Energy powers
intelligence

The health system retains authority over patient data, model use, access policies and clinical decisions. Each project is designed around agreed institutional controls:

• Dedicated or physically isolated compute where required, with separate clinical, research and commercial environments.
• U.S.-hosted data and workloads where required by the health system or applicable obligations; agreed data residency and access boundaries.
• Hospital-controlled encryption keys, encryption at rest and in transit, zero-trust access and multifactor authentication.
• Auditable data access and model activity, an approved model registry, version history and provenance.
• No unauthorized external model training, sale or secondary use of patient data.
• Controlled connections to Epic and other approved clinical systems, with resilient backup and disaster recovery.

Coinroll develops the infrastructure; the health system retains clinical governance. Clinical validation and authorization remain with the hospital and applicable technology or medical-device providers.

Projects are designed around applicable HIPAA administrative, physical and technical safeguards, with business-associate agreements where required. Providers maintaining electronic protected health information may have business-associate responsibilities even when the data is encrypted.

U.S. hosting is a project-specific sovereignty protection, not a blanket HIPAA requirement. There is no general-purpose “HIPAA AI certification.” Healthcare AI obligations depend on the technology and its intended use.

Design planning considers current HIPAA obligations and evolving cybersecurity requirements, including asset inventories, network maps, encryption, multifactor authentication, segmentation, vulnerability management, incident response and tested recovery. Applicable requirements are confirmed during project diligence.

Healthcare AI governance includes documented intended use and limitations, model versions and provenance, performance and risk monitoring, separation of research and clinical workloads, and meaningful human oversight. Infrastructure supports transparency and auditability; it does not itself establish clinical approval or certified health IT compliance.

HHS cloud guidance · HHS Security Rule proposal

On-campus, adjacent-campus or regional projects can be modular, phased or permanent. Coinroll evaluates ground leases, energy-services agreements, compute-capacity agreements, joint development and sale-leaseback structures according to each institution’s capital strategy.

Ownership and financing can be structured through Coinroll, the hospital, a joint venture or a project company. The hospital contracts for agreed capacity; approved commercial customers contract for separately allocated capacity. Site diligence, credit, demand and definitive agreements determine the final structure.

The proposed 10% Healthcare Prosperity Commitment can support community health, medical research, workforce development, rural access and patient-support priorities selected by the health system, subject to project agreements and applicable healthcare regulations.

Resilience designs are coordinated with the hospital’s required emergency-power architecture. Construction and expansion are planned around continuity of clinical operations.