PHI use and disclosure — minimum necessary principle enforced at retrieval; AI agents gated by need-to-know policy before PHI enters the agent's context window.
Subpart E is the core of the HIPAA Privacy Rule. It governs all uses and disclosures of protected health information (PHI) by covered entities and their business associates, establishes the minimum necessary standard, defines individual rights over their health information, and sets requirements for notice of privacy practices.
AI agents operating in healthcare environments are typically classified as business associates when they process PHI on behalf of a covered entity. Every retrieval of PHI by an AI agent is a "use" under Subpart E and must have a permissible purpose. Without a governance layer that records what PHI each agent accessed and why, covered entities cannot demonstrate that uses were limited to permissible purposes. AutoPIL acts as the technical enforcement layer for Subpart E — every agent access is evaluated against a declared policy before PHI is retrieved, and each decision is logged in the audit chain.
Covered entities must make reasonable efforts to limit the use or disclosure of PHI to the minimum necessary to accomplish the intended purpose. The minimum necessary standard applies to all routine disclosures and any request for PHI.
AI agents are a particular compliance risk here because they typically request access at a broad connection level — a query against an EHR database can return far more fields than the agent actually needs. Application-level controls can filter output but do not govern the retrieval itself. AutoPIL enforces minimum necessary at the source level: each data source is classified by sensitivity, and agent policies specify which sources and sensitivity tiers a given agent may access. A clinical operations agent configured for scheduling cannot retrieve diagnostic records or prescription histories — the retrieval is blocked before it occurs.
PHI that has been properly de-identified is not subject to the Privacy Rule. Section 164.514 defines two acceptable methods: Safe Harbor (removal of 18 specified identifiers) and Expert Determination (statistical analysis confirming very low re-identification risk).
The AI governance risk is that agents trained or evaluated on de-identified data are then deployed against production systems containing identified PHI, without any policy boundary separating the two. AutoPIL's sensitivity classification in the source registry distinguishes identified PHI sources from de-identified research datasets. Agents authorised against de-identified sources can be explicitly restricted from accessing identified counterparts, maintaining the de-identification boundary at runtime.
Covered entities must provide individuals with access to their PHI in a designated record set within 30 days of a request. They must also provide an accounting of disclosures — a record of to whom PHI was disclosed, when, and for what purpose.
When an AI agent accesses PHI and that access is later challenged by a patient under §164.524, covered entities need a complete accounting of what was accessed, when, and by which system. AutoPIL's audit chain is queryable by data source and time range, enabling the compliance team to produce an accurate accounting of AI agent disclosures without manual reconstruction from fragmented application logs.
This page is a working reference and not a substitute for qualified legal review. Verify against official sources before use in compliance artifacts.
The policy below enforces HIPAA's minimum necessary standard at every PHI retrieval. Clinical agents access only the PHI categories their declared task requires — billing agents, scheduling agents, and research agents use separate, more restricted policies.
# HC-HIPAA-MN-001 — Minimum Necessary Standard (§164.502(b))
# PHI access controlled at retrieval — before data enters the agent context window.
# Each task bound to minimum required PHI sources.
- name: hipaa_minimum_necessary
policy_id: HC-HIPAA-MN-001
agent_role: hipaa_clinical_agent
allowed_sources:
- ehr_summaries
- lab_results
- vital_signs
- care_plans
- medication_history
- allergy_records
denied_sources:
- billing_records
- claims_data
- financial_records
- research_datasets_identified
- marketing_data
allowed_tasks:
- chart_review
- care_coordination
- medication_reconciliation
- clinical_summary
max_sensitivity: high
require_task_for_sensitivity: high
# §164.502(b): each task accesses only the PHI it requires
task_bindings:
- task: chart_review
permitted_sources: [ehr_summaries, lab_results, vital_signs]
- task: care_coordination
permitted_sources: [ehr_summaries, care_plans, lab_results]
- task: medication_reconciliation
permitted_sources: [medication_history, allergy_records, ehr_summaries]
- task: clinical_summary
permitted_sources: [ehr_summaries, lab_results, vital_signs, care_plans]
session_ttl_minutes: 120
require_principal_entitlements:
- sensitivity: [high]
require_any: [group:licensed-clinicians, group:care-coordinators]The HIPAA Privacy Rule applies to covered entities (healthcare providers, health plans, clearinghouses) and their business associates. AI tools that access PHI on behalf of these entities are business associates by definition.
AutoPIL intercepts every AI agent data access call, enforces your policy, and writes a tamper-evident audit record — before sensitive data enters the agent context window.