HIPAA provider failover and degradation architecture for enterprise LLM deployment — Reference Architecture

Reference architecture · published 2026-10-16 · regulated enterprise · HIPAA · layout diagram_first · implementation executed in CI before publish

The control that resolves this is a Labelled Degradation Ladder, evaluated before the request reaches a model provider rather than audited afterwards. In regulated enterprise the binding constraint is HIPAA, and the question it actually asks is can PHI reach a place the BAA does not cover. The shape below holds p95 ≤ 600ms over REST over HTTPS, and ships with a standard-library implementation that runs as written.

The blueprint

Labelled Degradation Ladder — the request path, with the decision points that must exist before the first model call:

flowchart LR
    REQ[Request + min_quality] --> T1{Tier 1 breaker closed?}
    T1 -->|open| T2{Tier 2}
    T1 -->|closed| CALL1[Call tier 1]
    CALL1 -->|fails| BRK[Record failure<br/>maybe open breaker] --> T2
    T2 -->|below min_quality| REFUSE[Refuse: no acceptable tier]
    T2 -->|ok| CALL2[Call tier 2] --> LAB[Label response<br/>degraded=true]

The parts you have to build

1. Quality-ranked tiers — Explicit integer quality per provider, not an implicit order.
2. Circuit breaker — A failing tier leaves rotation instead of being retried into the ground.
3. Half-open probe — One probe after cooldown; recovery is tested, not assumed.
4. Tier label on response — Every answer names its tier and whether it was degraded.
5. Quality floor per caller — A caller declares a minimum; below it is a refusal.
6. Degradation events — Each failover recorded — the signal the incident needs.

Implementation parameter matrix

Every value below is a parameter you can hold a vendor or an internal team to. Adjectives are not acceptance criteria.

Why this blocks production

When the primary provider degrades, traffic fails over to a weaker model and the answers keep flowing. Nobody downstream is told the quality changed, so the incident is discovered in complaints.

What HIPAA specifically requires

HIPAA holds the covered entity responsible for PHI wherever it flows. A model provider without a signed BAA is not a permissible destination, and 'the prompt only contained a little PHI' is not a defence — the minimum necessary standard is itself a control.

The artifact that satisfies it is a de-identification record per request plus the BAA chain. The way teams most often fail it: PHI reaching a subprocessor with no BAA, via a logging sidecar nobody mapped.

The implementation — Degradation ladder with circuit breaker and quality floor

Standard-library Python, no external dependencies, runs as written. Executed by the publish gate: if it raises, this page does not ship. Wire it behind REST over HTTPS; the failure mode it guards against is a retried POST creating a duplicate record. The output you hand the assessor is the minimum-necessary de-identification log.

"""Degradation ladder with a circuit breaker and labelled quality tiers.

The failure: a provider degrades, traffic silently fails over to a weaker
model, and nobody downstream knows the answer came from a lower tier. The
control is that degradation is explicit and labelled on the response, so a
consumer can refuse a tier it cannot accept, and that a failing provider is
taken out of rotation rather than retried into the ground.
"""
import time


class ProviderDown(Exception):
    pass


class CircuitBreaker:
    def __init__(self, threshold: int = 3, cooldown_s: float = 30.0):
        self.threshold, self.cooldown_s = threshold, cooldown_s
        self.failures, self.opened_at = 0, None

    def record_failure(self, now: float) -> None:
        self.failures += 1
        if self.failures >= self.threshold and self.opened_at is None:
            self.opened_at = now

    def record_success(self) -> None:
        self.failures, self.opened_at = 0, None

    def closed(self, now: float) -> bool:
        if self.opened_at is None:
            return True
        if now - self.opened_at >= self.cooldown_s:
            self.opened_at, self.failures = None, 0   # half-open: allow a probe
            return True
        return False


class Tier:
    def __init__(self, name: str, quality: int, call):
        self.name, self.quality, self.call = name, quality, call
        self.breaker = CircuitBreaker()


class DegradationLadder:
    """Tiers in descending quality. The response always names the tier that
    produced it; a caller declaring min_quality gets a refusal rather than a
    quietly worse answer."""

