HIPAA-compliant generative AI at scale: UTHealth Houston's iDFax journey with Amazon Bedrock
Published by AINave Editorial • Reviewed by Ramit
UTHealth Houston, in collaboration with AWS, has demonstrated that HIPAA-compliant generative AI at scale with Amazon Bedrock is achievable in regulated healthcare environments. The iDFax system processes over 100,000 medical faxes monthly, cutting per-fax handling time by more than half and freeing thousands of staff hours for direct patient care.
What happened
In June 2023, UTHealth Houston launched iDFax as a pilot processing 2,800 faxes per month. By February 2026, it scaled to over 100,000 faxes monthly, a roughly 3,500% increase. The system uses an eight-step pipeline: ingestion via AWS Direct Connect, queuing with SQS, containerized processing on EC2, metadata management in DynamoDB, AI classification with Bedrock foundation models, automated referral transcription, and routing to Epic EHR. OCR accuracy exceeds 95%.
Per-fax processing time dropped from 82-150 seconds to 28-68 seconds, saving approximately 19,000 staff hours annually. The financial impact: more than $2 million in annual cost savings, ROI over 220%, and a payback period of 3-4 months.
Why AI builders should care
This case study provides a blueprint for deploying generative AI in highly regulated industries. Key lessons include starting with clinical leadership, designing for HIPAA compliance from day one, prioritizing EHR integration, deploying in phases, measuring rigorously, investing in change management, and incorporating continuous user feedback. The architecture is replicable for other regulated sectors like insurance, legal, and mortgage that handle sensitive document workflows.
The eight-step iDFax pipeline demonstrates how to orchestrate multiple AWS services for HIPAA-compliant document processing. Builders can adopt similar patterns: use Bedrock for classification without custom ML infrastructure, integrate directly with existing EHR or record systems, and maintain PHI security by using HIPAA-eligible services throughout.
Practical implications
The phased approach (pilot, systematic expansion, production deployment, optimization) allows risk mitigation while proving value incrementally. The system's dynamic monitoring dashboard provides actionable insights into usage and efficiency. For teams building similar solutions, the key takeaway is that HIPAA-compliant generative AI at scale is not just possible but can deliver strong ROI when aligned with clinical workflows and supported by strong governance.
Caveats
All results are specific to UTHealth Houston's environment and workflows. Outcomes may vary for other organizations. Some configuration details may be proprietary or contextual. The case study is published by AWS, so consider potential bias. The system's success depends on strong clinical leadership and organizational support, which may not be present in all settings.
