Healthcare

Healthcare AI agents handle Protected Health Information (PHI) under HIPAA regulations.

Requirements

• PHI must not reach third-party LLMs
• Prescription actions require physician approval
• Complete audit trail for compliance
• Network isolation for medical device integrations

Example: Clinical Assistant

schema_version: "1.0"
name: clinical-assistant
version: "1.0.0"
publisher: healthcare-corp

capabilities:
  - name: ehr-read
    description: Read patient records
    api:
      method: GET
      url_pattern: "https://ehr.hospital.internal/fhir/Patient/**"
    rate_limit:
      requests_per_minute: 100
    taint_labels: [phi, patient_data]

  - name: ehr-write
    description: Update patient records
    api:
      method: PUT
      url_pattern: "https://ehr.hospital.internal/fhir/Patient/**"
    rate_limit:
      requests_per_minute: 20
    requires_approval:
      threshold: always
      timeout_seconds: 300
      default_on_timeout: deny
    taint_labels: [phi]

  - name: prescription
    description: Create prescriptions
    api:
      method: POST
      url_pattern: "https://ehr.hospital.internal/fhir/MedicationRequest"
    rate_limit:
      requests_per_minute: 10
    requires_approval:
      threshold: always
      timeout_seconds: 600
      default_on_timeout: deny

  - name: llm-summarize
    description: Summarize non-PHI data
    api:
      method: POST
      url_pattern: "https://api.openai.com/v1/chat/completions"
    rate_limit:
      requests_per_minute: 30
    secret_headers:
      Authorization: "Bearer ${OPENAI_API_KEY}"

taint_rules:
  - name: hipaa-phi-isolation
    deny_flow:
      from_labels: [phi, patient_data]
      to_capabilities: [llm-summarize]

secrets:
  - name: OPENAI_API_KEY
    required: true

Controls