Local AI for clinicians: work with patient records without PHI leaving your machine

You are the custodian of every patient record — a cloud chatbot can’t be

If you run a private practice or work as an independent clinician, the protected health information in your charts is your personal responsibility. When a record is exposed, the person who answers for it is you — not a vendor’s status page, not a support queue. That is the plain reason a general-purpose cloud chatbot is a poor fit for patient records: the moment you paste a chart note, a referral, or an intake form into it, PHI has left your control and entered a system you did not build and cannot inspect.

Pasting patient data into a hosted model is a disclosure you have to defend afterward — to a patient, to a board, or to yourself. Local AI for patient records exists because that decision is one most clinicians outside a hospital’s managed cloud tenancy would rather not make at all. SealedBrief removes it: the model runs entirely on your own machine, so the records never leave it. You can’t send patient records to cloud AI — and with SealedBrief you don’t have to.

Why a cloud chatbot is a PHI exposure problem for clinicians

Sending patient records to a cloud AI creates three problems you cannot account for later.

• It travels to a third party. The text of the record leaves your disk and crosses the network to a server you neither own nor control. For AI for clinicians without sending PHI to the cloud, that transit is the thing that has to not happen.
• Retention, logging, and training you can’t inspect. Once the record is on someone else’s infrastructure, it may be retained, logged, or used to improve a model, under terms that can change and that you have no way to audit from the outside.
• No after-the-fact proof of where it went. If you ever need to show who could read a specific record, a hosted service gives you a policy document, not evidence. You cannot independently prove where the data went or who had access.

A hospital with a legal department papers these over with contracts. An independent practice has no procurement team to negotiate a data-processing agreement and no one else to absorb the liability. Keeping records off the cloud is not caution for its own sake — it is a direct way to keep PHI inside the boundary you are actually accountable for.

How SealedBrief works with your patient records, locally

SealedBrief is a desktop AI workspace that reads your own documents and answers questions about them on your machine. You point it at a folder — a directory of charts, referrals, lab reports, or correspondence — and its ingestion engine indexes everything in place. There is no proprietary cloud store and nothing is uploaded; the files stay where they already sit.

It reads PDF, DOCX, TXT, Markdown, EPUB, and HTML, and extracts text from scanned pages and still images (PNG, JPG, TIFF) with on-device OCR — useful for the scanned charts and faxed referrals that fill a real practice. It works in English, Portuguese, or French. It does not transcribe audio or video.

This is private medical document AI in the literal sense: every answer is grounded in retrieved passages from your own records and shows the source paragraphs alongside the response, so you can check each claim against the exact text it came from. When the model cannot ground a claim in your documents, it says so rather than inventing a citation. Treat every answer as a draft — read the cited passages before you rely on it, the way you would review a junior colleague’s work. The value is in surfacing and locating what your own records already contain, not in an authority you should take unverified.

This is the general-practice case for on-device AI for PHI, and it sits alongside the broader argument for private, local AI for confidential documents. If your work is specifically mental-health documentation, there is a companion page on keeping clinical session notes on-device.

Why “sync to the cloud and trust us” is the wrong trade for patient records

The standard pitch for a hosted AI assistant is: sync your data to the cloud and trust us with it. For ordinary work that trade is often acceptable. For PHI, most independent clinicians would rather not make that trade at all — the record leaves a boundary you are personally accountable for and enters a system you cannot inspect, and you are the one who answers for it.

Retention toggles and “we don’t train on your data” settings do not close this, because they are promises to not do something with records the vendor already holds. To analyze patient records without cloud AI you have to remove the holding, not just the intent. SealedBrief is built around that position: because nothing is transmitted, there is no processor to enter a data-processing agreement with — the reviewer’s question about third-party access has a structural answer, not a policy answer. There is no server-side copy of your records to reason about in a review, because there is no server in the loop at all.

What’s encrypted, and what honestly isn’t

SealedBrief encrypts your indexed content on disk. The document text, source references, and metadata are encrypted field by field with AES-256-GCM, using HKDF-SHA256-derived subkeys and a fresh random nonce per record; the core database and full-text search index sit behind SQLCipher AES-256 page encryption. The master key lives in your operating system’s keychain. Every record is encrypted at rest before it touches disk.

