Hospital IT policy decides, and PHI stays out.

Hospital IT policy decides, and the baseline is that Jarvis (getjarvis.eu), a desktop AI assistant, is not a HIPAA tool. Because it signs no BAA, protected health information must stay out of it, and IT should treat it like any other unsanctioned cloud app. For non-PHI work it runs on macOS, Windows, and Linux and opens with Cmd+/ (Ctrl+/ on Windows). Jarvis is a desktop assistant for macOS, Windows, and Linux, opened with Cmd+/ (Ctrl+/ on Windows), routing to frontier models from Anthropic, OpenAI, and Google on GDPR-aligned infrastructure with your data stored in the EU, with AES-256-GCM token encryption and no training on your data. Because it does not sign a BAA, IT should treat it like any non-sanctioned cloud app: permit it, if at all, only for de-identified, non-clinical work. There is no central admin console for fleet-wide PHI controls, so individual discipline and clear policy matter.

Hospitals lock down endpoints for good reason, and any new app on a clinical workstation needs IT and security approval. Jarvis is a per-user desktop install, not an enterprise-managed platform with central PHI controls or admin oversight of employee prompts, so it does not slot into the governance model hospitals use for sanctioned clinical software. That gap is the core reason it should not be relied on around patient data. If IT does allow it, the safest scope is non-clinical machines or clearly non-PHI tasks, with installation and use governed by explicit policy.

Clinical workstations frequently have EHRs open, and Jarvis is screen-aware when invoked, so an accidental capture is a real risk in a hospital corridor or nursing station. Without a BAA, any PHI that reaches Jarvis is a compliance issue. Staff must clear the screen before pressing Cmd+/, avoid connecting any account that surfaces patient data, and de-identify everything they type. On shared or fast-switching devices, those habits are harder to maintain, which is another reason hospitals may prefer to restrict Jarvis to administrative or personal-productivity contexts only.

Privacy & data