HIPAA and SOC 2 Compliant AI Agent: Five Things to Verify

“HIPAA compliant AI agent” is a sales label, not a certification. Nobody issues it.

HHS says so directly: its Office for Civil Rights does not endorse, certify, or recommend specific technology or products. So when a vendor says “we’re HIPAA compliant,” that is a claim you have to test.

Here are five things to verify before you sign. This is operator advice, not legal advice. Have counsel review the final paper.

Why a HIPAA Compliant AI Agent Label Proves Little

HIPAA does not regulate software. It regulates covered entities (providers, health plans, clearinghouses) and their business associates (vendors who handle protected health information for them).

That has two consequences.

First, no one can “be HIPAA compliant” in the abstract. A vendor can only be compliant with respect to a specific service, a specific contract, and a specific configuration. The same product can be fine under one setup and a violation under another.

Second, the label tends to mean one of three things:

1. The vendor will sign a business associate agreement (BAA).
2. The vendor has a SOC 2 report.
3. The vendor’s marketing team wrote the sentence.

Only the first is a legal commitment. The second is useful evidence. The third is noise. Your job is to find out which one you are looking at.

Cloud providers use careful language. AWS, for example, publishes a list of HIPAA eligible services and says customers “still must configure these services consistent with HIPAA requirements.” Eligible is not the same as compliant. That wording is the right model for every AI vendor: eligible to handle PHI, if you set it up right.

For the healthcare workflow side, see my post on AI agents and healthcare compliance.

Check 1: BAA Scope

If an AI agent touches PHI, you need a BAA with the vendor. HHS cloud guidance is clear that a covered entity and a cloud provider must enter into a BAA when the provider creates, receives, maintains, or transmits ePHI. It adds that this holds even when the provider only stores encrypted data and has no key.

That last point matters for AI. Vendors sometimes argue they never “see” the data. HHS says that does not exempt them.

But signing a BAA is the start. The scope is what you check. Read it for these items. They track HHS’s own sample BAA provisions:

• Which services does the BAA cover? Many vendors cover only certain products or plans. If the agent, the logging tool, and the search index are different services, each needs to be in scope.
• Permitted uses. The BAA should limit the vendor to the uses needed to deliver your service. Watch for optional clauses that let the vendor use PHI for its own management, or for data aggregation.
• Safeguards. The vendor must implement the HIPAA Security Rule requirements for ePHI.
• Reporting. The vendor must report any use or disclosure not allowed by the contract, including breaches.
• Subcontractors. They must agree to the same restrictions.
• Return or destroy at termination. What happens to prompts, embeddings, and logs when you leave?
• Termination right. You can end the contract if the vendor breaks a material term.

Ask in writing: “List every product, model, and sub-service under this BAA. List what is outside it.”

A common gap: the BAA covers the platform, but a beta feature, a plugin, or a connected tool sits outside it. If PHI can flow there, you have a hole.

Check 2: Subprocessors

An AI agent is a chain. The vendor’s app calls a model provider. It stores data in a database. It logs to a monitoring tool. It may send email. Each link may touch PHI.

The BAA rules say subcontractors that access PHI must agree to the same restrictions as the vendor. That means you should be able to see the chain.

Ask in writing:

• A current list of every subprocessor that can receive PHI, what each receives, and where it runs.
• Proof that each one has a BAA (or equivalent downstream agreement) with the vendor.
• Notice of changes, with a right to object.
• Whether the model provider is a subprocessor, and under which terms.

Pay special attention to the model layer. Some providers will sign a BAA only for certain products or only for eligible endpoints. OpenAI’s enterprise privacy page states it can sign BAAs, and that zero data retention is available for eligible endpoints in qualifying cases. Eligibility depends on the endpoint, so ask which one your vendor uses.

I go deeper on the review in my AI agent vendor security assessment.

Check 3: Retention and Training Use

Where do prompts go, and how long do they stay?

In a healthcare agent, a prompt is PHI. It may include a diagnosis, a medication list, or a patient name pasted from a chart. Every place that prompt lands is a place PHI sits.

Check each hop:

• Vendor storage. Do they keep prompts and outputs? For how long? Can you set the period?
• Model provider storage. Providers often keep API data for abuse monitoring. OpenAI’s page says API inputs and outputs may be retained up to 30 days, with zero data retention available on request for qualifying cases. Microsoft documents an abuse-monitoring process where human reviewers can see flagged prompts and completions, and says approved customers can apply to modify it.
• Training use. Both providers state business data is not used for training by default. Get the same statement from your vendor, in the contract, for them and for every subprocessor.
• Derived data. Embeddings, summaries, and caches can hold PHI too. Ask how they are stored and deleted.

Ask in writing: “State the retention period for prompts, outputs, embeddings, and logs at every hop. State whether any of it is used to train or evaluate models.”

Glossary background: zero data retention and data sovereignty. For the location angle, see data sovereignty for AI agents. One note: HHS says the HIPAA Rules do not set requirements specific to ePHI handled outside the United States. That does not make offshore handling a good idea. It means you should set a location rule in your own contract.

Check 4: Logging and Access

Two questions: who can see the prompts, and what is recorded about it?

The HIPAA Security Rule has an audit controls standard. Under 45 CFR 164.312(b), you must implement mechanisms “that record and examine activity in information systems that contain or use electronic protected health information.” An AI agent is such a system.