    def __init__(self, tiers: list):
        self.tiers = sorted(tiers, key=lambda t: -t.quality)
        self.events: list[dict] = []

    def complete(self, prompt: str, min_quality: int = 0, now=None) -> dict:
        now = now if now is not None else time.monotonic()
        attempted = []
        for tier in self.tiers:
            if tier.quality < min_quality:
                continue
            if not tier.breaker.closed(now):
                attempted.append({"tier": tier.name, "skipped": "circuit open"})
                continue
            try:
                text = tier.call(prompt)
            except ProviderDown:
                tier.breaker.record_failure(now)
                attempted.append({"tier": tier.name, "failed": True})
                continue
            tier.breaker.record_success()
            degraded = tier is not self.tiers[0]
            self.events.append({"tier": tier.name, "degraded": degraded})
            return {"text": text, "tier": tier.name, "quality": tier.quality,
                    "degraded": degraded, "attempts": attempted}
        raise ProviderDown(
            f"no tier at or above quality {min_quality} available: {attempted}")


if __name__ == "__main__":
    def primary(p): raise ProviderDown("502 from primary")
    def secondary(p): return f"secondary:{p}"
    def local(p): return f"local-small:{p}"

    ladder = DegradationLadder([
        Tier("frontier", 100, primary),
        Tier("secondary", 70, secondary),
        Tier("local-small", 30, local)])

    r = ladder.complete("summarise", now=0.0)
    assert r["tier"] == "secondary" and r["degraded"] is True, r
    assert r["attempts"][0]["failed"], r

    # A caller that cannot accept degradation gets an error, not a worse answer.
    strict = DegradationLadder([Tier("frontier", 100, primary),
                                Tier("local-small", 30, local)])
    try:
        strict.complete("x", min_quality=90, now=0.0)
        raise AssertionError("served below the declared quality floor")
    except ProviderDown:
        pass

    # The breaker opens after repeated failures and stops the retry storm.
    t = Tier("flaky", 50, primary)
    for i in range(3):
        try:
            t.call("x")
        except ProviderDown:
            t.breaker.record_failure(now=float(i))
    assert not t.breaker.closed(now=3.0), "breaker should be open"
    assert t.breaker.closed(now=40.0), "breaker should half-open after cooldown"

    print("Degradation ladder + circuit breaker: OK")
    print(f"  served tier={r['tier']} degraded={r['degraded']}, "
          f"events {len(ladder.events)}")

The HIPAA control, as code

Minimum-necessary de-identification with a BAA-pinned egress gate. This is the artifact an assessor asks for under HIPAA specifically — it is not the same control as the one above, and a system that implements one does not thereby implement the other. It executes under the same publish gate.

"""Minimum-necessary de-identification with a BAA-pinned destination gate.

HIPAA holds the covered entity responsible for PHI wherever it flows, so the
control is not "we told people not to paste PHI". Two things must be
structural: PHI is reduced to the minimum necessary BEFORE egress, and the
destination set is pinned to those under a signed BAA, failing closed on
anything else.

Safe Harbor (45 CFR 164.514(b)(2)) lists 18 identifier classes. This implements
the mechanical subset and records a per-request de-identification receipt,
because the auditor asks for proof per request, not a policy document.
"""
import re

SAFE_HARBOR_PATTERNS = {
    "name_mrn": re.compile(r"\bMRN[:\s#]*([A-Z0-9-]{4,})", re.I),
    "ssn": re.compile(r"\b\d{3}-\d{2}-\d{4}\b"),
    "phone": re.compile(r"\b(?:\+1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b"),
    "email": re.compile(r"\b[\w.+-]+@[\w-]+\.[\w.]+\b"),
    "date_full": re.compile(r"\b\d{1,2}/\d{1,2}/(19|20)\d{2}\b"),
    "member_id": re.compile(r"\b(?:member|policy)\s*(?:id|#)[:\s]*([A-Z0-9-]{5,})", re.I),
}


class BAARegistry:
    """Destinations are permissible only as attested data, never by convention."""

