HIPAA
The Health Insurance Portability and Accountability Act (HIPAA) is a US federal law that establishes standards for protecting sensitive patient health information (PHI). It requires covered entities and their business associates to implement administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of electronic PHI.
Why It Matters
HIPAA's relevance to AI agents is immediate in healthcare settings. When an agent accesses an EHR system, a patient portal, or a clinical database, every tool call that touches PHI is subject to HIPAA's access controls, audit requirements, and minimum necessary standard.
The minimum necessary standard is particularly relevant: agents should access only the PHI required for the specific task. Session-scoped permissions and per-action policy enforcement align directly with this requirement. An agent that holds standing access to an entire patient database violates the principle even if it only reads one record.
Business associate agreements (BAAs) apply to any entity that handles PHI on behalf of a covered entity. If an AI agent governance platform processes PHI in transit, a BAA is required before deployment.