Open-Weight AI Gains Ground in Healthcare as HIPAA Rules Favor On-Premise Models

Healthcare organizations are increasingly adopting open-weight AI models hosted on their own infrastructure to avoid the compliance risks of sending protected health information to third-party cloud providers under HIPAA's Security Rule. A German university hospital deployed DeepSeek-R1 via vLLM inside a fully air-gapped radiology environment with no outbound internet access, completing a one-week pilot involving 22 residents and radiologists. The pilot found the model performed well on structured rewriting tasks such as simplifying existing radiology reports, but produced critical errors — including hallucinations and omitted findings — when generating clinical conclusions from scratch. Self-hosting eliminates the need for a Business Associate Agreement with an external AI vendor, removing one processor from the PHI data flow and narrowing the legal liability perimeter. Experts note that open-weight models have become the practical default in clinical IT not due to superior performance, but because closed APIs place a third party in the middle of sensitive patient data.