Comply · United States
HIPAA — health information privacy
US health-information privacy and security for AI touching PHI.
HIPAA governs the privacy and security of protected health information (PHI) in the United States. When an AI agent processes, stores, or transmits PHI, HIPAA's Privacy and Security Rules apply — requiring safeguards, minimum-necessary use, access controls, audit controls, and business-associate agreements.
Who it applies to
Covered entities (healthcare providers, plans, clearinghouses) and their business associates whose AI systems handle PHI.
Key obligations
- Apply administrative, physical, and technical safeguards to PHI
- Enforce minimum-necessary access
- Maintain audit controls and access logging
- Execute Business Associate Agreements with AI vendors
- Support breach detection and response
How Maetra maps agents to HIPAA
Maetra's Secure module detects PHI and sensitive-health data leaving an agent, Comply tracks HIPAA controls and evidence per agent, and Audit provides the access and decision logs HIPAA expects.
In practice, Maetra:
- Scans and fingerprints each agent. Discover reads the agent’s code — its tools, data access and sensitivity, actions, model, and environment — into an evidence-backed profile tied to the exact file and commit.
- Decides what applies. That profile determines whether HIPAA is in scope for the agent and which of its requirements apply.
- Auto-detects controls and surfaces gaps. Controls your code already satisfies are detected automatically from the scan; the rest become a clear list of gaps, each tied to the requirement and the evidence it still needs.
- Proves it and keeps it current. Close gaps with linked evidence or generated documents — reused across every framework the same control supports — and Maetra re-checks on each rescan and flags evidence that has gone stale.
Related frameworks
Prove HIPAA compliance with Maetra
Classify your AI agents once and Maetra maps them to HIPAA and every other framework it supports — generating the evidence and documentation, tracking gaps and deadlines, and sealing every decision in an immutable audit trail.