An AI agent platform is a HIPAA business associate if it creates, receives, keeps or sends protected health information while performing a service for a covered entity. Almost every platform used on patient or member data qualifies. You need a business associate agreement before PHI flows, and the platform needs matching agreements with its own sub-contractors, including the model provider.
What does HIPAA require of business associates?
A business associate is a person or organisation that performs functions or services for a covered entity, or for another business associate, involving the use or disclosure of protected health information. Examples include billing firms, claims processors, cloud hosts that store PHI, and analytics providers.
HIPAA requires, in substance:
- a written business associate agreement between the covered entity and the business associate before PHI is shared;
- the business associate may only use and disclose PHI as the agreement permits or as the law requires;
- the business associate must comply with the security rule for electronic PHI;
- it must report breaches and security incidents to the covered entity;
- it must pass the same restrictions down to any sub-contractor that handles PHI, through its own agreement;
- it is directly liable for certain violations, not only through contract.
There is a narrow exception for pure conduits that only transmit data and do not store it beyond a transient basis. An agent platform does far more than transmit, so the exception does not help.
Who does it apply to?
Covered entities choosing an agent platform, the platform vendor, and every sub-contractor in the chain that touches PHI. If you are already unsure whether HIPAA reaches your deployment, start with do AI agents need to comply with HIPAA.
Why are agent platforms a harder business associate case?
A billing firm has a defined job. An agent platform's job is defined by the agents you build on it, and those change. That creates four issues the agreement must anticipate.
The permitted uses are moving. The agreement should not list today's agents. It should tie permitted uses to your documented instructions, meaning the agent briefs you approve, so new agents are covered and unapproved uses are not.
The chain is long. A platform typically uses a hosting provider and a model provider, and sometimes speech, search or document services. Each that handles PHI is a sub-contractor and needs its own agreement with the platform carrying equivalent restrictions.
Vendor reuse is tempting. Conversation data is valuable for improving agents. A business associate may use PHI for its own management and administration in limited ways, but it may not use your patients' data to build products for others. De-identification for such use must be authorised in the agreement and done to HIPAA's standard.
Logs are PHI too. Prompts, outputs, traces and evaluation sets all contain PHI. They must be within the agreement's protections, retention terms and return-or-destroy obligations.
What must the agreement cover?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Permitted uses and disclosures | Uses limited to performing your instructions as set out in approved agent briefs | Agreement clause; brief version history |
| No use for the vendor's own products | Express bar on training models or building benchmarks with your PHI | Agreement clause; vendor attestation |
| Security rule compliance | Vendor maintains administrative, physical and technical safeguards | Security documentation; independent reports |
| Breach and incident reporting | Defined timelines and content for notifying you | Agreement clause; incident notices |
| Sub-contractors bound | Written agreements with each sub-contractor handling PHI | Sub-contractor list; flow-down confirmation |
| Patient rights support | Vendor helps locate PHI for access, amendment and accounting | Request responses |
| Minimum necessary | Vendor and agents access only what the task needs | Access configuration |
| Return or destruction | All PHI, including logs and evaluation data, returned or destroyed at end | Destruction certificate |
| Access to records | Vendor makes records available to the regulator when required | Agreement clause |
The minimum necessary row deserves its own design work; see HIPAA minimum necessary and AI agent access. For what the agreement sits within, see HIPAA and AI agents handling protected health information.
What should due diligence look like before signing?
The agreement states promises. Due diligence checks whether they can be kept. Ask the platform to show, not describe, how PHI moves: which services receive it, where they are, how long each keeps it, and whether any can be switched off for your account. Our vendor due diligence questionnaire for AI agent platforms gives a full question set.
What will an auditor or investigator ask?
- Do you have a signed agreement with every vendor whose agents touch PHI?
- Who are the platform's sub-contractors, and do they have agreements?
- Does any party use your PHI to train or improve models?
- How long does each party retain prompts, outputs and logs?
- How quickly would the platform tell you about a breach, and has it ever?
- What happens to PHI held in evaluation sets when the contract ends?
What does the business associate relationship not cover?
It does not move your obligations to the vendor; you remain responsible as the covered entity. It does not decide whether a given use of PHI is permitted; you do. It does not address cybersecurity duties under other regimes; an EU-facing vendor may also need to consider whether NIS2 applies to AI agent platforms. For the full set of rules, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Pryme Intelligence never updates model weights for a customer. Qualification changes an agent's brief, sources, bounds and certification, which keeps a covered entity's data out of the vendor's own purposes. Agent briefs are versioned, so the instructions in force on any date can be produced, and every verdict is filed in an append-only record for audit.
Questions people ask
Is a model provider that never stores prompts still a sub-contractor?
If it receives PHI to perform part of the service, it is generally treated as a sub-contractor, even if retention is short. The conduit exception is for transmission services, not for processing that reads and responds to the data.
Can we use a platform's standard agreement?
You can, if it covers everything above. Check especially the clauses on use for the vendor's own purposes, sub-contractors and logs. Standard agreements written for storage services often miss how agents use data.
Does an agent platform used only by our staff, never patients, need an agreement?
Yes, if the agents handle PHI. Business associate status depends on access to PHI in performing a service, not on whether patients interact with the system.