{"slug": "hipaa-compliant-ai-agents-for-healthcare-operations-baa-phi-and-what-skyvern", "title": "HIPAA-Compliant AI Agents for Healthcare Operations: BAA, PHI and What Skyvern Stores", "summary": "AI agents can be used in HIPAA-compliant healthcare operations only when the vendor signs a business associate agreement (BAA) and applies the safeguards required by the HIPAA Security Rule, according to Skyvern, which published guidance on the topic and disclosed that HIPAA support is part of its Enterprise plan and that it holds a SOC 2 Type II report. Skyvern noted that HHS does not require or recognize any \"certification\" of HIPAA compliance, and that a cloud provider remains a business associate \"even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data.\" Skyvern said a single eligibility check on a payer portal moves protected health information through six places, and that subcontractors including the cloud it runs on and the model providers that read what the agent sees must also be covered by business associate agreements.", "body_md": "# HIPAA-Compliant AI Agents for Healthcare Operations: BAA, PHI and What Skyvern Stores\n\nAn AI agent can be used in a HIPAA-compliant way when its vendor signs a business associate agreement (BAA) with you, protects patient data with the safeguards the HIPAA Security Rule requires, and is set up to handle only the protected health information (PHI) the task needs. No AI product is HIPAA compliant on its own, and no government body certifies one. HHS says [no standard requires an organization to \"certify\" its compliance](https://www.hhs.gov/hipaa/for-professionals/faq/2003/are-we-required-to-certify-our-organizations-compliance-with-the-standards/index.html?ref=skyvern.com), and it doesn't recognize private \"HIPAA certifications\" either.\n\nMost of what's written about HIPAA and AI covers tools that talk: chat assistants, medical scribes and voice agents. In those tools, PHI sits in a prompt or a transcript. A browser agent that checks eligibility or submits prior authorizations on payer portals touches PHI in more places, because it reads the same screens your staff read and keeps a record of what it did. Teams use agents like this to handle more eligibility checks and prior authorizations without adding staff, and before one touches patient data, your security team needs to know where that data goes.\n\nWe build Skyvern, an AI agent that does this portal work for healthcare operations teams, so this page also explains our own setup. Skyvern has a SOC 2 Type II report and HIPAA support is part of our [Enterprise plan](https://www.skyvern.com/pricing). The sections below cover what HIPAA requires of any AI vendor, where PHI goes during a portal run, what Skyvern stores, and how to keep PHI inside your own cloud.\n\n## Can an AI agent be HIPAA compliant?\n\nYes, if two things are true: every vendor that handles PHI for you has signed a BAA, and each of them protects that PHI with the safeguards the Security Rule requires.\n\nThe BAA comes from how HIPAA defines a business associate. Any outside company that [creates, receives, maintains or transmits PHI](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?ref=skyvern.com) on behalf of a covered entity is a business associate, and the two must sign a BAA. An AI agent that logs into a payer portal with your credentials and reads a member's coverage receives PHI, so its vendor is a business associate.\n\nEncryption doesn't change that. HHS's cloud guidance says a cloud provider is a business associate \"even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data.\" Encryption is one of the safeguards. It doesn't replace the BAA.\n\nThe safeguards come from the [Security Rule](https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html?ref=skyvern.com), which requires \"reasonable and appropriate administrative, physical, and technical safeguards\" for electronic PHI. The rule is technology neutral. It doesn't name specific tools or settings. Each organization runs its own risk analysis and picks the measures that fit its risks, and that analysis has to include the AI vendor.\n\nThe obligation also passes down the chain. A subcontractor that handles PHI for a business associate [is a business associate too](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html?ref=skyvern.com), and the same contract rules apply between them. For an AI agent, the subcontractors include the cloud it runs on and the model providers that read what the agent sees. So check two contracts: the AI vendor's BAA with you, and the terms that cover its model providers.\n\n## Where PHI goes when an agent checks eligibility on a payer portal\n\nA single portal run moves PHI through six places, and a security review needs an answer for each one. Here is an example with an [eligibility check](https://www.skyvern.com/blog/automating-healthcare-insurance-eligibility-verification/), where the agent looks up a patient's coverage before a visit.\n\n1. **The task input.** You send the agent the patient's name, date of birth and member ID. Skyvern's[privacy policy](https://www.skyvern.com/privacy) calls these task payloads and lists health-related information and government ID numbers among the sensitive data they can carry.