Policy JSON
{
"guard": {
"pii_detection": {
"enabled": true,
"action": "DENY",
"patterns": ["EMAIL", "PHONE", "SSN", "CREDIT_CARD", "ADDRESS", "DOB", "NAME", "MEDICAL_RECORD", "HEALTH_PLAN_ID", "DIAGNOSIS_CODE", "PRESCRIPTION_ID", "LAB_RESULT"],
"redact_in_logs": true
},
"prompt_injection": {
"enabled": true,
"sensitivity": "high",
"action": "DENY",
"log_attempts": true
},
"content_moderation": {
"enabled": true,
"threshold": 0.5,
"categories": ["hate", "violence", "sexual", "self_harm", "dangerous_content"],
"action": "DENY"
}
},
"secrets": {
"enabled": true,
"confidence_threshold": 0.7,
"categories": ["api_keys", "tokens", "passwords", "cloud_secrets", "certificates"],
"actions": {
"critical": "DENY",
"high": "DENY",
"medium": "DENY"
}
},
"memory": {
"classification": "restricted",
"enforce_read_governance": true,
"scopes": {
"global": { "classification_required": "public" },
"shared": { "classification_required": "public" },
"user": { "classification_required": "restricted" },
"session": { "classification_required": "restricted" }
},
"deny_secrets_in_memory": true,
"deny_pii_in_memory": true,
"purge_on_session_end": true
},
"registry": {
"models": ["gpt-4o", "claude-3-5-sonnet"],
"strict": true,
"tools": ["patient_lookup", "medical_reference", "appointment_schedule", "lab_results", "prescription_check", "clinical_guidelines"],
"deny_unlisted": true,
"verify_provenance": true,
"require_hash": true
},
"cost": {
"budget": {
"daily": 200.00,
"action_on_exceed": "DENY",
"alert_threshold": 0.7
},
"per_request_limit": 5.00,
"action_on_exceed": "DENY",
"estimate_before_execution": true
},
"reliability": {
"circuit_breaker": {
"failure_threshold": 3,
"reset_timeout_ms": 60000,
"half_open_max_attempts": 1
},
"retry": {
"max_retries": 2,
"backoff": "exponential",
"max_backoff_ms": 3000,
"action_on_exhausted": "DENY"
}
},
"audit": {
"enabled": true,
"log_decisions": true,
"log_evidence": true,
"redact_pii": true,
"redaction_method": "HASH",
"retention_days": 2555,
"export_format": "SARIF",
"include_correlation_ids": true,
"include_risk_scores": true
}
}
policy = {
"guard": {
"pii_detection": {
"enabled": True,
"action": "DENY",
"patterns": [
"EMAIL", "PHONE", "SSN", "CREDIT_CARD", "ADDRESS", "DOB",
"NAME", "MEDICAL_RECORD", "HEALTH_PLAN_ID", "DIAGNOSIS_CODE",
"PRESCRIPTION_ID", "LAB_RESULT",
],
"redact_in_logs": True,
},
"prompt_injection": {
"enabled": True,
"sensitivity": "high",
"action": "DENY",
"log_attempts": True,
},
"content_moderation": {
"enabled": True,
"threshold": 0.5,
"categories": ["hate", "violence", "sexual", "self_harm", "dangerous_content"],
"action": "DENY",
},
},
"secrets": {
"enabled": True,
"confidence_threshold": 0.7,
"categories": ["api_keys", "tokens", "passwords", "cloud_secrets", "certificates"],
"actions": {"critical": "DENY", "high": "DENY", "medium": "DENY"},
},
"memory": {
"classification": "restricted",
"enforce_read_governance": True,
"scopes": {
"global": {"classification_required": "public"},
"shared": {"classification_required": "public"},
"user": {"classification_required": "restricted"},
"session": {"classification_required": "restricted"},
},
"deny_secrets_in_memory": True,
"deny_pii_in_memory": True,
"purge_on_session_end": True,
},
"registry": {
"models": ["gpt-4o", "claude-3-5-sonnet"],
"strict": True,
"tools": [
"patient_lookup", "medical_reference", "appointment_schedule",
"lab_results", "prescription_check", "clinical_guidelines",
],
"deny_unlisted": True,
"verify_provenance": True,
"require_hash": True,
},
"cost": {
"budget": {"daily": 200.00, "action_on_exceed": "DENY", "alert_threshold": 0.7},
"per_request_limit": 5.00,
"action_on_exceed": "DENY",
"estimate_before_execution": True,
},
"reliability": {
"circuit_breaker": {
"failure_threshold": 3,
"reset_timeout_ms": 60000,
"half_open_max_attempts": 1,
},
"retry": {
"max_retries": 2,
"backoff": "exponential",
"max_backoff_ms": 3000,
"action_on_exhausted": "DENY",
},
},
"audit": {
"enabled": True,
"log_decisions": True,
"log_evidence": True,
"redact_pii": True,
"redaction_method": "HASH",
"retention_days": 2555,
"export_format": "SARIF",
"include_correlation_ids": True,
"include_risk_scores": True,
},
}
What’s Included
| Dimension | Configuration | Why |
|---|---|---|
| Security | 12 PHI/PII patterns + DENY action | Healthcare data requires the strictest protection — block, don’t redact |
| Secrets | All severity levels DENY | No credential leakage in healthcare environments |
| Memory | Restricted classification + purge | PHI must not persist; all scopes require restricted classification |
| Registry | 2 capable models + 6 healthcare tools | Minimal model surface; healthcare-specific tool allowlist |
| Cost | 200/day+5/request | Healthcare queries can be complex; higher limits with strict controls |
| Reliability | Fast circuit breaker (3 failures) | Healthcare agents need quick failure detection |
| Audit | SARIF export + HASH redaction + 7-year retention | HIPAA-compliant audit trail with structured export |
Install
# Install the healthcare agent starter
tealtiger policy install --starter healthcare-agent
# Or copy the JSON above into your tealtiger.config.json
Customize
| Setting | Default | Adjust For |
|---|---|---|
guard.pii_detection.patterns | 12 patterns | Add custom PHI patterns for your specialty |
registry.tools | 6 healthcare tools | Match your EHR/clinical system integrations |
audit.retention_days | 2555 (7 years) | Increase if your organization requires longer retention |
cost.budget.daily | 200.00 | Scale with patient volume |
This configuration provides technical controls for HIPAA compliance. It does not replace a formal HIPAA risk assessment, Business Associate Agreement (BAA), or compliance program. Consult your compliance officer.
Related
- HIPAA Healthcare Pack — Compliance-focused configuration
- PII Redaction — Basic — Simpler PII handling for non-healthcare
- Deny Secrets in Memory — Standalone memory protection
- TealAudit Documentation — Full audit API reference