Yes, whenever they handle protected health information for a covered entity or business associate. HIPAA follows the data, not the technology. The platform and model provider behind such an agent will usually be business associates or their subcontractors, which means signed agreements, safeguards and limits on how the data is used.
What does HIPAA require, in plain words?
HIPAA protects individually identifiable health information held by covered entities: health plans, healthcare clearinghouses and healthcare providers that conduct certain transactions electronically. It also reaches business associates, the organisations that handle that information on a covered entity's behalf, and their subcontractors.
In substance, three sets of rules matter for agents. The privacy rules limit how protected health information may be used and disclosed, and generally require that only the minimum necessary is used for a purpose. The security rules require administrative, physical and technical safeguards for electronic health information, including access controls and audit controls. The breach rules require notification when unsecured health information is compromised. A covered entity must have a business associate agreement in place before a vendor handles that information for it.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Who does it apply to?
| Party | Usual position |
|---|---|
| Hospital, clinic or health plan deploying the agent | Covered entity |
| Agent platform processing health information for them | Business associate |
| Model provider receiving health information through the platform | Subcontractor business associate |
| Cloud host storing the data | Subcontractor business associate |
| A bank or insurer outside health plans, handling general customer data | Usually outside HIPAA, though other privacy laws apply |
Each link in the chain needs the right agreement. The detail is in HIPAA business associates and AI agent platforms.
What changes when the system is an agent?
Minimum necessary becomes a design rule. An agent decides what to read and what to pass to a model. If its access is broad, it will read more than a task needs, and every read is a use. Access must be set per capability: an agent checking claim codes does not need clinical notes. The guide on HIPAA minimum necessary and AI agent access covers how to set it.
Audit controls need to see the agent's actions. Who accessed which record, when and why, must be traceable, including when the "who" is an agent acting for a named team.
Model provider terms matter. Whether prompts containing health information are kept, and whether they may be used to improve models, must be settled in the agreement, not assumed.
How do you meet it?
| Requirement in substance | Control for an agent | Evidence it leaves |
|---|---|---|
| Business associate agreements | Signed through the chain: platform, model provider, host | Executed agreements |
| Minimum necessary | Field-level access per capability; only needed fields sent to the model | Access configuration; logs of fields sent |
| Access controls | Agent credentials scoped to its role; no shared accounts | Access grants |
| Audit controls | Every read and action filed with agent, capability and purpose | Filed verdicts |
| No unauthorised use | Contract bars provider use of data to train models | Contract clause |
| Breach response | Agent incidents feed your breach assessment process | Incident records |
| Workforce oversight | Named staff review the agent's outputs that affect patients | Review records |
What does that look like in practice?
Say a health plan deploys an agent to prepare prior authorisation files. It reads the request, the member's coverage and the relevant clinical criteria, and drafts a summary for a nurse reviewer, who decides.
The plan signs agreements with the platform and, through it, the model provider and host. The agent may read the request, the coverage record and the specific clinical documents attached, but not the member's full history. Member names are not sent to the model. Every read and draft is filed against the agent and the reviewer's team. The nurse makes every decision, and denials follow the plan's existing review process.
What does HIPAA not cover?
HIPAA does not certify an agent as safe or accurate, and it does not govern the quality of clinical decisions. It also does not replace state privacy laws or other federal rules. Management system standards such as ISO/IEC 42001 can help structure governance, but they are not a substitute for HIPAA compliance; see whether you need ISO/IEC 42001 to deploy AI agents.
The wider rules picture is in our guide to AI agent regulation.
Questions people ask
Can we avoid HIPAA by de-identifying data first?
Properly de-identified data falls outside HIPAA's protections. But de-identification has specific standards, and agents often need identifiable data to do the job, so it is rarely a complete answer.
Is a model provider always a business associate?
If it creates, receives, keeps or sends protected health information for you or your platform, it usually is. A provider that will not sign an agreement should not receive that data.
Does HIPAA apply to agents in a bank?
Generally not, unless the bank acts as a covered entity or business associate for health data. Financial privacy rules such as GLBA apply instead.