\n2. **The portal login.** The agent needs your staff's portal credentials. Skyvern keeps them in an encrypted credential vault and fills them in when the run starts, so they don't appear in the workflow itself. Our post on[how Skyvern handles authentication](https://www.skyvern.com/blog/how-skyvern-handles-authentication/) covers logins and two-factor codes.\n3. **The screen.** Once logged in, the agent reads the coverage page, which shows the patient's plan, dates of coverage and benefits.\n4. **The model call.** To decide what to click and what to read, Skyvern sends screenshots of the page to a large language model. The privacy policy names the providers we use (OpenAI, Anthropic, Google Gemini, Azure OpenAI and AWS Bedrock) and says the screenshots \"may contain visible user data.\" PHI on the screen reaches the model provider.\n5. **The output.** The fields you asked for, such as active coverage, copay and deductible, come back as structured data for your billing or scheduling system.\n6. **The run record.** Skyvern saves a screenshot of each step and a video recording of the browser session, so your team can see what the agent did. Both can show PHI.\n\nPlaces 4 and 6 are the ones a chat tool doesn't have. Because of the model call, the BAA chain has to reach the model providers. Because of the run record, you need retention and access rules in place before the first run.\n\nThe [minimum necessary standard](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement/index.html?ref=skyvern.com) applies here as well. It asks covered entities to take reasonable steps to limit the PHI they use or disclose to what the purpose needs. In an agent workflow, two choices put that into practice. Send the agent only the identifiers the portal asks for, and have it return only the fields your next system uses. Then limit which people on your team can open run screenshots and recordings, since those show the full page.\n\n## What Skyvern stores and who can see it\n\nOn Skyvern Cloud, we keep a record of each run so your team can review it, and we protect that record with encryption, access controls and audit logging.\n\nThe privacy policy lists what a run leaves behind: the task payload, a screenshot of each automation step that you can view in your dashboard, and a video recording of the browser session. The extracted output stays with the run results.\n\nWe keep that data \"for as long as necessary to provide our Services and as required by applicable law,\" and you can ask us to delete it at any time by writing to support@skyvern.com. These terms come from the privacy policy. For PHI workloads, agree on a specific retention period and deletion process in your Enterprise contract.\n\nOur [trust center](https://trust.skyvern.com/?ref=skyvern.com) lists the controls behind these records. Data is encrypted at rest and in transit, audit logs are collected, access to production is restricted, and employee access is reviewed regularly. It also lists an established breach notification process and a data retention policy. Our SOC 2 Type II audit tested controls like these, and the [SOC 2 post](https://www.skyvern.com/blog/skyvern-x-soc-2/) explains what it covered.\n\n## Keeping PHI inside your own cloud\n\nIf your policy says PHI can't leave your environment, you can run Skyvern in your own cloud account. In return, your team runs and maintains the deployment.\n\nSkyvern's core is [open source](https://github.com/Skyvern-AI/skyvern?ref=skyvern.com) under the AGPL-3.0 license. When you self-host, the [storage settings](https://www.skyvern.com/docs/developers/self-hosted/storage) send run data to your own Amazon S3, Azure Blob Storage or Google Cloud Storage buckets. Skyvern uses four of them:\n\n- **Artifacts:** extracted data, HTML snapshots, logs and recordings.\n- **Screenshots:** page screenshots at each step.\n- **Browser sessions:** saved browser state for reusable profiles.\n- **Uploads:** files uploaded for agent runs.\n\nPortal credentials can live in your own vault as well. The same settings page covers an encrypted local vault, Azure Key Vault and AWS Secrets Manager.\n\nYou also choose the model. A self-hosted deployment uses your own keys with the provider you configure. That can be Azure OpenAI under your organization's Microsoft agreement, or a model you host yourself through Ollama or another OpenAI-compatible server. One trade-off to plan for: the docs note that most Ollama models can't read images, and without vision Skyvern works from the page's HTML, which can be less accurate on complex portals.\n\nSelf-hosting also moves retention into your hands. Links to screenshots and recordings in run responses expire after 24 hours by default. Local storage is never cleaned up automatically, so set a lifecycle rule on your buckets or a scheduled deletion job that matches your retention policy.