HIPAA Healthcare

A compliance pack designed for healthcare AI agents handling Protected Health Information (PHI). Enforces strict PII/PHI detection, restricted memory classification, HASH-based audit redaction, and 7-year log retention aligned with HIPAA requirements.

Policy JSON

{
  "guard": {
    "pii_detection": {
      "enabled": true,
      "action": "DENY",
      "patterns": ["EMAIL", "PHONE", "SSN", "CREDIT_CARD", "ADDRESS", "DOB", "NAME", "MEDICAL_RECORD", "HEALTH_PLAN_ID", "DIAGNOSIS_CODE"],
      "redact_in_logs": true
    },
    "prompt_injection": {
      "enabled": true,
      "sensitivity": "high",
      "action": "DENY",
      "log_attempts": true
    },
    "content_moderation": {
      "enabled": true,
      "threshold": 0.5,
      "categories": ["hate", "violence", "sexual", "self_harm", "dangerous_content"],
      "action": "DENY"
    }
  },
  "secrets": {
    "enabled": true,
    "confidence_threshold": 0.7,
    "categories": ["api_keys", "tokens", "passwords", "cloud_secrets", "certificates"],
    "actions": {
      "critical": "DENY",
      "high": "DENY",
      "medium": "DENY"
    }
  },
  "memory": {
    "classification": "restricted",
    "enforce_read_governance": true,
    "scopes": {
      "global": { "classification_required": "public" },
      "shared": { "classification_required": "public" },
      "user": { "classification_required": "restricted" },
      "session": { "classification_required": "restricted" }
    },
    "deny_secrets_in_memory": true,
    "deny_pii_in_memory": true,
    "purge_on_session_end": true
  },
  "registry": {
    "models": ["gpt-4o", "claude-3-5-sonnet"],
    "strict": true,
    "tools": ["patient_lookup", "medical_reference", "appointment_schedule"],
    "deny_unlisted": true,
    "verify_provenance": true,
    "require_hash": true
  },
  "cost": {
    "budget": {
      "daily": 100.00,
      "action_on_exceed": "DENY",
      "alert_threshold": 0.7
    },
    "per_request_limit": 5.00,
    "action_on_exceed": "DENY"
  },
  "reliability": {
    "circuit_breaker": {
      "failure_threshold": 3,
      "reset_timeout_ms": 60000,
      "half_open_max_attempts": 1
    },
    "retry": {
      "max_retries": 2,
      "backoff": "exponential",
      "max_backoff_ms": 3000,
      "action_on_exhausted": "DENY"
    }
  },
  "audit": {
    "enabled": true,
    "log_decisions": true,
    "log_evidence": true,
    "redact_pii": true,
    "redaction_method": "HASH",
    "retention_days": 2555,
    "export_format": "SARIF",
    "include_correlation_ids": true
  }
}

