Oracle Publishes Reference Design to Keep PHI AI Requests Inside OCI

Healthcare teams using AI often face a blunt question from security reviewers: can they prove where patient data went? Oracle has published a public reference implementation intended to answer it by classifying requests before model inference, blocking PHI from external-model routes, and sending it to an isolated lane inside Oracle Cloud Infrastructure instead.

The design addresses a practical weakness in rules that depend on developers correctly labeling free-text requests. Its gateway examines request content locally, rather than accepting the caller’s data-class label. In Oracle’s example, a request classified as containing protected health information, or PHI, receives a 403 denial when aimed at an external-model lane; the response identifies the detected entity types and directs the application to an in-tenancy model lane.

A gate that checks before sending

The classifier is a local, in-process named-entity-recognition system, according to Oracle’s walkthrough. That means the text is checked at the gateway before it is passed to a model—a material design choice when the purpose is to avoid sending sensitive text outside the intended boundary. Oracle reports overhead of under 6 milliseconds per request.

The boundary is a missing route

The key enforcement mechanism is not simply an outbound firewall rule. Oracle’s PHI inference subnet uses a route table with zero rules and has no route to an internet gateway, NAT gateway, or service gateway. The subnet also prohibits public IP addresses, creating a second network control. Oracle’s argument is that a reviewer can inspect the absence of a path rather than rely on a rule that permits an existing path to be changed later.

That isolation does not mean every request must run on a customer-hosted model. Oracle says its managed OCI Generative AI service can be reached through a Service Gateway over Oracle’s backbone. The reference design therefore distinguishes managed OCI inference from a request to a third-party provider, which Oracle describes as the true external-egress path.

Useful evidence, incomplete assurance

Oracle is explicit about what the pattern cannot establish. It is not HIPAA Safe Harbor, does not detect every identifier type, and does not provide BAA coverage, clinical validation, or a compliance attestation. The company also notes that a named-entity-recognition classifier covers only a subset of identifiers; site-specific formats need additional recognition logic.

The design deliberately over-denies some requests, Oracle says, which can include material that is not patient data. That tradeoff favors a fail-closed control, but it leaves teams needing context rules, allow-lists, and an exception process if they want developers to keep using the sanctioned route.

Oracle has made the implementation public, including scripts to create and tear down the network setup, and says it can be deployed in about 30 minutes on a fresh OCI tenancy. It also proposes versioned Object Storage and retention rules for audit records. Those retention rules have an operational consequence: once locked, a bucket cannot be deleted until its retention period ends.