What HIPAA expects.
What an AI Actor brings.
The HIPAA Security Rule expects covered entities to maintain audit controls that record activity in systems containing electronic Protected Health Information. AI agents now sit inside those systems. The record an agent produces about itself is structurally insufficient under that expectation — which is the gap an AI Actor exists to close.
A short framing
HIPAA, briefly.
The Health Insurance Portability and Accountability Act of 1996 establishes federal protections for individuals' health information held by covered entities and their business associates. Two regulations operationalise it: the Privacy Rule, which governs how Protected Health Information (PHI) is used and disclosed, and the Security Rule, which sets administrative, physical, and technical safeguards for electronic PHI (ePHI). The Breach Notification Rule completes the trio.
The Security Rule is the part that matters most for AI agent observability. It is organised into three families of safeguards. The technical safeguards include access controls under §164.312(a), audit controls under §164.312(b), integrity controls under §164.312(c), person or entity authentication under §164.312(d), and transmission security under §164.312(e).
Covered entities are health plans, health-care clearinghouses, and health-care providers who transmit health information electronically. Business associates are organisations that perform functions on behalf of covered entities involving the use or disclosure of PHI. Both categories have obligations directly; business associates must sign a Business Associate Agreement (BAA) with each covered entity they serve.
AI agents acting on behalf of a covered entity — triaging messages, summarising charts, suggesting referrals, drafting patient communications — typically sit in a Business Associate role with respect to the covered entity. The infrastructure that records those agents sits one layer further out, as a subcontractor Business Associate.
The relevant clause
§164.312(b) Audit controls.
The clause that turns audit logging from a nice-to-have into a required technical safeguard for electronic PHI.
45 CFR §164.312(b)
Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.
Read literally, this is what an Actor produces. Hardware or software — Trustvice is software. Mechanisms that record activity — every consequential agent action lands in the Witness surface, hash-chained and append-only. Mechanisms that examine activity — Council, Historian, Conscience, and Custodian each provide a different examination surface over the same record.
The Office for Civil Rights has historically declined to prescribe what specific data must be logged, in recognition that "appropriate" varies by system. The Actor's posture is to capture every consequential decision — what the agent decided, what alternatives it considered, what rules were in force at the time, who reviewed the output, and who later accessed the record. The bar is set higher than HIPAA's floor because the same record format also serves the EU AI Act, TRAIGA, and audit scenarios in regulated industries beyond healthcare.
Roadmap posture
What the HIPAA-eligible workspace will offer.
The list below describes the eventual shape of the HIPAA-eligible Trustvice workspace. None of these items are generally available today. The page does not state a timeframe; it states a destination.
Signed BAA.
A Business Associate Agreement executed with each covered-entity customer or upstream business-associate customer, covering Trustvice's role as a subcontractor business associate. Standard terms first; customer-specific addenda negotiable.
Technical safeguards mapped to the Security Rule.
Access controls under §164.312(a) implemented via the workspace permission model and SSO. Integrity controls under §164.312(c) via the hash-chain record format. Person/entity authentication under §164.312(d). Transmission security under §164.312(e) via TLS 1.3 with no downgrade.
Audit controls — first-class.
§164.312(b) is the surface the Actor was designed for. The same Witness, Custodian, and Conscience records that serve EU AI Act Article 12 obligations cover the audit-controls expectation under HIPAA. No bolt-on, no parallel logging system.
Documented controls map & gap assessment.
A current controls map cross-walking Trustvice's technical implementation to the Security Rule, the Privacy Rule's minimum-necessary standard, and the Breach Notification Rule. Available to HIPAA-eligible customers under NDA as soon as it is published internally.
Subprocessor posture.
Every Trustvice subprocessor in the HIPAA-eligible deployment path will be HIPAA-eligible or behind a signed BAA. The published subprocessor list will flag HIPAA-eligible entries explicitly so customers can perform their own Transfer Impact Assessment if needed.
Breach Notification Rule alignment.
Incident-response workflow tuned to the 60-day notification window required of business associates after discovery of a breach, with a documented runbook covering identification, scoping, customer notification, and the Custodian-side records that travel with the incident report.
Current status — honest version
Trustvice is not yet a HIPAA-eligible data processor. We do not currently sign BAAs. Customers in healthcare contexts can still use Trustvice today — they just need to keep PHI out of the records that flow into Trustvice, either by not using the Actor for PHI-handling agents or by configuring the Actor's scrubbing rules to redact PHI before persistence. The product page above describes the destination, not the present.
Stay in the loop
Be the first to know when it opens.
Leave your email and we will reach out when the HIPAA-eligible workspace tier becomes generally available. Double opt-in — you will receive a confirmation email before being added to the notification list, and no other marketing will be sent to this address.
This page is informational and does not constitute legal advice or a representation of current product compliance status. HIPAA-covered entities should consult their own compliance counsel before adopting any AI agent observability platform. References to HIPAA clauses describe the law as published; obligations under HIPAA rest with the entities the law applies to. Legal.
Trustvice 360Declare the rules. Have every run checked.
Agents, evidence, governance, commerce and disclosure are all in Trustvice 360. Sign up free and open every suite from one dashboard.