HIPAA cost control architecture for enterprise LLM deployment — Reference Architecture

Reference architecture · published 2026-10-16 · regulated enterprise · HIPAA · layout spec_first · implementation executed in CI before publish

Technical parameters

Every value below is a parameter you can hold a vendor or an internal team to. Adjectives are not acceptance criteria.

The control that resolves this is a Pre-Flight Budget Governor, evaluated before the request reaches a model provider rather than audited afterwards. In regulated enterprise the binding constraint is HIPAA, and the question it actually asks is can PHI reach a place the BAA does not cover. The shape below holds p95 ≤ 900ms over REST over HTTPS, and ships with a standard-library implementation that runs as written.

The architecture friction point

LLM spend is discovered in a monthly invoice and defended with a dashboard, so it is reported rather than controlled. Finance asks for a per-team cap and engineering cannot implement one, because nothing in the request path knows a budget exists.

What HIPAA specifically requires

HIPAA holds the covered entity responsible for PHI wherever it flows. A model provider without a signed BAA is not a permissible destination, and 'the prompt only contained a little PHI' is not a defence — the minimum necessary standard is itself a control.

The artifact that satisfies it is a de-identification record per request plus the BAA chain. The way teams most often fail it: PHI reaching a subprocessor with no BAA, via a logging sidecar nobody mapped.

The implementation — Two-phase token budget with per-tenant chargeback

Standard-library Python, no external dependencies, runs as written. Executed by the publish gate: if it raises, this page does not ship. Wire it behind REST over HTTPS; the failure mode it guards against is a retried POST creating a duplicate record. The output you hand the assessor is the minimum-necessary de-identification log.

"""Pre-flight token budget enforcement with per-tenant chargeback.

Why this shape: LLM spend is discovered monthly in an invoice and defended with
a dashboard, which means it is never actually controlled. The control has to run
BEFORE the call, on an estimate, with a hard ceiling per tenant and per period —
otherwise the first thing finance asks for is a cap you cannot implement.
"""
import math
import time
from dataclasses import dataclass, field


# USD per 1k tokens. Keep rates in config, not code: they change, and a stale
# rate silently misprices every chargeback downstream of it.
RATES = {
    "frontier":  {"in": 0.0030, "out": 0.0150},
    "mid":       {"in": 0.0008, "out": 0.0040},
    "small":     {"in": 0.0001, "out": 0.0004},
}


def estimate_tokens(text: str, chars_per_token: float = 3.8) -> int:
    """Deliberately a conservative OVER-estimate.

    Under-estimating defeats the purpose: the request gets admitted, the real
    usage exceeds the budget, and the ceiling is decorative."""
    return max(1, math.ceil(len(text or "") / chars_per_token))


def price(tier: str, tokens_in: int, tokens_out: int) -> float:
    r = RATES[tier]
    return (tokens_in / 1000.0) * r["in"] + (tokens_out / 1000.0) * r["out"]


class BudgetExceeded(Exception):
    def __init__(self, tenant, projected, ceiling):
        self.tenant, self.projected, self.ceiling = tenant, projected, ceiling
        super().__init__(f"{tenant}: ${projected:.4f} would exceed "
                         f"${ceiling:.2f} for the period")


@dataclass
class Budget:
    ceiling_usd: float
    period_seconds: float = 86400.0
    spent_usd: float = 0.0
    started: float = field(default_factory=time.time)
    committed: dict = field(default_factory=dict)   # request_id -> reserved USD

    def _roll(self, now):
        if now - self.started >= self.period_seconds:
            self.started, self.spent_usd = now, 0.0
            self.committed.clear()

    def reserve(self, request_id: str, projected_usd: float, now=None) -> float:
        """Two-phase: reserve the estimate, settle the actual.

        Without a reservation, N concurrent requests each see the same low
        `spent` and all get admitted — the classic race that blows a cap."""
        now = time.time() if now is None else now
        self._roll(now)
        outstanding = sum(self.committed.values())
        if self.spent_usd + outstanding + projected_usd > self.ceiling_usd:
            raise BudgetExceeded("tenant",
                                 self.spent_usd + outstanding + projected_usd,
                                 self.ceiling_usd)
        self.committed[request_id] = projected_usd
        return projected_usd

    def settle(self, request_id: str, actual_usd: float):
        self.committed.pop(request_id, None)
        self.spent_usd += actual_usd

    def release(self, request_id: str):
        self.committed.pop(request_id, None)


class Governor:
    def __init__(self):
        self.budgets: dict = {}
        self.ledger: list = []

