HIPAA Compliant AI Agents: A 2026 Requirements Guide
Oct 18, 202617 min read
HIPAA compliant AI agents are arrangements, not products
Are AI agents HIPAA compliant by themselves?
No agent is HIPAA compliant by itself.
An AI agent is compliant only when the whole arrangement around it is: the agent, its model provider, its hosting and every connected tool (including workflow automation layers such as Activepieces), governed by a signed agreement and enforced safeguards.
Each new connection that touches patient data is a new liability line until its coverage is documented.
Miss any one of five parts and it is a finding. A signed BAA, the business associate agreement, binds the vendor in writing to protect PHI.
Every subprocessor is covered: the model host, storage and any downstream service that sees the data sits under the same obligations. Access controls limit, by role, who and what can read, change or run the agent.
An audit trail records who accessed which data and when, so an incident can be reconstructed. Minimum necessary PHI means the agent receives only the fields its task requires.
Treat these as the checklist a buyer should demand evidence for, and the rest of this guide tests vendors against it.
What HIPAA compliant AI agent means under HHS
Here, a HIPAA compliant AI agent means one that handles protected health information for a covered entity or its business associate, under a BAA, with Security Rule safeguards in place.
If a vendor shows a "HIPAA certified" badge, it is the vendor's marketing claim, not a government credential, because HHS doesn't certify software. What a buyer can verify is the contract, the controls and the evidence behind them.
How we verify HIPAA vendor claims
If a page doesn't state a BAA or a safeguard, we don't assume one. Every vendor fact here was checked on 2026-10-18 against the vendor's own trust, security or pricing pages.
Activepieces is held to the same rule: we cite its MIT-licensed core and the 741 integrations counted from its public repository, and we describe self-hosting as a deployment fact, not as a compliance guarantee.
This takes minutes, not a project: automate it in Activepieces free.
Agent prerequisites for handling PHI
Before an agent touches protected health information (PHI), a signed business associate agreement (BAA) and HIPAA's technical safeguards must cover every system it passes data through. That's a property of the arrangement, not the model.
The table shows where each requirement originates and what it demands of an agent; treat each row as a separate liability line.
| Requirement | HIPAA rule | What it means for an agent |
|---|---|---|
| BAA | Privacy Rule, Security Rule | Signed with each vendor that touches PHI, including subprocessors |
| Access control | Security Rule, technical safeguards | Unique identities and least-privilege tool permissions |
| Audit logging | Security Rule, technical safeguards | Every prompt, retrieval and action is recorded |
| Encryption | Security Rule, transmission and storage | Protect data in transit and at rest, including logs |
| Minimum necessary | Privacy Rule | Send the agent only the fields the task needs |
| Retention | Security Rule, documentation | Keep policies and records six years; do not keep stray PHI copies |
| Breach notice | Breach Notification Rule | Vendor must report to you within 60 days at most |
Prices and plan limits checked against docs.claude.com and claude.com and openai.com and gemini.google on October 18, 2026.
You can inspect every requirement here, because each is a contract or a control.
Without a BAA, sending PHI to a vendor is an impermissible disclosure, whatever the vendor's badge says.
That exposure has a price.
**Without a BAA, sending PHI to a vendor is an impermissible disclosure, whatever the vendor's badge says.
Phishingcost, summarizing IBM's 2025 Cost of a Data Breach, puts healthcare at $7.42 million per breach, against $5.56 million for financial services and $4.83 million for energy and utilities. So a gap in your vendor chain costs more here than in any other sector listed.
Expect an auditor to test access control, audit logging and encryption.
Technology and SaaS breaches average $4.79 million and pharmaceutical $4.61 million, so even the next-most-regulated sectors lose about $2.6 to $2.8 million less than healthcare.
Retail, at $3.48 million, is less than half the healthcare figure.
Withhold a field from the agent and it can't leak, be logged or be retained. Restrict inputs first, then set retention so transcripts and logs don't become an unmanaged PHI store.
