of Python. No proxy.
10k spans/month free · no credit card · MIT SDK license
18
PHI identifier types
0
Proxied requests
10k
Free spans/month
2
Lines of Python
What can go wrong
Diagnosis without a license
Scenario: LLM responds: "Based on your symptoms, you likely have Type 2 Diabetes."
Violation: Unauthorized medical advice — PHI exposure and HIPAA §164.508 violation
PHI in the model response
Scenario: LLM echoes: "Patient John Smith, DOB 1982-03-14, prescribed Metformin…"
Violation: PHI leaked in plaintext output — HIPAA §164.502 minimum necessary rule
No audit trail
Scenario: Breach investigation: "Which LLM calls accessed this patient record?"
Violation: Cannot answer → HIPAA §164.312(b) audit-controls requirement unmet
PHI sent to the model provider
Scenario: Prompt includes raw EHR data sent to an LLM API without scrubbing.
Violation: Third-party data processing without a BAA — HIPAA §164.504(e)
What you get
PHI detection & block
Detects 18 HIPAA PHI identifiers — names, DOBs, SSNs, MRNs, diagnoses — in prompts and responses
Blocks the call before PHI leaves your stack; logs violation type, not the PHI itself
PHI detection details →Tamper-evident audit log
Every LLM call is logged with timestamp, model, token count, and guardrail verdict
Append-only, cryptographically signed — your compliance officer can export it for a HIPAA audit
Audit log spec →Diagnosis & prognosis guardrail
Detects statements of medical fact or treatment recommendation made without qualification
Warns or blocks; configurable per endpoint — more restrictive for patient-facing, looser for internal tools
Guardrails reference →In-process enforcement
Guardrails run in your Python process — PHI never leaves your stack to reach a third-party filter
No proxy, no gateway, no BAA required for the enforcement layer itself
HIPAA architecture →Setup
No wrappers. No monkey-patching. No proxy. Peekr hooks into the SDK at the transport layer.
Install
pip install peekrOne package. No proxy agent. No architecture change.
Instrument with HIPAA pack
import peekr
peekr.instrument(
exporter=peekr.HTTPExporter(
endpoint="https://peekr.starkspherelabs.com",
api_key="pk_live_…",
),
compliance=["HIPAA"],
)
# Every openai.chat.completions.create() and
# anthropic.messages.create() call is now traced,
# checked for PHI, and appended to the audit log.The HIPAA pack runs in-process — PHI never leaves your stack to reach a third-party filter.
Violations blocked, audit log ready
# Peekr intercepts before response reaches your user:
[HIPAA] PHI detected — patient name in output — BLOCKED
Trace #7142 87ms 2,340 tok $0.0021
└─ openai.chat 81ms 2,340 tok
guardrail: HIPAA — PHI_NAME — blocked
audit_id: aud_8vXk… (signed, append-only)
# Your compliance officer sees the dashboard.
# You get a tamper-evident trail for the next audit.No sampling. Every call logged. Retention configurable to meet your HIPAA retention policy.
More resources
HIPAA for LLMs
Technical architecture for HIPAA-compliant LLM deployments.
HIPAA AI Agents
Four HIPAA controls every AI agent in healthcare must implement.
HIPAA Compliance LLM guide
45 CFR citations, risk categories, and implementation checklist.
LLM Guardrails
17 compliance packs enforced in-process on every call.
All compliance packs
HIPAA, FDCPA, FINRA, GDPR and 13 more — two lines of Python.
AI Agent Observability
Trace multi-step clinical AI agents: tool calls, RAG, and sub-agents.
10k spans/month free. No credit card. MIT SDK license. PHI guardrails active the moment you add two lines.
Auto-instruments OpenAI · Anthropic · Gemini · Bedrock · LangChain · LlamaIndex