OCI Generative AI Services

NEVER Do This

❌ NEVER send PHI/PII identifiers to GenAI APIs

# WRONG - patient identifiers in external service logs
prompt = f"Transcribe note for patient {patient_name}, MRN {mrn}, SSN {ssn}: {note}"

# RIGHT - redact first, keep mapping in secure DB
prompt = f"Transcribe this medical note: {redacted_note}"
# phi_mapping stored locally: temp_id → real_id

GenAI service logs may retain data. Sending PHI violates HIPAA/GDPR regardless of Oracle BAA status.

❌ NEVER trust GenAI output without validation in critical systems

• Hallucination rate: 5-15% for factual queries, higher for medical/legal
• Always route AI-suggested content to human review queue before acting on it