Private Clinical AI for a Chilean Specialty Medical Group

Chilean clinical data sits under two regimes at once, and the design had to satisfy both. Ley 19.628 treats health data as sensitive and permits processing only where a law authorises it, the data subject consents, or it is necessary to determine or grant health benefits, with health and biological-profile data confined to the purposes set out in special health legislation. Ley 20.584 and its Decreto 41 of 2012 govern the ficha clínica itself: confidential, retained for at least fifteen years, with the enumerated access list above and a duty to record who opened a record and why. Neither framework contains anything resembling a business associate agreement, the US instrument that lets an organisation extend its compliance perimeter to a vendor by contract. In Chile there is no such extension to buy, which is the detail most AI vendors pitching into this market have not registered.

The second pressure was timing. Ley 21.719 was published in December 2024 and takes effect on 1 December 2026, replacing a thin regime with a supervised one: a new Agencia de Protección de Datos Personales, breach notification inside seventy-two hours, accountability duties that oblige the controller to demonstrate compliance and to design for privacy by default, and penalties reaching 20,000 UTM. It also puts real weight on the encargado de tratamiento relationship. A processor that steps outside documented instructions, or transfers data without authorisation, becomes a controller in its own right and answers personally and jointly. Every processor the group onboarded in 2025 was a relationship it would have to re-paper, re-assess, and eventually defend to a regulator that did not yet exist.

We treated this as an architecture decision rather than a paperwork exercise. If clinical data never crosses an organisational boundary, there is no processor to assess, no subcontractor chain to track, no international transfer to declare, and no external breach surface to notify on. That constraint shaped every choice below, and it is why the group accepted the cost of owning hardware.

The core of the design is one explicitly drawn boundary around clinical data. Inference nodes, application services, the retrieval index, object storage, and the audit database live in one segmented zone in the group's own data center. Egress is default-deny. Model weights and container images entered through a reviewed artifact path and are pinned by digest. A runtime pull from the public internet is an uncontrolled dependency inside a controlled zone, and we did not ship one.

Data moves in one direction. The clinical record system, document intake, and dictation feed an ingestion tier inside the boundary. Documents are normalised, chunked, embedded, and indexed locally, inference happens locally, and responses carry source spans back to the originating record so a clinician verifies instead of trusting. Nothing round-trips. The staff-facing surface is Lumen inside the same boundary: a governed workspace with SSO and admin visibility, which is what replaced the browser tabs pointed at consumer models.

De-identification is a second lane, not the safety story for the first. We built an anonymisation pipeline that strips direct and indirect identifiers to feed analytics and evaluation sets, held to the standard Ley 21.719 sets for anonymised data: the result must not permit re-identification by reasonable means. We did not treat de-identification as the control that lets an external processor read clinical free text. Narrative notes carry re-identifying detail that pattern matching misses, and a miss on a cloud path is a disclosure of sensitive data rather than a bug. For the same reason we declined the design that looks cheapest on a whiteboard, a scrubbing proxy in front of a hosted frontier model, because it keeps the processor relationship intact and quietly promotes a redaction system whose failure mode is silent into a compliance control.

We deployed fewer and smaller models than the group expected to need. Referral extraction, coding support, and triage are narrow tasks with checkable outputs, and Particula-Healthcare handles them on a fraction of the VRAM a general model needs, which moved the hardware bill and the concurrency ceiling together. A larger general model is reserved for open-ended summarisation and drafting. One serving runtime, two model tiers, no per-use-case sprawl.

Language was the constraint that shaped model selection more than parameter count. The corpus is Spanish throughout, written in Chilean clinical register, with local abbreviations, Fonasa and Isapre billing vocabulary, and dictation carrying a regional accent that generic speech models handle unevenly. Most published medical NLP evaluation is English-first, so a model that leads the English leaderboards tells you very little here. We built the shortlist on the group's own Spanish documents from the start, and Whisper was tuned and measured against their dictation rather than accepted at its published word error rate.

Particula-Healthcare covers the extraction tier: diagnoses, medications, dosages, and codes pulled from referral packets and discharge summaries, with an identifier redaction pass before anything is logged and a source span on every field, running at 32K context. The general tier is Llama 3.3 70B, quantised to the GPU budget and served by the same vLLM runtime, so the group's operations team has one system to run and patch. Both tiers sit across two NVIDIA H100 nodes sized from measured peak concurrency.

