Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Towards a HIPAA Compliant Agentic AI System in Healthcare

Subash Neupane, Sudip Mittal, Shahram Rahimi

TL;DR

The paper tackles the regulatory challenge of deploying autonomous agentic AI in healthcare under HIPAA. It proposes a HIPAA-compliant framework that combines Attribute-Based Access Control (ABAC), a hybrid PHI sanitization pipeline, and immutable audit trails to enforce data governance throughout AI-driven clinical workflows. Key contributions include the integration of ABAC with dynamic policy enforcement, a PHI redaction strategy combining rule-based and model-based techniques, and an auditable, retention-compliant logging system. The work demonstrates preliminary PHI detection/sanitization performance and policy enforcement efficiency on MIMIC-IV data, highlighting the potential for safer, compliant AI-assisted healthcare operations.

Abstract

Agentic AI systems powered by Large Language Models (LLMs) as their foundational reasoning engine, are transforming clinical workflows such as medical report generation and clinical summarization by autonomously analyzing sensitive healthcare data and executing decisions with minimal human oversight. However, their adoption demands strict compliance with regulatory frameworks such as Health Insurance Portability and Accountability Act (HIPAA), particularly when handling Protected Health Information (PHI). This work-in-progress paper introduces a HIPAA-compliant Agentic AI framework that enforces regulatory compliance through dynamic, context-aware policy enforcement. Our framework integrates three core mechanisms: (1) Attribute-Based Access Control (ABAC) for granular PHI governance, (2) a hybrid PHI sanitization pipeline combining regex patterns and BERT-based model to minimize leakage, and (3) immutable audit trails for compliance verification.

Towards a HIPAA Compliant Agentic AI System in Healthcare

TL;DR

The paper tackles the regulatory challenge of deploying autonomous agentic AI in healthcare under HIPAA. It proposes a HIPAA-compliant framework that combines Attribute-Based Access Control (ABAC), a hybrid PHI sanitization pipeline, and immutable audit trails to enforce data governance throughout AI-driven clinical workflows. Key contributions include the integration of ABAC with dynamic policy enforcement, a PHI redaction strategy combining rule-based and model-based techniques, and an auditable, retention-compliant logging system. The work demonstrates preliminary PHI detection/sanitization performance and policy enforcement efficiency on MIMIC-IV data, highlighting the potential for safer, compliant AI-assisted healthcare operations.

Abstract

Agentic AI systems powered by Large Language Models (LLMs) as their foundational reasoning engine, are transforming clinical workflows such as medical report generation and clinical summarization by autonomously analyzing sensitive healthcare data and executing decisions with minimal human oversight. However, their adoption demands strict compliance with regulatory frameworks such as Health Insurance Portability and Accountability Act (HIPAA), particularly when handling Protected Health Information (PHI). This work-in-progress paper introduces a HIPAA-compliant Agentic AI framework that enforces regulatory compliance through dynamic, context-aware policy enforcement. Our framework integrates three core mechanisms: (1) Attribute-Based Access Control (ABAC) for granular PHI governance, (2) a hybrid PHI sanitization pipeline combining regex patterns and BERT-based model to minimize leakage, and (3) immutable audit trails for compliance verification.

Paper Structure

This paper contains 15 sections, 4 equations, 4 figures, 3 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Background
  3. Health Insurance Portability and Accountability Act (HIPAA)
  4. Core Components of HIPAA
  5. Agentic AI Systems in Healthcare
  6. Attribute-Based Access Control (ABAC)
  7. HIPAA Compliant Agentic AI Framework
  8. Access Control
  9. Middleware Agent
  10. Post-Inference Redaction Agent
  11. Audit Agent
  12. Preliminary Results
  13. Dataset
  14. Evaluation
  15. Discussion, Futurework & Conclusion

Figures (4)

  • Figure 1: A graphical overview of the HIPAA-compliant Agentic framework. [...] (used for brevity) indicates that there are more data modalities and downstream tasks.
  • Figure 2: An example of PHI identifiers that requires protection based on HIPAA Safe Harbor rule § 164.514(b)(2).
  • Figure 3: Architecture of the HIPAA-compliant Agentic AI Framework for Clinical Workflows. The system integrates dynamic Attribute-Based Access Control (ABAC), hybrid PHI sanitization, and immutable audit trails to enforce compliance across autonomous data interactions in healthcare settings.
  • Figure 4: An example of unstructured discharge summary. --- represent anynomized PHI entities and [...] is used for brevity of textual contents.