Towards a HIPAA Compliant Agentic AI System in Healthcare

2025-04-24

AI Summary

Large language models (LLMs) deployed in clinical settings face significant HIPAA compliance challenges when processing protected health information (PHI), particularly regarding data access control, real-time de-identification, and auditable accountability. Method: We propose the first end-to-end autonomous agent framework for clinical AI compliance, featuring a dynamic context-aware policy engine that integrates attribute-based access control (ABAC), hybrid PHI de-identification (combining regex-based pattern matching with a fine-tuned BERT model), and a blockchain-inspired immutable audit trail. Contribution/Results: Unlike static rule-based approaches, our framework enables fine-grained, real-time, and verifiable compliance decisions. Empirical evaluation demonstrates substantial reduction in PHI leakage risk and full adherence to HIPAA’s technical and administrative safeguards. The system provides a production-ready, auditable, and scalable compliance infrastructure for LLM-powered clinical applications—including automated report generation and clinical note summarization—thereby bridging a critical gap between AI innovation and regulatory requirements.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Humans and AI: AI for Accessibility
• Natural Language Processing: (Large) Language Models

Application Category

• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions
• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information
• User Modeling, Personalization and Recommendation: Large Language Models (LLM) for user modeling and recommendation

Abstract

Agentic AI systems powered by Large Language Models (LLMs) as their foundational reasoning engine, are transforming clinical workflows such as medical report generation and clinical summarization by autonomously analyzing sensitive healthcare data and executing decisions with minimal human oversight. However, their adoption demands strict compliance with regulatory frameworks such as Health Insurance Portability and Accountability Act (HIPAA), particularly when handling Protected Health Information (PHI). This work-in-progress paper introduces a HIPAA-compliant Agentic AI framework that enforces regulatory compliance through dynamic, context-aware policy enforcement. Our framework integrates three core mechanisms: (1) Attribute-Based Access Control (ABAC) for granular PHI governance, (2) a hybrid PHI sanitization pipeline combining regex patterns and BERT-based model to minimize leakage, and (3) immutable audit trails for compliance verification.

Problem

• Ensuring HIPAA compliance in Agentic AI for healthcare
• Protecting PHI with dynamic policy enforcement
• Integrating ABAC and PHI sanitization for data security

Innovation

• Dynamic context-aware policy enforcement for HIPAA
• ABAC for granular PHI governance
• Hybrid PHI sanitization with regex and BERT