policy = {
    "guard": {
        "pii_detection": {
            "enabled": True,
            "action": "DENY",
            "patterns": [
                "EMAIL", "PHONE", "SSN", "CREDIT_CARD", "ADDRESS",
                "DOB", "NAME", "MEDICAL_RECORD", "HEALTH_PLAN_ID", "DIAGNOSIS_CODE",
            ],
            "redact_in_logs": True,
        },
        "prompt_injection": {
            "enabled": True,
            "sensitivity": "high",
            "action": "DENY",
            "log_attempts": True,
        },
        "content_moderation": {
            "enabled": True,
            "threshold": 0.5,
            "categories": ["hate", "violence", "sexual", "self_harm", "dangerous_content"],
            "action": "DENY",
        },
    },
    "secrets": {
        "enabled": True,
        "confidence_threshold": 0.7,
        "categories": ["api_keys", "tokens", "passwords", "cloud_secrets", "certificates"],
        "actions": {"critical": "DENY", "high": "DENY", "medium": "DENY"},
    },
    "memory": {
        "classification": "restricted",
        "enforce_read_governance": True,
        "scopes": {
            "global": {"classification_required": "public"},
            "shared": {"classification_required": "public"},
            "user": {"classification_required": "restricted"},
            "session": {"classification_required": "restricted"},
        },
        "deny_secrets_in_memory": True,
        "deny_pii_in_memory": True,
        "purge_on_session_end": True,
    },
    "registry": {
        "models": ["gpt-4o", "claude-3-5-sonnet"],
        "strict": True,
        "tools": ["patient_lookup", "medical_reference", "appointment_schedule"],
        "deny_unlisted": True,
        "verify_provenance": True,
        "require_hash": True,
    },
    "cost": {
        "budget": {"daily": 100.00, "action_on_exceed": "DENY", "alert_threshold": 0.7},
        "per_request_limit": 5.00,
        "action_on_exceed": "DENY",
    },
    "reliability": {
        "circuit_breaker": {
            "failure_threshold": 3,
            "reset_timeout_ms": 60000,
            "half_open_max_attempts": 1,
        },
        "retry": {
            "max_retries": 2,
            "backoff": "exponential",
            "max_backoff_ms": 3000,
            "action_on_exhausted": "DENY",
        },
    },
    "audit": {
        "enabled": True,
        "log_decisions": True,
        "log_evidence": True,
        "redact_pii": True,
        "redaction_method": "HASH",
        "retention_days": 2555,
        "export_format": "SARIF",
        "include_correlation_ids": True,
    },
}

What It Does

PHI Detection — Scans for 10 PHI/PII patterns including medical records, health plan IDs, and diagnosis codes
DENY on PHI — Blocks requests containing PHI rather than redacting (HIPAA requires preventing unauthorized disclosure)
Restricted Classification — All memory scopes require restricted classification for PHI data
HASH Redaction — Audit logs use SHA-256 hashing for PII so records can be correlated without exposing PHI
7-Year Retention — 2,555-day audit retention aligned with HIPAA’s 6-year minimum (plus buffer)
SARIF Export — Structured audit export for compliance reporting and incident investigation
Provenance Verification — Hash-based model verification to ensure approved models are in use

HIPAA Control Mapping

HIPAA Requirement	TealEngine Coverage
§164.312(a) — Access Control	`registry` — model/tool allowlists, strict mode
§164.312(b) — Audit Controls	`audit` — full decision logging, SARIF export
§164.312(c) — Integrity	`registry.verify_provenance` — model integrity checks
§164.312(d) — Authentication	`registry.strict` — deny unlisted models/tools
§164.312(e) — Transmission Security	`guard.pii_detection` — PHI detection and denial
§164.530(j) — Retention	`audit.retention_days: 2555` — 7-year retention

Install

# Install the HIPAA compliance pack
tealtiger policy install --pack hipaa-healthcare

# Or copy the JSON above into your tealtiger.config.json

Customize

Setting	Default	Adjust For
`guard.pii_detection.patterns`	10 patterns	Add custom PHI patterns for your domain
`registry.tools`	3 healthcare tools	Match your agent’s actual tool set
`audit.retention_days`	`2555` (7 years)	Increase if your organization requires longer retention
`cost.budget.daily`	`100.00`	Match your healthcare application’s budget

This pack provides a strong technical foundation for HIPAA compliance but does not replace a formal HIPAA risk assessment. Work with your compliance officer and legal team to validate the configuration meets your specific Covered Entity or Business Associate requirements.

OWASP ASI Starter — Broader security baseline
Healthcare Agent Starter — Use-case-specific configuration
PII Redaction — Basic — Simpler PII handling for non-healthcare
TealAudit Documentation — Full audit API reference

Getting Started

Core Concepts

Governance Domains

Policy Authoring

Architecture

Integrations

Deployment

API Reference

Cookbook

Compliance & GRC

Guides

Reference

Versions

Playground

Dashboard

Blog

Policy JSON

What It Does

HIPAA Control Mapping

Install

Customize

​Policy JSON

​What It Does

​HIPAA Control Mapping

​Install

​Customize

​Related

Policy JSON

What It Does

HIPAA Control Mapping

Install

Customize

Related