How can I build HIPAA-compliant LLMs for healthcare?
Towards a HIPAA Compliant Agentic AI System in Healthcare
April 25, 2025
https://arxiv.org/pdf/2504.17669This paper proposes a framework for building HIPAA-compliant agentic AI systems in healthcare, focusing on securing sensitive patient data (PHI). It utilizes a multi-agent system where different agents are responsible for access control, data sanitization, and auditing.
Key points for LLM-based multi-agent systems:
- Attribute-Based Access Control (ABAC): Dynamically grants or restricts access to PHI based on user roles, data sensitivity, and context, crucial for LLMs accessing sensitive data.
- Hybrid Sanitization Pipeline: Combines regex and BERT-based models to redact PHI before and after LLM processing, minimizing data leakage and supporting HIPAA compliance.
- Immutable Audit Trails: Logs all interactions with PHI, enabling traceability and compliance verification, important for accountability in LLM-driven workflows.
- Middleware Agent: Mediates interactions with the LLM, enforcing policies, managing session context, and analyzing conversation flow for cumulative risk assessment of PHI exposure.
- Real-world applicability with consideration for BAA (Business Associate Agreement): Acknowledges the need for BAA compliance when using third-party LLM APIs, a practical concern for developers.