    def __init__(self):
        self._signed: dict[str, str] = {}

    def attest(self, destination: str, agreement_ref: str) -> None:
        self._signed[destination] = agreement_ref

    def covered(self, destination: str) -> bool:
        return destination in self._signed

    def reference(self, destination: str) -> str | None:
        return self._signed.get(destination)


class PHIEgressGate:
    def __init__(self, registry: BAARegistry):
        self.registry = registry
        self.receipts: list[dict] = []

    def deidentify(self, text: str) -> tuple[str, dict[str, int]]:
        counts: dict[str, int] = {}
        out = text
        for label, pattern in SAFE_HARBOR_PATTERNS.items():
            out, n = pattern.subn(f"[REDACTED:{label}]", out)
            if n:
                counts[label] = n
        return out, counts

    def send(self, text: str, destination: str) -> dict:
        """Refuses rather than redacting-and-hoping when the BAA is absent."""
        redacted, counts = self.deidentify(text)
        phi_present = bool(counts)
        if phi_present and not self.registry.covered(destination):
            receipt = {"destination": destination, "admitted": False,
                       "reason": "no BAA on file for a PHI-classified payload",
                       "identifier_classes": sorted(counts)}
            self.receipts.append(receipt)
            raise PermissionError(receipt["reason"])
        receipt = {
            "destination": destination,
            "admitted": True,
            "baa_ref": self.registry.reference(destination),
            "identifier_classes": sorted(counts),
            "redactions": sum(counts.values()),
            "payload": redacted,
        }
        self.receipts.append(receipt)
        return receipt


if __name__ == "__main__":
    reg = BAARegistry()
    reg.attest("azure-openai-us-east", "BAA-2026-0041")
    gate = PHIEgressGate(reg)

    note = ("Patient MRN: 88213A, contact 555-867-5309 or a.patient@example.com, "
            "DOB 04/11/1974, follow-up scheduled.")
    ok = gate.send(note, "azure-openai-us-east")
    assert ok["admitted"] and ok["redactions"] >= 4, ok
    assert "88213A" not in ok["payload"] and "555-867-5309" not in ok["payload"], ok
    assert "a.patient@example.com" not in ok["payload"], ok

    try:
        gate.send(note, "some-vendor-eval-endpoint")
        raise AssertionError("PHI reached a destination with no BAA")
    except PermissionError:
        pass

    # No PHI means no BAA requirement — the gate must not over-block.
    benign = gate.send("Summarise ward occupancy trends.", "some-vendor-eval-endpoint")
    assert benign["admitted"] and benign["redactions"] == 0, benign

    print("HIPAA minimum-necessary egress gate: OK")
    print(f"  receipts {len(gate.receipts)}, "
          f"refusals {sum(1 for r in gate.receipts if not r['admitted'])}")

Controls and acceptance parameters

Each row carries an acceptance parameter rather than an adjective, because "low latency" cannot be signed off. Retention here is bound by per the data class retention schedule, enforced automatically.

Questions to answer before approval

• Which destinations hold a BAA, and what structurally prevents PHI from reaching one that does not?
  Destinations carry a BAA flag as attested data, and the routing gate refuses a PHI-classified payload to any destination without it. The refusal is logged with its reason.
• When the primary provider fails, how does a downstream consumer learn the answer came from a weaker model?
  The response names the tier that produced it and carries a degraded flag. A consumer reading the label can treat a degraded answer differently; silent failover is what this design exists to prevent.
• What stops a failing provider from being retried thousands of times a minute?
  The circuit breaker. After the failure threshold it opens and the tier is skipped entirely until the cooldown elapses, so a failing provider leaves rotation rather than absorbing retries.
• Can a caller that requires top-tier quality be served a degraded answer?
  No. The caller declares a minimum quality and tiers below it are never attempted — the ladder raises instead of serving, which is the correct outcome when no acceptable tier exists.
• How do you know a recovered provider is actually healthy before restoring full traffic?
  The breaker goes half-open after cooldown and admits a single probe. Full rotation is restored only after that probe succeeds, so recovery is tested rather than assumed.
• What prevents failover from moving data outside the contracted region?
  Each tier carries a residency attribute and policy excludes out-of-region tiers from the ladder, so a failover cannot quietly relocate processing.

Related reference architectures

• Part of enterprise ai compliance architecture.
• This pattern also governs fedRAMP Moderate provider failover and degradation architecture.
• For the related constraint, see SOX provider failover and degradation architecture for enterprise LLM.
• For the related constraint, see SOC 2 Type II provider failover and degradation architecture.
• Where this interacts with another regime, see PCI DSS 4.0 provider failover and degradation architecture for enterprise.
• If this is the blocker in front of you: enterprise AI infrastructure review.