22 AI Agent Hipaa Control Pack

AI Agent HIPAA Security Rule Control Pack Skill

Use When

• Use when mapping a PHI-touching AI agent to HIPAA Security Rule safeguards, minimum-necessary access, BAA duties, evidence, testing, and breach handling. Use ISO 27001 or SOC 2 packs for those frameworks.

Do Not Use When

• Do not use for AI features that demonstrably do not touch PHI (synthetic-data demos, non-PHI workflows, marketing analytics on de-identified Safe-Harbor data). Do not use as the sole pack if EU patients are in-scope — pair with the AI Act and GDPR coverage. Do not relax the admin-only constraint for clinical PHI agents.
• Do not use this skill to fabricate missing project facts, legal conclusions, test results, approvals, or certification claims.

Required Inputs

Capability and permission boundaries

Default to read-only. Read and search access to the supplied artefacts are required. Editing is limited to an explicitly authorised requested draft or project files. Execute validation only when authorised; publishing, signature, certification, production mutation, destructive action, spending, and risk acceptance require explicit authority.

Degraded Mode

When files, tools, network, rendering, fonts, execution, or evidence are unavailable, return the narrowest useful qualified draft or finding set. Name every unavailable check and its consequence; an unassessed check is never a pass. Preserve evidence already gathered and provide the exact next verification step.

Decision Rules

Workflow

1. Confirm the requested artefact, audience, scope, decision owner, and applicable baseline or version. Work read-only by default; source mutation, publication, signature, certification, production change, or risk acceptance requires explicit authority.
2. Inspect every required input and record missing, stale, conflicting, or inaccessible evidence. Stop claims that depend on an unresolved required input.
3. Apply the Decision Rules, then execute the existing Core Instructions below in order; preserve project terminology and trace each material statement to its source.
4. Test the draft against the output acceptance conditions and domain quality standards. If a check cannot run, mark it not assessed and never convert it into a pass.
5. On failure, recover by preserving completed evidence, identifying the narrowest corrective action and owner, and rerunning only the affected checks before handoff.
6. Produce the named artefact and evidence record; publish, sign, certify, mutate production, or accept risk only under explicit authority.

Outputs

Evidence Produced

Quality Standards

• Every PHI-touching feature shall have a Security Rule treatment per standard and implementation specification (required/addressable). Clinical PHI agents shall be admin-only with no autonomous L1+ external-write tools touching PHI. Every audit control row shall reference the hash-chain action audit log. BAA addendum language shall be cited.
• Use deterministic acceptance conditions and preserve traceability from source to decision and output.
• Separate facts, inferences, assumptions, and approvals; never present one as another.
• Apply 28-anti-ai-slop during authoring and 29-ai-slop-audit at major checkpoints and release.

Anti-Patterns

• Producing AI Agent HIPAA Security Rule Control Pack from assumptions instead of named project sources. Fix: Cite the source or mark the item unverified.
• Treating a missing or inaccessible check as passed. Fix: Mark it not assessed, state impact, and block dependent claims.
• Using vague gates such as adequate, secure, or user-friendly. Fix: Replace each with an observable criterion, threshold, and evidence source.
• Copying a generic template without product, control, role, version, or jurisdiction detail. Fix: Ground every section in the supplied context and remove unused boilerplate.
• Publishing, signing, certifying, changing production, or accepting risk without authority. Fix: Prepare a draft and route the decision to the accountable owner.
• Listing evidence without provenance or an acceptance result. Fix: Record source, period, integrity check, mapping, and pass/fail/not-assessed status.

Worked Example

Example: if a control is applicable but evidence or test procedure is absent, record a gap; do not claim control effectiveness. Record the evidence and result in the validation record; this avoids unsupported assurance.

References

• Generation logic: load when creating the complete artefact.
• Skill notes: consult for local examples and invocation context.
• Repository operating rules: apply the engine's routing, evidence, and release gates.

Overview

The HIPAA Security Rule (45 CFR §164.302–§164.318) is the auditable control framework for PHI confidentiality, integrity, and availability. For an agentic SaaS, the rule's "workforce" concept extends to the agent service principal; the audit-control standard maps onto the agent action audit log; the integrity standard maps onto hash-chain or WORM; and the technical access-control standard maps onto per-tenant scope at the dispatcher.

The defining policy decision for clinical PHI agents is admin-only: a clinical PHI agent shall not act autonomously on external systems containing PHI. Every irreversible external-write tool touching PHI shall be gated by a named clinician approval event. This is the operationalisation of §164.312(a)(1) (Access Control) and §164.312(b) (Audit Controls) for agent systems handling clinical PHI.

Quick Reference

Core Instructions

Step 1: Classify every feature by PHI touch

Record the classification in HIPAA_PHI_Touch_Classification.md and reflect it in the action catalogue's phi_touch metadata field.

Step 2: §164.308 Administrative safeguards

Step 3: §164.310 Physical safeguards

Inherited from parent if no dedicated agent infrastructure. Cite inheritance.

Step 4: §164.312 Technical safeguards

Step 5: §164.316 Policies, procedures, and documentation

Step 6: Minimum-necessary application

The minimum-necessary rule (§164.502(b)) applies to the agent service principal:

• The agent shall not request PHI beyond what is required for the current task.
• The retrieval set returned to the agent shall be minimised by query-scoped filter and per-tenant scope.
• Audit log records the PHI fields touched per tool call.
• Quarterly review samples tool calls and verifies minimum-necessary compliance.

Step 7: BAA implications

• BAA addendum language for agent processing (see 26-ai-agent-baa-and-data-processing-language).
• Model provider BAA required if the provider processes PHI; alternatives:
  1. De-identify before model call (Safe Harbor or Expert Determination).
  2. Use provider with executed BAA and zero-retention configuration.
  3. Run model on-premise / on-tenant infrastructure within the covered entity's boundary.

Step 8: Breach notification

• §164.408 PHI breach notification: ≤ 60 days to affected individuals; immediate to HHS for ≥ 500 individuals.
• Agent breach scenarios: cross-tenant retrieval leak, prompt-injection-driven disclosure, audit-log integrity compromise, memory-tier leak.

Step 9: Write the pack

AI_Agent_HIPAA_Control_Pack.md sections: 1) PHI Touch Classification per Feature, 2) Admin-Only Constraint Statement, 3) Administrative Safeguards (§164.308), 4) Physical Safeguards (§164.310), 5) Technical Safeguards (§164.312), 6) Policies and Documentation (§164.316), 7) Minimum-Necessary Application, 8) BAA Implications, 9) Breach Notification Procedure, 10) Evidence and Audit Procedure, 11) Cross-Refs, 12) Sign-off Ledger.

Standards

• 45 CFR §164.302–§164.318 (HIPAA Security Rule)
• 45 CFR §164.400–§164.414 (Breach Notification Rule)
• 45 CFR §164.500–§164.534 (Privacy Rule, where the agent processes PHI for treatment, payment, operations)
• NIST SP 800-66 Rev. 2 (HIPAA Security Rule implementation)
• HHS OCR audit protocol
• HITRUST CSF (cross-link)

Resources

• logic.prompt, README.md, references/ai-agent-hipaa-control-matrix-template.md.