Where HIPAA compliant AI agents are used today
Whether an agent touches PHI decides its compliance burden, and the five common uses split unevenly: some handle identifiable data by design, others only sometimes.
The table shows where each sits, so read the last column as the price of admission before you scope a pilot.
| Use case | Touches PHI | Data involved | Compliance burden |
|---|---|---|---|
| Intake and scheduling | Yes | Name, date of birth, contact details, reason for visit, insurance | Moderate: needs a BAA and access controls, but the data set is narrow |
| Prior authorization | Yes | Diagnoses, procedure codes, clinical notes, payer identifiers | High: clinical detail travels to outside payers |
| Claims status | Sometimes | Claim numbers, dates of service, member IDs | Moderate: depends on whether identifiers are sent |
| Documentation summaries | Yes | Visit notes, transcripts, medications, histories | Highest: the richest PHI, stored in outputs |
| Patient messaging | Yes | Names, contact details, appointment or result context | High: outbound content leaves your control |
Four of the five rows are a flat yes, so the real choice is how much each agent needs to see, not whether it sees anything.
Most automatable, easiest to over-expose: intake, scheduling, prior authorization and claims status. Intake and scheduling need identity and contact data, nothing clinical.
Often, claims status can run on claim numbers alone, which is the one place minimum-necessary data can keep an agent outside PHI.
Prior authorization can't; it moves diagnoses to payers, so every connection in that path is a liability line that needs coverage.
Summaries carry the most sensitive content, and the output is new PHI that someone must store, review and control. The risk is not only the model call.
It's who can read the drafts, how long they persist, and whether a clinician signs off before they enter the record.
Only messaging has the agent writing to people outside your walls. A wrong recipient or an over-informative text is a disclosure. Restrict what a message may contain, log every send, and keep clinical detail out of channels the patient hasn't agreed to use.
Vendor HIPAA offerings by plan
Before you sign, read each vendor's page: the terms differ enough to matter. Each of the five vendors below offers a BAA through an API or cloud account, not through a consumer chat plan.
Comparison table
To see where each vendor puts its BAA and what you must do to get it, read the table. The takeaway is that the agreement attaches to the account type you buy, not to the model you like.
Dated 2026-10-18; every row is "confirm on vendor page" before you rely on it.
| Vendor | BAA available | Plan type | Cost or conditions |
|---|---|---|---|
| OpenAI API | Yes, by request | API account, not ChatGPT consumer plans | Eligibility and covered endpoints: confirm on vendor page |
| Anthropic | Yes, for the API | Commercial API account, not consumer Claude plans | Covered features and retention terms: confirm on vendor page |
| Azure OpenAI (OpenAI models hosted by Microsoft) | Yes, through Microsoft's agreement | Azure subscription | Covered deployments: confirm on vendor page |
| Vertex AI (Google Cloud's model platform) | Yes, through Google Cloud's agreement | Google Cloud account | Covered models and features: confirm on vendor page |
| AWS Bedrock (Amazon's hosted-model service) | Yes, through AWS's agreement | AWS account | Covered models and regions: confirm on vendor page |
Even with a signed agreement, a feature outside the vendor's list leaves you exposed, because a "yes" here covers only the services the vendor lists.
Consumer plans versus API and enterprise
Cheap and immediate: that is why staff drift to the consumer tiers. OpenAI's pricing page lists Free at $0 a month, Go at $8 and Plus at $20, so users can start free but must pay for premium features.
At those prices a clinician can start pasting patient notes in minutes. There's no BAA, and no one in compliance is aware of it. Treat any plan bought on a personal card as out of scope for PHI.
You can follow the rest of this with the builder open. Start free, no card.
Mistakes that make an AI agent non-compliant
Six common HIPAA compliance failures in AI agents
One of six failures sinks most non-compliant agents. The causes are SOC 2 mistaken for HIPAA, PHI in a tool with no BAA, an uncovered vector database, PHI in prompts and traces, over-broad access, or no audit trail.
A BAA that reaches every tool only holds if none of these gaps opens behind it.
