PHI-aware policy, minimum-necessary enforcement, and BAA-covered evidence for AI in payer, provider, and life-sciences settings.