Regulation and fairness, where you deploy and how bias is measured

A health network enabled HIPAA mode on its only API organization for a clinical assistant. The next day, the marketing campaigns start failing with 400 errors. Elsewhere, an assistant that pre-screens CVs passes fewer candidates with career gaps, and the team proposes adding “evaluate without bias” to the prompt. In both cases the answer lies outside the prompt.

Each regulation decides something different

You saw in the guardrails lesson that compliance lives in the deployment. This is what the exam expects you to know about each case:

Regulation	What it requires in practice
HIPAA (health data)	a signed business associate agreement (BAA) and a HIPAA-enabled organization. It applies to the whole organization, it’s permanent and the API rejects ineligible features. For general use, another organization
GDPR (personal data in the EU)	legal basis, data minimization, defined retention, data subject rights and control over where data is processed and stored
FedRAMP (US government workloads)	processing inside the authorized boundary: the cloud provider’s government region, confirming which models and features are available there

In the health network’s case, the way out isn’t turning HIPAA off for the campaign (you can’t) or asking the model not to keep data: it’s separating the workloads, PHI in the enabled organization and general use in another one.

For data residency there are concrete controls: the API lets you set the geography where inference runs, per request or as a workspace default, and on cloud platforms the region is set by the endpoint. Minimization is architecture too: what the model doesn’t need isn’t sent to it, and what gets logged is defined as a requirement.

Bias is measured by group

Asking the model to be impartial proves nothing. Fairness is measured:

1. A representative dataset with the groups that matter, even if the model never sees the attribute.
2. Selection rate by group and error rates by group, compared against each other.
3. Look for proxy variables: criteria that aren’t in the job requirements but correlate with a protected group, such as employment continuity, postcode or certain institutions. If they aren’t requirements, they come out.
4. Measure again after every change, as part of the suite.

Deleting gender and age from the CV isn’t enough: the proxies are still there. And recruiters agreeing a lot with the system doesn’t prove fairness; it may be automation bias.

Transparency from the start

• Tell people that AI is used in the process before they interact with it, not after an incident.
• Explain which criteria are evaluated and offer a way to request human review.
• Document known limitations and the results of the bias measurements.

The usual traps

• Turning HIPAA off for a while and back on, or retrying the 400s until they go through.
• A system prompt forbidding data retention as a compliance measure.
• Asking for a BAA to solve a federal hosting requirement.
• Adding “don’t discriminate” to the prompt and checking again next quarter.
• Disclosing AI use only if someone asks.

On the exam

If a regulation appears, look for the answer in contracts, organization, region or authorized boundary. If an organization mixes PHI with general use, separate them. If there’s a disparate outcome between groups, look for the option that measures by group, removes proxy criteria unrelated to the job and discloses AI use from the start.