Framework / HIPAA

HIPAA wants an audit trail.
Your agents aren't in it.

45 CFR 164.312(b) requires audit controls over who accessed ePHI. Your EHR logs the humans; the autonomous agents touching FHIR resources are the gap. AIR records every agent action against ePHI, signed and attributable.

45 CFR 164.312(b)audit controlsePHIBAA

Book an agent audit See the evidence ↓

Per-agent · attributable · ePHI stays in your boundary

HIPAA audit · live

Agentnotes-summarizer-02

ePHI accessPatient/8841 · read

Authorized bydr.okafor · Auth0

Bulk exportblocked · SV-EXFIL

164.312(b) record · signed · anchored Rekor

✓ attributable · who, what, when

01The stakes

OCR inquiry · ePHI access review

An agent accessed ePHI. 164.312(b) wants the audit trail. Your EHR's stops at humans.

Audit logging is "addressable" today and routinely skipped for agents; the 2025 Security Rule NPRM would make it mandatory. Either way the autonomous agents are the uncovered gap, and AIR closes it with a signed, attributable record of every agent access.

02The rule

What 164.312(b) requires, stated straight.

164.312(b)

audit controls

Implement mechanisms that record and examine activity in systems containing ePHI. For humans your EHR does; for agents, it doesn't.

The forensic question: which agent touched which patient's record.

Addressable → mandatory

the 2025 NPRM

Today it's "addressable," and routinely skipped. The 2025 Security Rule NPRM would remove the addressable-vs-required split.

Proposed, not final — as of mid-2026 OCR has issued no final rule.

BAA

the contract

A vendor touching ePHI signs a Business Associate Agreement, with annual certification under the proposed rule.

Air-gapped AIR keeps the ePHI inside your boundary — nothing to phone home.

03How AIR answers

Every audit-control question, for the agent layer.

Which agent accessed which patient's ePHI?

MonitorPer-agent identity with DataSubjectRef / DataAssetRef on every action.

Under whose authority?

AccountBound to a named human via Auth0, Entra, Okta or SPIFFE.

Can you prove the record wasn't edited?

ProveBLAKE3 + Ed25519, anchored to a public log.

Does it satisfy 164.312(b)?

ReportRecords map to the audit-controls requirement.

Keep ePHI inside the boundary?

Air-gappedOn-prem deployment; the record never leaves.

04The evidence

The 164.312(b) record, for an autonomous agent.

A signed, attributable, timestamped record of an agent's ePHI access — who, what, when, under whose authority — verifiable independently and admissible under FRE 902(13)–(14).

See the healthcare view →

HIPAA 164.312(b) record · agdr/v2

Delegation · dr.okafor authorized notes-summarizer-02

Subject · DataSubjectRef = Patient/8841

Action · FHIR read — in scope, signed

Halt · bulk export blocked — SV-EXFIL

signed in-process · blake3 · ed25519 · anchored Rekor

✓ attributable · search.sigstore.dev

05What you get

The tiers HIPAA-covered teams choose.

Enterprise

most teams here

164.312(b) agent-layer audit records
Containment — halt agents before harm
Causal graph, query & replay
SIEM: Splunk · Datadog · Sentinel · Sumo
SSO / OIDC, SLA

Book an agent audit

Air-gapped

regulated · sovereign

Everything in Enterprise, plus

Signed BAA
HL7v2 / FHIR R4 interop
On-prem / offline anchoring
Admissibility Pack — FRE 902 + expert support

Talk to us

Put your agents in the audit trail.

A free agent audit shows exactly what 164.312(b) evidence you'd have for your agents today — nothing deployed, ePHI never leaves your boundary.

Book an agent audit →