According to the Protectedharbor 2021 Healthcare Data Breach Trend Report, hacking and IT incidents caused 74% of breaches and unauthorized access another 21%.
Together that's 95%, so almost every breach traces to who could reach the data. Theft (3%), loss (1%) and improper disposal (1%) account for the remaining few percent.
Examples of each AI agent compliance failure
Here is a typical example of each failure. A team accepts a vendor's SOC 2 audit report as proof it may handle patient records.
A staff member pastes a patient note into a chat assistant the company never contracted. Embeddings of clinical notes sit in a vector database whose host never signed a BAA.
Full patient names persist in debugging logs that anyone on the team can search. A scheduling agent holds credentials that also open billing and diagnosis records. After an incident, nobody can say which records the agent read.
How to fix AI agent HIPAA gaps
Don't read SOC 2 as HIPAA coverage: it reports on a vendor's security controls and doesn't make the vendor answerable under HIPAA. Without a signed BAA, the covered entity carries the exposure alone, whatever badge is on the vendor's site.
Treat prompts, traces and embeddings as copies of the data. Each copy sits with a subprocessor, so each one needs the same coverage as the original. An unlisted logging service is a disclosure waiting to be found.
Give an agent a broad service account and it reads everything that account can see, every run. Scope it to the minimum PHI the task needs. Unauthorized access was 21% of breaches, so over-permissioned credentials are the most common route in after hacking.
Missing human review and audit trails for agents
It's the missing risk analysis that regulators punish, not only the breach.
In OCR risk analysis settlements, Sunhawk Consulting lists penalties from $25,000 (Comprehensive Neurology) through $75,000 (Comstar), $80,000 (Elgon Information) and $90,000 (VPN Solutions) to $227,816 (Health Fitness) and $337,750 (USR Holdings), making the cost of non-compliance materially expensive for organizations.
At thirteenfold, the spread makes the cost of an undocumented review unpredictable, and a logged, human-reviewed agent is the cheapest defense.
Build a compliant setup around the agent with Activepieces
No workflow tool makes an agent compliant, and Activepieces doesn't either; its MIT-licensed core lets a team inspect the controls around an agent and keep them inside its own boundary.
That layer matters because every connection an agent gets, to a records system, an inbox or a model provider, is a new liability line until someone has scoped it.
Look at the Agents dashboard to see what that scoping looks like in practice. Each agent is a named, listed object, here "Blog Author Enricher" and "SEO blog writer", sitting beside Flows, Tables, MCP and Connections in the sidebar.
For a reviewer, the point is that agents and the connections they use are managed in one place rather than scattered across personal accounts, which makes an inventory possible. An inventory is the precondition for every other control.
Self-host to keep PHI in your environment
Activepieces runs self-hosted from its MIT-licensed core, including in an air-gapped setup, which keeps the workflow itself inside the team's own network.
For a regulated team, this is the practical route: the orchestration layer, its stored run data and its credentials stay in an environment the team already controls and audits.
The core is MIT-licensed, and the public GitHub repository (25,087 stars, 741 integrations in its community integrations directory) shows exactly what runs inside that boundary before anything is installed; its LICENSE file puts only the packages/ee/ directories under a separate commercial licence.
You pay for it operationally. The team now owns patching, backups and uptime, which the managed cloud would otherwise carry.
If a team prefers not to run infrastructure, it can use the managed cloud in an EU or US region, which settles where data resides but not who operates the servers.
Access control and audit trail
When someone leaves the company and is deprovisioned, their access to workflows and connections ends with it: Activepieces holds a SOC 2 Type II report and supports SSO and SCIM, so access follows the identity provider.
With custom RBAC, a team separates who builds a flow, who may use a connection holding patient records, and who may only view runs.
The enterprise RBAC documentation spells out that these access policies also apply to which connections an agent may use, so the agent sits inside the same access model as the staff around it.
Audit logs record what changed and who changed it, which is the evidence an assessor will ask for, and the run detail view for an agent step lists each tool call separately, with its own input and output.