    def set_budget(self, tenant: str, ceiling_usd: float, period_seconds=86400.0):
        self.budgets[tenant] = Budget(ceiling_usd, period_seconds)

    def admit(self, tenant: str, request_id: str, prompt: str,
              tier: str = "mid", max_output_tokens: int = 1024) -> dict:
        b = self.budgets.get(tenant)
        if b is None:
            raise KeyError(f"{tenant} has no budget: fail closed, never open")
        t_in = estimate_tokens(prompt)
        projected = price(tier, t_in, max_output_tokens)
        b.reserve(request_id, projected)
        return {"tenant": tenant, "request_id": request_id, "tier": tier,
                "tokens_in_est": t_in, "projected_usd": round(projected, 6)}

    def record(self, tenant: str, request_id: str, tier: str,
               tokens_in: int, tokens_out: int) -> dict:
        actual = price(tier, tokens_in, tokens_out)
        self.budgets[tenant].settle(request_id, actual)
        row = {"tenant": tenant, "request_id": request_id, "tier": tier,
               "tokens_in": tokens_in, "tokens_out": tokens_out,
               "actual_usd": round(actual, 6), "ts": time.time()}
        self.ledger.append(row)     # this is the chargeback record
        return row


if __name__ == "__main__":
    g = Governor()
    g.set_budget("bank-eu", ceiling_usd=0.05)
    adm = g.admit("bank-eu", "req-1", "Reconcile these 400 journal lines." * 20)
    print("admitted:", adm)
    print("settled :", g.record("bank-eu", "req-1", "mid", adm["tokens_in_est"], 310))
    try:
        for i in range(40):
            g.admit("bank-eu", f"burst-{i}", "x" * 4000, tier="frontier")
    except BudgetExceeded as e:
        print("ceiling held:", e)

The HIPAA control, as code

Minimum-necessary de-identification with a BAA-pinned egress gate. This is the artifact an assessor asks for under HIPAA specifically — it is not the same control as the one above, and a system that implements one does not thereby implement the other. It executes under the same publish gate.

"""Minimum-necessary de-identification with a BAA-pinned destination gate.

HIPAA holds the covered entity responsible for PHI wherever it flows, so the
control is not "we told people not to paste PHI". Two things must be
structural: PHI is reduced to the minimum necessary BEFORE egress, and the
destination set is pinned to those under a signed BAA, failing closed on
anything else.

Safe Harbor (45 CFR 164.514(b)(2)) lists 18 identifier classes. This implements
the mechanical subset and records a per-request de-identification receipt,
because the auditor asks for proof per request, not a policy document.
"""
import re

SAFE_HARBOR_PATTERNS = {
    "name_mrn": re.compile(r"\bMRN[:\s#]*([A-Z0-9-]{4,})", re.I),
    "ssn": re.compile(r"\b\d{3}-\d{2}-\d{4}\b"),
    "phone": re.compile(r"\b(?:\+1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b"),
    "email": re.compile(r"\b[\w.+-]+@[\w-]+\.[\w.]+\b"),
    "date_full": re.compile(r"\b\d{1,2}/\d{1,2}/(19|20)\d{2}\b"),
    "member_id": re.compile(r"\b(?:member|policy)\s*(?:id|#)[:\s]*([A-Z0-9-]{5,})", re.I),
}


class BAARegistry:
    """Destinations are permissible only as attested data, never by convention."""

    def __init__(self):
        self._signed: dict[str, str] = {}

    def attest(self, destination: str, agreement_ref: str) -> None:
        self._signed[destination] = agreement_ref

    def covered(self, destination: str) -> bool:
        return destination in self._signed

    def reference(self, destination: str) -> str | None:
        return self._signed.get(destination)


class PHIEgressGate:
    def __init__(self, registry: BAARegistry):
        self.registry = registry
        self.receipts: list[dict] = []

    def deidentify(self, text: str) -> tuple[str, dict[str, int]]:
        counts: dict[str, int] = {}
        out = text
        for label, pattern in SAFE_HARBOR_PATTERNS.items():
            out, n = pattern.subn(f"[REDACTED:{label}]", out)
            if n:
                counts[label] = n
        return out, counts

    def send(self, text: str, destination: str) -> dict:
        """Refuses rather than redacting-and-hoping when the BAA is absent."""
        redacted, counts = self.deidentify(text)
        phi_present = bool(counts)
        if phi_present and not self.registry.covered(destination):
            receipt = {"destination": destination, "admitted": False,
                       "reason": "no BAA on file for a PHI-classified payload",
                       "identifier_classes": sorted(counts)}
            self.receipts.append(receipt)
            raise PermissionError(receipt["reason"])
        receipt = {
            "destination": destination,
            "admitted": True,
            "baa_ref": self.registry.reference(destination),
            "identifier_classes": sorted(counts),
            "redactions": sum(counts.values()),
            "payload": redacted,
        }
        self.receipts.append(receipt)
        return receipt


