The technical implementation guide for HIPAA-compliant AI in healthcare — mapping §164.312 safeguards to Aegis checkpoints, PHI detection in prompts and outputs, zero-retention mode, BAA requirements for LLM providers, and the audit evidence package.
Healthcare organisations deploying AI faced a new category of HIPAA risk the moment they connected an LLM to a system that processes Protected Health Information. The problem is not the model itself — it is what happens to PHI once it enters an LLM's context. PHI that enters a prompt may appear in outputs (a leakage risk), be retained in model memory across sessions (a retention risk), propagate to downstream agents in a multi-agent pipeline (a disclosure risk), or be transmitted to the LLM provider's API (a BAA requirement trigger). None of these pathways were contemplated in the original HIPAA Security Rule, written in 2003 — long before LLMs existed. Healthcare AI teams are implementing HIPAA technical safeguards in a regulatory gap, applying existing rules to a technology the rules weren't designed for.
This guide maps the specific §164.312 technical safeguard requirements to the AIZA-HexTyx controls that satisfy them. The general healthcare AI security context: Healthcare AI Security: HIPAA-Compliant LLM Deployment →
The HIPAA Security Rule's technical safeguards (§164.312) are organised into five categories. Each has specific implications for AI systems that traditional security programs did not need to address:
§164.312(a) — Access Control: Unique user identification, automatic logoff, encryption and decryption. For AI systems, this means: every AI interaction must be attributable to an authenticated user (session_id in the Aegis audit log satisfies unique user identification); session timeout must be enforced at the AI layer (not just the application layer); PHI in prompts and retrieved content must be encrypted at rest and in transit (standard TLS + database encryption covers transit; storage encryption covers rest).
§164.312(b) — Audit Controls: Hardware, software, and procedural mechanisms to record and examine activity in information systems containing ePHI. The Aegis audit log is the primary technical control satisfying this requirement: every prompt, every response, every tool call, every security decision — logged in immutable JSONL with SHA-256 per-record integrity hashing. The audit log includes session_id (user attribution), timestamp_iso (time of access), action (what happened), and finding_types (any security events).
§164.312(c) — Integrity: Mechanisms to authenticate ePHI and protect it from improper alteration or destruction. The SHA-256 integrity hash on each audit record serves as an integrity control for logged ePHI interactions. For RAG pipelines, Aegis CP2's chunk provenance tracking ensures retrieved ePHI chunks have verified origin — the same mechanism that prevents RAG poisoning also satisfies the integrity safeguard for retrieved ePHI.
§164.312(d) — Person or Entity Authentication: Verification of identity before allowing access. For AI systems with tool access to EHR data, Aegis CP3's IDOR check (caller_id vs requested patient_id) is the technical implementation of entity authentication at the AI layer — preventing an AI agent from accessing one patient's records while authenticated as a different patient or clinician.
§164.312(e) — Transmission Security: Guard against unauthorized access to ePHI transmitted over electronic communications networks. All Aegis-to-hextyx and hextyx-to-Anthropic API communication occurs over TLS 1.3. Zero-retention mode ensures ePHI is not persisted in the Aegis audit record when configured — satisfying the minimum necessary standard for transmission security.
The most immediate technical challenge: preventing PHI from appearing in AI outputs where it shouldn't. Aegis CP4's 13 secret pattern types cover API keys and credentials — but healthcare deployments need extended PHI pattern detection applied alongside the standard secret patterns.
PHI categories requiring detection in AI outputs: patient name + date of birth combinations (linkability risk), medical record numbers (direct identifier), diagnosis codes + patient identifiers (combination risk), medication records + patient identifiers, Social Security Numbers (frequently co-located in EHR data), and insurance member IDs.
Configure Aegis CP4 for healthcare by extending the DANGEROUS_PATTERNS list with PHI-specific regex patterns. The same auto-redaction mechanism that prevents credential leakage applies to PHI: the pattern match triggers redaction before the response reaches the client, and the finding is logged as phi_leak (critical severity) for the audit record.
Zero-retention mode is the strongest PHI protection available in Aegis. When AEGIS_ZERO_RETENTION=true, no prompt or response content is stored in the audit log — only metadata (action, risk_score, finding_types, session_id, timestamp). This satisfies the HIPAA minimum necessary standard for AI audit records: you maintain evidence that monitoring occurred and what decisions were made, without retaining the PHI content itself.
Any LLM provider that receives PHI — including PHI that inadvertently appears in prompts — is a Business Associate under HIPAA and requires a signed Business Associate Agreement (BAA). This is the requirement most healthcare AI deployments get wrong: they sign a BAA with their EHR vendor but forget that the Anthropic API receives prompt content that may include PHI.
AIZA-HexTyx's architecture mitigates this in two ways: the Playground proxy (/playground/analyse) ensures the Anthropic API key never exists in the browser, and zero-retention mode at the Aegis layer can be configured to strip PHI from prompts before they reach the Anthropic API. However, neither of these eliminates the BAA requirement if PHI reaches the API at all — they only reduce the risk of PHI transmission. Healthcare organisations must: obtain a BAA from Anthropic for any deployment where PHI may reach the Anthropic API, document the PHI handling practices in the BAA, and implement technical controls (PHI detection, prompt sanitisation) to minimise PHI transmission.
Anthropic offers a BAA for eligible enterprise customers. Verify the BAA covers AXIOM, the LLM evaluator, and the Playground proxy — all three use the Anthropic API. The compliance audit framework: EU AI Act Requirements & Checklist: Complete Enterprise Compliance Guide →
RAG pipelines that retrieve from EHR data sources require the most careful PHI governance. Every retrieved chunk may contain PHI, and the chunk enters the model's context as "trusted information." The security controls required:
Access control at the retrieval layer: The user authenticated to the AI application should only be able to retrieve chunks from EHR records they are authorised to access. This requires integrating the retrieval query with the healthcare organisation's role-based access control system — clinicians retrieve their patients' records, not all records.
Aegis CP2 for retrieved PHI: Every retrieved chunk must be validated before entering the model context — both for injection content (adversarial instructions) and for PHI that should not appear in a given retrieval context. The same checkpoint that blocks RAG poisoning also provides the audit trail for PHI access in retrieved content.
Minimum necessary standard in retrieval: HIPAA's minimum necessary standard applies to AI retrieval as it does to any other PHI access. Configure retrieval queries to return only the PHI fields necessary for the specific AI task — not full patient records when a specific data element is needed.
The SOC2 for AI evidence package that supports HIPAA audit readiness: SOC2 for AI Products: Practical Guide for LLM Platforms →
The agentic runtime governance guide that covers the ongoing PHI protection controls: AI Autonomous Agentic Runtime Governance: Complete Enterprise Control Guide →
The runtime monitoring guide for production PHI protection: AI Agents Behavior Monitoring and Runtime Protection →
Run a scan and export the §164.312 compliance evidence — audit log export, PHI detection coverage, access control test results, and integrity verification for HIPAA audit readiness.
Generate HIPAA Evidence Package →