What it does not do
Do not look to Activepieces for a BAA: it doesn't offer one, and it doesn't claim HIPAA certification; the MIT-licensed core is something to inspect, not an agreement to sign.
The model provider the agent calls, and any other service in the chain, still needs its own agreement and its own review.
Self-hosting keeps the workflow layer in your environment; it doesn't cover a downstream vendor that receives the data. Minimum necessary PHI remains a design decision the team must make in each flow.
Agent security review questions
Ask eight questions, in this order, and accept a document as the answer to each, not a verbal assurance. This is how you test whether a vendor actually meets the obligations above.
Each question below targets a place where the arrangement tends to break, and each unanswered one is a liability line you carry yourself.
- Who signed the business associate agreement (BAA), and does its scope cover the agent product you are buying, not just the vendor's other services?
- Which subprocessors touch the data, and is each one covered by an agreement that flows down the same obligations?
- How long are prompts, outputs and logs retained, and are they ever used for model training?
- In which region is data stored and processed, including backups and support access?
- Can you export the audit log yourself, and does a test export show who accessed what?
- Does the product support single sign-on (SSO) and automated user provisioning through SCIM, so departures remove access the same day?
- What are the contractual incident notice times, and who at the vendor makes the call?
- Can they send their security documentation, such as audit reports and policies, before you sign?
If a vendor can't answer the first two, it has given you a badge, not an arrangement.
Security review questions for the workflow platform
Repeat all eight questions for the platform that connects the agent to your systems: it is a separate party with its own answers, and it sees every payload passing through.
Add one more: can it run in your own environment, so regulated data never leaves your network?
Make the platform state the tradeoff of a hosted setup in writing: convenience is paid for in who can see the data.
MoneyGram, Moneypenny, Alan and FundingSocieties run Activepieces, and its security documents and enterprise pricing are at https://www.activepieces.com/sales. Request them on Monday, so the answers are in hand before the review meeting.
Frequently asked questions
Is ChatGPT HIPAA compliant?
Not by default: whether a ChatGPT deployment is HIPAA compliant depends on the contract and configuration around it, not on the product name. Consumer accounts carry no business associate agreement, so putting PHI in them is an unmanaged disclosure.
Only an arrangement where the vendor has signed a BAA covering the specific product you use, with access controls and logging switched on, can be treated as eligible. Ask your vendor in writing which products and plans the BAA covers.
Does SOC 2 mean an AI tool is HIPAA compliant?
No. SOC 2 is an independent auditor's report on a vendor's security controls, and it's useful evidence. It's not a HIPAA assessment, and it creates no obligation to sign a BAA.
A vendor can hold a clean SOC 2 report and still refuse to accept PHI. Treat it as one input to the review, alongside the BAA, the subprocessor list and the audit trail.
Can I use an AI agent with de-identified data without a BAA?
Sometimes, but only if the data truly meets HIPAA's de-identification standard, through either expert determination or removal of the specified identifiers. The risk is that agents pick up identifiers from free text, attachments and logs that nobody intended to send.
Confirm de-identification happens before data reaches the agent, and have someone own that check, because a failure turns an exempt workflow into a reportable one.
Who is liable if an AI vendor leaks PHI?
Even when the leak occurs at a vendor, your organization stays accountable to patients and regulators. A signed BAA allocates responsibilities and gives you contractual recourse, but it doesn't transfer your duty to choose vendors carefully and limit what they receive.
Without a BAA, the exposure sits with you alone. Have counsel review indemnity and breach notification terms before go-live.
Is there an official HIPAA certification for AI tools?
No. The federal government doesn't certify or endorse software as HIPAA compliant, so any "HIPAA certified" badge is a vendor's own marketing claim or a third-party attestation with no regulatory standing.
What you can verify is the arrangement: the signed BAA, subprocessor coverage, access controls, audit logs and minimum necessary data. Buy that, and ask to see the documents.
Related reading
Build it
Set this up in minutes.
No code required. Connect your accounts, and Activepieces runs it from there.
Start free Talk to sales