For an agent, activity records should include:

• Who asked, and when.
• What PHI the agent retrieved.
• Which tools it called, with what inputs and results.
• What it returned.
• Who at the vendor accessed the data, and why.

That last item is the one buyers forget. Ask about vendor staff access:

• Can vendor employees read our prompts? Under what approval?
• Is that access logged, and can we see the log?
• Does support get access to production data? How is it removed afterward?
• Are logs themselves scrubbed or protected, since they can contain PHI?

Then ask the agent-specific question: what can the agent read? An agent with broad access to the record system will pull more PHI than the task needs. Limit it to the minimum, and require the access to be logged. My post on what to log in an AI agent audit trail has the field list.

Ask in writing: “Provide a sample log export from a test tenant, and the policy governing vendor staff access to customer data.”

Check 5: Incident Duties

What happens when something goes wrong?

Under the HIPAA breach rule, a business associate must notify the covered entity “without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.” The notice must identify, to the extent possible, each person affected.

Sixty days is the legal ceiling, not a good standard. Your own notification duties may run on a shorter clock, so ask counsel when it starts. A vendor who waits 55 days can leave you with very little time.

So negotiate a tighter number. My recommendation is notice within 72 hours of discovery for any suspected incident involving your data, and sooner for confirmed ones. That is my view, not a legal rule. Counsel can tell you what fits your state and contracts.

Ask in writing:

• The notice period for suspected and confirmed incidents, in hours.
• What the notice includes: affected records, timeline, root cause, steps taken.
• A named 24-hour contact.
• Whether the vendor can cut off one agent or one customer’s access fast.
• Whether they will cooperate in your investigation and give you logs.

Also ask what the vendor does when an agent misbehaves without a breach, like sending PHI to the wrong recipient inside your own system. That is an incident too. See AI agent incident response.

What SOC 2 Does and Does Not Cover

A SOC 2 report is good evidence. It is not a HIPAA stamp.

SOC 2 is an audit framework from the AICPA. It is built on the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. An auditor reports on the controls a company chose to put in scope.

What that means for you:

• It does not map one-to-one to HIPAA. The HIPAA Rules are a legal standard. SOC 2 is an attestation against criteria. A vendor can pass one and fail the other.
• Scope can be narrow. The report covers a defined system. Check that the AI agent product is in it. A report on the vendor’s old web app tells you little about the new agent.
• Categories vary. A report can address any combination of the five categories. Check which ones. For PHI, confidentiality and privacy matter.
• Type 1 versus Type 2. Under the AICPA’s own description, a Type 1 report does not give an opinion on operating effectiveness. Type 2 covers controls over a period. Ask for Type 2.
• Exceptions. The auditor lists where controls failed. Read that section first.
• It is not a BAA. SOC 2 says nothing about who signs responsibility for PHI.
• AI-specific risk. SOC 2 criteria were not written for agents. Prompt injection, tool permissions, and model behavior may not be tested at all. Ask what the report says about them.

My rule: SOC 2 Type 2 plus a signed BAA plus the five checks above. Any one alone is not enough.

The Five Things in One Table

Check	Ask for in writing	Red flag
1. BAA scope	Services in and out of scope	Beta features or tools outside the BAA
2. Subprocessors	Full list with downstream BAAs	”Proprietary architecture, can’t share”
3. Retention and training	Days kept per hop; no training use	Retention unknown at the model layer
4. Logging and access	Sample log export; staff access policy	Vendor staff can read prompts with no log
5. Incident duties	Notice in hours; named contact	”Per applicable law” with no number

Bottom Line

A HIPAA compliant AI agent is one you verified, not one that says so.

Get a signed BAA with a clear scope. See the subprocessor list. Know the retention at each hop. Read a sample log. Put an incident number in the contract.

Treat SOC 2 Type 2 as supporting evidence. Then have counsel review the paper.

FAQ

What makes an AI agent HIPAA compliant? No agency certifies it. Compliance comes from a signed BAA, the right safeguards, and a correct configuration for your use. The same product can be compliant in one setup and not in another, so verify the specific service you will use.

Do I need a BAA for an AI agent? Yes, if the agent creates, receives, maintains, or transmits PHI for you. HHS guidance says this applies even when the provider stores only encrypted data and has no key. Check that the BAA covers every product and sub-service in the data path.

What does SOC 2 not cover? It does not prove HIPAA compliance, replace a BAA, or test AI-specific risks like prompt injection by default. It also covers only the scope the vendor chose. Check that the agent product is in scope and ask for a Type 2 report.

Where do prompts go? To the vendor, and often to a model provider and other subprocessors. Each hop may store them. Some providers keep API data for abuse monitoring for up to 30 days unless you arrange zero data retention. Ask for retention in days at every hop.

What should I ask for in writing? The BAA scope, the subprocessor list with downstream agreements, retention and training terms, a sample log export with the staff access policy, and an incident notice period in hours. Get these in the contract, not just in sales emails.

Three Ways to Work With TMA

Need an agent built? We deploy production AI agents in your infrastructure. Working pilot. Real data. Measurable ROI. → Schedule Demo

Want to co-build a product? We’re not a dev agency. We’re co-builders. Shared cost. Shared upside. → Partner with Us

Want to join the Guild? Ship pilots, earn bounties, share profit. Community + equity + path to exit. → Become an AI Architect