HIPAA compliance for AI agents in healthcare

HIPAA (Health Insurance Portability and Accountability Act) sets strict requirements for systems that handle Protected Health Information (PHI). AI agents deployed in healthcare settings must meet these requirements, which cover access controls, audit trails, data integrity, and transmission security.

HIPAA requirements relevant to AI agents

Access controls (164.312(a))

Only authorized users and systems should access PHI. For AI agents:

• The agent should only access patient data necessary for the current task
• Access should be scoped to the specific patient and data type
• Credentials should be unique to the agent, not shared with human users

rules:
  - tool: "patient.lookup"
    action: allow
    when:
      context.hasConsent:
        equals: true
      args.fields:
        not:
          contains: "ssn"
    reason: "Patient lookup allowed with consent, excluding SSN"

Audit controls (164.312(b))

Record and examine activity in systems that contain PHI:

• Log every agent access to patient data
• Include who requested the access (user and agent identity)
• Include what data was accessed
• Retain logs for at least six years

Hash-chained receipts meet this requirement. Each receipt records the tool call, arguments, principal chain, and decision. The chain's tamper-evident property satisfies the integrity requirement for audit logs.

Integrity controls (164.312(c))

Protect PHI from improper alteration or destruction:

• Policy rules should prevent the agent from modifying patient records without authorization
• Aegis scanning should detect potential data corruption in agent inputs
• Receipt chains should be append-only with no update or delete capability

Transmission security (164.312(e))

Protect PHI during transmission:

• All communication between the agent and the control plane should use TLS
• PHI in tool arguments should be encrypted in transit
• MCP gateway connections should use encrypted transports

Minimum necessary standard

HIPAA's minimum necessary standard requires that access to PHI be limited to what is needed for the task. For AI agents, this means:

• Policy rules that restrict which patient data fields the agent can access
• Session-scoped access that expires when the task is complete
• No caching or storing PHI beyond the immediate need

Business Associate Agreement

If you are providing an AI agent system that handles PHI on behalf of a covered entity, you are a Business Associate and need a BAA. The BAA should specify how the agent system protects PHI, what controls are in place, and how breaches are reported.

Practical implementation

Deploy Authensor with:

1. Strict, deny-by-default policies for all patient data access
2. Aegis scanning for PII in both inbound and outbound data
3. Receipt logging with 6-year retention
4. Approval workflows for any data modification
5. TLS for all network connections
6. Principal binding so every access is attributed to a user and agent