HIPAA-aligned controls for AI agents touching PHI

A connector into email, a helpdesk, or a warehouse can pull protected health information into an agent's context. These policies support HIPAA-aligned minimum-necessary, access, and de-identification controls on the MCP path.

For: Security and compliance owners exposing PHI-adjacent systems to AI

HIPAA's minimum-necessary rule asks that a workforce member — or an agent acting as one — touch only the PHI the task requires. An MCP connector ignores that by default: ask an agent to "summarize this patient thread" and it can pull an entire mailbox, a full support history, or a warehouse table into its context. The gateway is where the agent channel gets narrowed back to need-to-know.

These policies support alignment with the minimum-necessary and access controls (§164.502(b), §164.514(d), §164.312(a)) on that channel. cap-bulk-export clamps how many records a single call returns, so a summary request can't become a bulk pull. redact-pii-egress masks identifier patterns in responses before they reach the model. redact-conversation-pii does the same for support conversations, and guard-dm-privacy fences private-channel reads to an authorized group. Each decision lands in the audit log, which supports the §164.312(b) audit-control expectation.

Be candid about the boundary: this is coverage on the MCP path only. It is not a BAA, it does not encrypt anything at rest or in transit, and it does not certify de-identification. The web UI, the native API, retention, and the physical safeguards are all still yours to handle. The hipaa bundle collects the agent-channel policies; treat it as one input to a HIPAA program, not the program.