Chile publishes no technical safeguards checklist of the kind 45 CFR gives a US deployment, so we built the mapping in the other direction: from the duties in Ley 20.584, Decreto 41, and the accountability obligations arriving with Ley 21.719, down to controls a reviewer can actually test. Access control resolves to the group's existing identity provider with role scoping, unique user identity per request, automatic session termination, and a documented break-glass path, because Decreto 41 requires the record to show who opened a ficha clínica and on what basis. Audit controls are append-only rows in PostgreSQL rather than application logs: actor, purpose of use, source record, model version, prompt hash, response hash, retained to match the fifteen-year ficha clínica period instead of a shorter application default. Inside the boundary, internal traffic is encrypted and mutually authenticated.

Need-to-know is enforced at retrieval, not at presentation. Every index query carries the requesting user's authorisation context and filters candidate documents before they reach the model, so a professional who is not treating a given patient never has that patient's record enter a prompt in the first place. Post-filtering the answer is how leaks happen: by then the restricted content has already shaped the output, and redacting visible text does not unwind that. This was the design point we would not compromise on, and it survived the group's own security review unchanged.

Two defaults we set and documented: no training or fine-tuning on production clinical data without an explicitly approved lane carrying its own data flow diagram, and no outbound telemetry of any kind, including crash reporting and usage analytics. Anything that phones home was disabled at build time or stayed outside the boundary. The second default also settles the international transfer question before anyone asks it. There is no outbound path, so there is nothing to declare, nothing to localise, and nothing to justify when the Agencia begins supervising in December 2026.

The first production workload took twelve weeks, sequenced so compliance review ran in parallel with the build rather than in front of it. Weeks one through three established the boundary: network segmentation, GPU nodes, identity integration, the artifact path, and the audit store. Weeks four through eight built ingestion for referral packets, the group's highest-volume document type, and stood up retrieval. Weeks nine through twelve belonged to shadow-mode use with the central intake team, the eval gate, and cutover.

Cutover was gated on eval parity, not on the calendar. The system ran alongside the existing process on live traffic, outputs were scored against a held-out set labelled by the group's own clinical and admissions staff, and cutover happened when the extraction tier met the agreed threshold and the audit trail was complete for every inference. Discharge summaries followed as the second workload, reusing the same boundary, runtime, and audit store, so the incremental work was ingestion and evaluation rather than a rebuild.

Handover was planned from the start: runbooks for model updates and node failure, capacity review tied to concurrency, and a named internal owner for the artifact path. A system only we can operate is a dependency we did not agree to create.

Model quality was measured on the group's own documents, not on leaderboards. Against the held-out set labelled by their staff, the extraction tier reached a field-level F1 of 0.95 on referral packets at cutover, with a span grounding rate of 98 percent, meaning nearly every asserted fact resolves to a real source sentence a reviewer can click through to. The model abstains on ambiguous notes rather than guessing, and intake staff treat those abstentions as correct behaviour: the referrals that used to take around twelve minutes each to triage by hand now take about four, with the extracted fields pre-filled and verified against their spans.

The compliance outcome is the one the project existed for. Roughly 45,000 documents a month are processed with zero external processors, no encargado de tratamiento to contract, assess, or re-paper before December 2026, no subcontractor chain, and no cross-border transfer anywhere on the data map, which was the line that mattered most given that every major model API would have moved Chilean clinical records offshore. Audit completeness is a monitored metric, every inference resolvable to actor, purpose of use, and source record, and the compliance team reviews access denials and break-glass usage on a schedule they own. Staff activity moved onto Lumen, where admins can actually see it, instead of consumer chat tools where nobody could.

Systems metrics closed the loop on the hardware decision: p50 and p95 latency at target concurrency hold on the two fixed nodes, and the capacity conversation replaced the cost conversation, which is the trade the group wanted. Public benchmarks such as MedQA and PubMedQA were used to shortlist the general model and then set aside, because no published score transfers cleanly to one organisation's note templates and dictation quirks, and almost none of that published work is in Spanish to begin with. Acceptance was measured on their documents, in their language, by their people, inside their fence.