One carve-out belongs up front, not buried, because precise claims are the point: the embedding vectors — the numeric representations used to find relevant passages — are stored unencrypted. Approximate-nearest-neighbour similarity search needs to do plaintext math over those numbers, so they cannot be encrypted at rest without breaking the retrieval that makes the product work. Text and metadata are encrypted; the vectors are not. That is the honest boundary of what SealedBrief encrypts at rest, stated plainly rather than discovered later.

Verify the no-egress claim yourself

You do not have to take a privacy claim on faith. SealedBrief runs as two operating-system processes that cannot swap roles. The Compute Plane — the part that touches your records, runs the model, and searches your index — has no network egress by construction. The Presentation Plane, the interface, reaches sealedbrief.com only to validate your licence and check for updates. Neither process contains your records or your questions.

That is what makes the claim checkable. Run a packet capture on your own machine while you query your files and watch the traffic: the document-handling process opens no connection, and the interface’s calls carry a licence check and an update check, never your records. Your IT contact or a technician can reproduce it in a few minutes. Follow the full verify-it-yourself walkthrough for the exact commands.

Note the honest boundary. This is not the claim that the application never touches the internet. It is the narrower, true claim: the process that reads your records has no egress, and the process with network access never carries your records. Those are different statements, and only the specific one is being made.

Scope and honest limits

A clinician personally liable for this data deserves the boundaries stated as plainly as the pitch.

• It runs a local open model, not GPT-4. SealedBrief ships with Qwen3-8B and Qwen3-14B (both Apache-2.0, GGUF, auto-selected by your available VRAM). These are capable open models running fully offline; they are not frontier hosted models, and you should not expect GPT-4-class reasoning. Verify the citations.
• It needs real hardware. On a Linux workstation with a 12 GB-or-larger NVIDIA GPU, answers come back in seconds. It also runs on 8–12 GB GPUs, on Apple Silicon Macs (M1–M4) via Metal, and CPU-only, which answers in tens of seconds. Plan on roughly 16 GB of RAM and about 15 GB of free disk.
• A one-time ~15 GB download, then offline. The full package, models included, is a single ~15 GB download, with nothing fetched at runtime.
• OCR yes, no audio or video. It reads text and runs on-device OCR over scanned charts; it does not transcribe dictation, calls, or video.
• Windows is a waitlist. Linux (a portable AppImage, no install step) and macOS (a signed, notarized build for Apple Silicon only) ship today. Windows is genuinely blocked on an encryption-library dependency — not a marketing “coming soon” — and there is no charge until it ships. If you work on Windows, join the waitlist and you will know exactly where you stand.
• This is a technical control, not a compliance certification. Keeping PHI on the device is a meaningful safeguard, but it does not by itself satisfy any regulation, and nothing on this page is medical or compliance advice about your obligations. How a given control maps to your duties is a question for your own counsel.

Personal versus Professional — what it costs

Both tiers run the same on-device workspace; the differences are additive, and Personal is never crippled. It is a 3-year term licence — not perpetual, and not a subscription.

• Personal — $199 for a 3-year term, plus $49/year support in years 2 and 3 ($297 total over the term), for one device. The right fit for an individual practitioner.
• Professional — $499 for a 3-year term, plus $109.99/year support in years 2 and 3 ($718.98 total over the term), for up to three devices. It adds a commercial-use grant that covers paid client work, and an exportable compliance-and-audit evidence surface: an at-rest encryption proof, a network-egress attestation, and an ingestion audit log — a self-owned record of what was indexed and that nothing was transmitted.

The licence is an Ed25519-signed file verified offline, so activation works even if the company were to disappear — it keeps working for the rest of your term. If a term lapses, the vault opens read-only and nothing is deleted. Every purchase is backed by a 30-day, no-questions refund, separate from the free trial. You can compare both tiers on the pricing page.

Try it on your own records

The free 14-day trial is the full workspace, not a limited demo. On first launch you choose “Start 14-day trial” on the welcome screen — no account, no credit card, and starting the trial makes no network call. Index your real records, ask cited questions, search, and export, all on your own hardware.

After 14 days the app opens read-only. Nothing is deleted and nothing is locked away — you keep full read, search, and export (Markdown and PDF) of everything already indexed. Only indexing new documents and asking new questions pause until you enter a licence, at which point the same install unlocks instantly with no reinstall and no lost work.

A useful next step is to run it against records you actually can’t upload, and capture the traffic while you do. Download the free 14-day trial for Linux or macOS (Apple Silicon) — a ~15 GB download — or compare both tiers on the pricing page if you already know which one fits your practice.