HIPAA Security
45 CFR 164.312(b) audit controls for AI agent actions on protected health information
The HIPAA Security Rule applies to covered entities and business associates that create, receive, maintain, or transmit electronic protected health information (ePHI). 164.312(b) requires hardware, software, or procedural mechanisms that record and examine activity in information systems that contain or use ePHI.
Asqav signs every AI agent action with ML-DSA-65 (FIPS 204) and chains receipts so an OCR investigator or internal auditor can rebuild the period under review without reading the underlying payload. The Audit Pack export packages receipts plus the resolved policy artefacts under one signed manifest.
The receipt format is profiled in the IETF Internet-Draft draft-marques-asqav-compliance-receipts, which binds the format to the Security Rule audit-controls obligation.
Obligations
| Section | Requirement | Asqav binding |
|---|---|---|
| 164.312(b) | Implement hardware, software, or procedural mechanisms that record and examine activity in information systems containing ePHI. | Per-action ML-DSA-65 signature plus chained receipts. The agent's policy_digest resolves to the access policy in force at action time. Audit Pack export ships the window plus a signed manifest. |
| 164.312(c)(1) | Implement policies and procedures to protect ePHI from improper alteration or destruction. | Tamper-evident hash-chain. Each receipt binds to the previous via previousReceiptHash. Any insertion or modification breaks the verifiable chain and is flagged on verify. |
| 164.312(d) | Verify that a person or entity seeking access to ePHI is the one claimed. | issuer_id binds each receipt to a stable identity. Access decisions are signed and resolvable from the audit trail. |
Bring-your-own KMS (AWS KMS / GCP KMS), customer-owned storage, and air-gapped on-prem mode are available for deployer profiles that disallow outbound traffic on PHI handling. See the docs for the full mapping and the IETF draft for the binding text.