if __name__ == "__main__":
    reg = BAARegistry()
    reg.attest("azure-openai-us-east", "BAA-2026-0041")
    gate = PHIEgressGate(reg)

    note = ("Patient MRN: 88213A, contact 555-867-5309 or a.patient@example.com, "
            "DOB 04/11/1974, follow-up scheduled.")
    ok = gate.send(note, "azure-openai-us-east")
    assert ok["admitted"] and ok["redactions"] >= 4, ok
    assert "88213A" not in ok["payload"] and "555-867-5309" not in ok["payload"], ok
    assert "a.patient@example.com" not in ok["payload"], ok

    try:
        gate.send(note, "some-vendor-eval-endpoint")
        raise AssertionError("PHI reached a destination with no BAA")
    except PermissionError:
        pass

    # No PHI means no BAA requirement — the gate must not over-block.
    benign = gate.send("Summarise ward occupancy trends.", "some-vendor-eval-endpoint")
    assert benign["admitted"] and benign["redactions"] == 0, benign

    print("HIPAA minimum-necessary egress gate: OK")
    print(f"  receipts {len(gate.receipts)}, "
          f"refusals {sum(1 for r in gate.receipts if not r['admitted'])}")

System architecture

Pre-Flight Budget Governor — the request path, with the decision points that must exist before the first model call:

flowchart LR
    REQ[Request] --> EST[Conservative token estimate]
    EST --> PR[Price at tier rate]
    PR --> RES{Reserve against budget<br/>spent + outstanding + projected}
    RES -->|over ceiling| REJ[429 BudgetExceeded]
    RES -->|no budget| FC[Refuse - fail closed]
    RES -->|ok| TR[Tier router<br/>cheapest tier meeting quality bar]
    TR --> M[Model call]
    M --> ST[Settle actual usage]
    ST --> LED[(Chargeback ledger)]
    LED --> FIN[Finance reconciliation]

The parts you have to build

1. Conservative estimator — Deliberately over-estimates; under-estimating makes the ceiling decorative.
2. Two-phase budget — Reserve the estimate, settle the actual — closes the concurrency race.
3. Rate table in config — Prices change; a stale rate in code silently misprices every chargeback.
4. Tier router — Routes to the cheapest tier that meets the quality bar for the task.
5. Chargeback ledger — Per-tenant, per-request actuals — the artifact finance reconciles against.
6. Fail-closed default — A tenant with no budget is refused, never admitted.

Risk mitigation matrix

Each row carries an acceptance parameter rather than an adjective, because "low latency" cannot be signed off. Retention here is bound by per the data class retention schedule, enforced automatically.

Control questions before sign-off

• Which destinations hold a BAA, and what structurally prevents PHI from reaching one that does not?
  Destinations carry a BAA flag as attested data, and the routing gate refuses a PHI-classified payload to any destination without it. The refusal is logged with its reason.
• What refuses a request that would exceed this team's monthly cap, and where in the path does it run?
  The budget governor, at admission — before the model call. It prices a conservative token estimate against the tenant's remaining ceiling and refuses the request if the projection would exceed it.
• If 50 requests arrive at once against a nearly-exhausted budget, how many are admitted?
  Only those that fit. Admission counts outstanding reservations as well as settled spend, which closes the race where concurrent requests all read the same low figure and are all admitted.
• How does your chargeback figure reconcile to the provider invoice, and what is the variance?
  The chargeback ledger records per-request actuals priced from a versioned rate table with an effective date; reconcile it monthly and track the variance against the provider invoice.
• What happens to a tenant with no budget configured?
  It is refused. A missing budget fails closed — admitting an unbudgeted tenant is how the cap becomes decorative.
• Which rate table priced last month's chargeback, and when was it last updated?
  The rate table in versioned config, with its effective date recorded. A rate older than 90 days raises an alert, because a stale rate silently misprices every chargeback downstream.

See also

• Part of enterprise llm cost control.
• Where this interacts with another regime, see HIPAA provider failover and degradation architecture for enterprise LLM.
• A different failure mode of the same component: HIPAA tracing and token accounting architecture for enterprise LLM.
• The same control appears in HIPAA legacy integration patterns for enterprise AI agents.
• This pattern also governs HIPAA model release gate and golden set evaluation for enterprise AI.
• If this is the blocker in front of you: enterprise AI infrastructure review.