\n\n## Skyvern's HIPAA posture\n\nHIPAA support, BAAs and the SOC 2 report come with our Enterprise plan\n\n|  | Skyvern | \n|---|---|\n| HIPAA | Compliant | \n| Plan | Enterprise | \n| BAA | Available on Enterprise | \n| SOC 2 | Type II, report available on Enterprise | \n| Encryption | In transit and at rest | \n| Portal credentials | Encrypted vault; Bitwarden and Azure Key Vault on Enterprise | \n| Run record | Step screenshots and session recordings | \n| Retention | As long as needed to provide the service; deletion on request | \n| Deployment | Skyvern Cloud, or self-hosted in your cloud | \n| Human review | Human-in-the-loop on Enterprise | \n\n## What to ask any AI automation vendor before a healthcare pilot\n\nEvery vendor should be able to answer these six questions in writing before a pilot touches real patient data. Each one maps to a place PHI goes during a run.\n\n- **Will you sign a BAA, on which plan, and does it cover your subcontractors, including model providers?** The BAA chain has to reach every company that sees PHI.\n- **What do you store from each run, where, and for how long?** Ask about task inputs, screenshots, recordings and extracted data one by one, since each may have a different retention period.\n- **Can run data go to our own storage, or can we self-host?** This decides whether PHI ever leaves your environment.\n- **Is our data used to train models, yours or your providers'?** Get the answer for your plan, in the contract.\n- **Who at your company can see our run data, and is that access logged?** Audit logs let your compliance team check access after the fact.\n- **How do you handle a breach, and how quickly will you tell us?** Your BAA should set the notice terms.\n\nOur [healthcare page](https://www.skyvern.com/healthcare) shows the workflows teams run with Skyvern, including [prior authorization](https://www.skyvern.com/blog/automate-healthcare-prior-authorization-insurance-portals/) and [credentialing](https://www.skyvern.com/blog/automate-healthcare-credentialing-medical-boards-caqh-nppes/). For an Enterprise conversation, our team can walk through each of these questions for your setup.\n\n## FAQ\n\n### Does HIPAA prohibit using AI?\n\nNo. HIPAA doesn't ban any technology. Its rules govern how PHI is used, disclosed and protected, whatever system handles it, and the Security Rule is technology neutral. An AI tool that touches PHI needs the same BAA, safeguards and risk analysis as any other vendor.\n\n### Will Skyvern sign a BAA?\n\nBAAs are available on our Enterprise plan. Put the BAA in place before you send any PHI through Skyvern, and ask what it covers, including the model providers that process screenshots.\n\n### Does Skyvern use our data to train its models?\n\nOur privacy policy describes using anonymized data to improve our models and excludes Google Workspace data from that use. For PHI workloads, set the training terms in your Enterprise agreement so your contract states exactly what applies to your data.\n\n### Is a \"HIPAA certified\" AI tool safer than one that isn't?\n\nNot by that label. HHS doesn't endorse or recognize private HIPAA certifications, and a certificate doesn't take a covered entity's obligations off its hands. A SOC 2 Type II report, a signed BAA and clear answers on storage and retention tell you more about a vendor.\n\n## Before your first PHI run\n\nStart with the BAA and the storage answers, then pilot on a single portal with the smallest set of fields the task needs. Review the first runs' screenshots with your compliance lead so you can see exactly what the agent sees and keeps.\n\nNone of this replaces your own risk analysis. HIPAA requires covered entities and business associates to run one for all the ePHI they handle, and HHS's cloud guidance tells them to understand each provider's environment as part of it. An AI agent is one more environment in that review.\n\n## Plan your first healthcare workflow with Skyvern\n\nSkyvern is a good fit when healthcare work is stuck in payer portals: it can navigate the pages, fill forms and return the fields your team needs. Start with one eligibility or prior authorization workflow so you can assess both the time saved and the data it touches.\n\n[Talk to our team about a healthcare pilot](https://www.skyvern.com/contact). Bring the portal you use and your security requirements. Before the first PHI run, agree on the BAA, model-provider terms, storage and retention for your deployment.", "url": "https://wpnews.pro/news/hipaa-compliant-ai-agents-for-healthcare-operations-baa-phi-and-what-skyvern", "canonical_source": "https://www.skyvern.com/blog/hipaa-compliance/", "published_at": "2026-11-08 15:21:00+00:00", "updated_at": "2026-11-09 01:45:43.614158+00:00", "lang": "en", "topics": ["ai-agents", "ai-policy", "ai-ethics"], "entities": ["Skyvern", "HHS", "HIPAA Security Rule", "SOC 2 Type II"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/hipaa-compliant-ai-agents-for-healthcare-operations-baa-phi-and-what-skyvern", "markdown": "https://wpnews.pro/news/hipaa-compliant-ai-agents-for-healthcare-operations-baa-phi-and-what-skyvern.md", "text": "https://wpnews.pro/news/hipaa-compliant-ai-agents-for-healthcare-operations-baa-phi-and-what-skyvern.txt", "jsonld": "https://wpnews.pro/news/hipaa-compliant-ai-agents-for-healthcare-operations-baa-phi-and-what-skyvern.jsonld"}}