Skip to content

HIPAA Compliance Guide

This guide helps compliance officers configure Lucid to meet the requirements of the Health Insurance Portability and Accountability Act (HIPAA) for AI systems that process Protected Health Information (PHI).

Overview

HIPAA establishes national standards for protecting sensitive patient health information. The HIPAA Security Rule requires covered entities and business associates to implement administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of electronic Protected Health Information (ePHI).

Lucid helps healthcare organizations meet these requirements through:

  • PHI detection and protection to identify and safeguard health information
  • Comprehensive audit controls to track all access to ePHI
  • Access control mechanisms to restrict system access to authorized users
  • Security measures to protect against threats and unauthorized access

Key HIPAA Provisions and Lucid Auditors

HIPAA Section Requirement Recommended Auditor
164.312(a) Access Control PII Compliance Auditor, Policy Auditor
164.312(b) Audit Controls Observability Auditor
164.312(c) Integrity Eval Auditor, Model Security Auditor
164.312(d) Person/Entity Authentication Secrets Auditor
164.312(e) Transmission Security Guardrails Auditor, Secrets Auditor
164.502 PHI Use/Disclosure Limitations PII Compliance Auditor

Deploying for HIPAA Compliance

Quick Start

Deploy an AI environment with the HIPAA compliance profile:

lucid apply --app open-webui --model llama-3.1-8b --profile hipaa

This enables the following auditors: - PII Compliance Auditor - PHI detection and access control - Secrets Auditor - Credential protection - Observability Auditor - Audit controls and activity logging - Guardrails Auditor - Transmission security and threat protection - Eval Auditor - Model integrity verification - Model Security Auditor - Model integrity verification

Custom Configuration

For healthcare environments requiring specific controls, create a YAML configuration:

# hipaa-environment.yaml
apiVersion: lucid.io/v1alpha1
kind: LucidEnvironment
metadata:
  name: hipaa-compliant-ai
spec:
  infrastructure:
    provider: aws
    region: us-east-1
  agents:
    - name: hipaa-agent
      model:
        id: meta-llama/Llama-3.1-8B
      gpu:
        type: A10G
        memory: 24GB
      auditChain:
        preRequest:
          - auditorId: lucid-guardrails-auditor
            name: Transmission Security (164.312(e))
            env:
              INJECTION_BLOCK_ON_DETECTION: "true"
              INJECTION_THRESHOLD: "0.7"
          - auditorId: lucid-pii-compliance-auditor
            name: PHI Protection (164.502)
            env:
              PII_DETECTION_ENABLED: "true"
              PII_CATEGORIES: "name,dob,ssn,mrn,health_condition,medication,diagnosis"
              PHI_DETECTION_ENABLED: "true"
              PHI_REDACT_ON_DETECTION: "true"
              ACCESS_CONTROL_ENABLED: "true"
          - auditorId: lucid-policy-auditor
            name: Credential Protection (164.312(d))
            env:
              CREDENTIAL_DETECTION_ENABLED: "true"
        postResponse:
          - auditorId: lucid-observability-auditor
            name: Audit Controls (164.312(b))
            env:
              LOG_RETENTION_DAYS: "2190"  # 6 years per HIPAA
              LOG_ALL_PHI_ACCESS: "true"
              LOG_USER_IDENTITY: "true"
              AUDIT_LEVEL: "detailed"
          - auditorId: lucid-eval-auditor
            name: Integrity Controls (164.312(c))
            env:
              MODEL_INTEGRITY_CHECK: "true"
              SAFETY_BENCHMARKS_ENABLED: "true"

Deploy with:

lucid apply -f hipaa-environment.yaml

Section-by-Section Guidance

164.312(a) - Access Control

Requirement: Implement technical policies and procedures for electronic information systems that maintain ePHI to allow access only to authorized persons or software programs.

Lucid Implementation:

  1. PII Compliance Auditor - Access control verification
  2. Validates user authorization before processing
  3. Supports role-based access control (RBAC)

  4. Logs all access attempts

  5. Policy Auditor - Policy enforcement

  6. Enforces organizational access policies
env:
  ACCESS_CONTROL_ENABLED: "true"
  REQUIRE_AUTHENTICATION: "true"
  ROLE_BASED_ACCESS: "true"

Documentation for Auditors: The PII Compliance Auditor generates records of access control enforcement that can be provided to HIPAA auditors demonstrating compliance with this requirement.

164.312(b) - Audit Controls

Requirement: Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI.

Lucid Implementation:

  1. Observability Auditor - Comprehensive audit logging
  2. Records all AI system activities
  3. Captures user identity, timestamps, and actions
  4. Logs are cryptographically signed within TEE
env:
  LOG_RETENTION_DAYS: "2190"  # 6 years per HIPAA
  LOG_ALL_PHI_ACCESS: "true"
  LOG_USER_IDENTITY: "true"
  LOG_TIMESTAMP_PRECISION: "millisecond"
  AUDIT_LEVEL: "detailed"

Accessing Audit Logs:

# View recent audit activity
lucid logs hipaa-agent --audit

# Export audit logs for compliance review
lucid passport export --from 2024-01-01 --to 2024-03-31 --format json > hipaa_audit.json

# Generate audit report
lucid passport export --compliance-report hipaa --format pdf

164.312(c) - Integrity

Requirement: Implement policies and procedures to protect ePHI from improper alteration or destruction.

Lucid Implementation:

  1. Model Security Auditor - Model integrity verification
  2. Verifies model weights haven't been tampered with

  3. Detects unauthorized changes

  4. Eval Auditor - Safety benchmarks

  5. Runs safety benchmarks to ensure proper operation

  6. TEE Execution - Hardware-based integrity protection

  7. All processing occurs in tamper-proof enclaves
  8. Cryptographic attestation proves integrity
env:
  MODEL_INTEGRITY_CHECK: "true"
  INTEGRITY_VERIFICATION_INTERVAL: "3600"  # Check every hour

164.312(d) - Person or Entity Authentication

Requirement: Implement procedures to verify that a person or entity seeking access to ePHI is the one claimed.

Lucid Implementation:

  1. Secrets Auditor - Authentication verification
  2. Validates authentication tokens
  3. Detects exposed credentials that could enable impersonation
  4. Supports multi-factor authentication verification
env:
  CREDENTIAL_DETECTION_ENABLED: "true"
  CREDENTIAL_BLOCK_ON_DETECTION: "true"
  REQUIRE_AUTHENTICATION: "true"
  MFA_VERIFICATION: "true"

164.312(e) - Transmission Security

Requirement: Implement technical security measures to guard against unauthorized access to ePHI being transmitted over networks.

Lucid Implementation:

  1. Guardrails Auditor - Protects against transmission-based attacks
  2. Blocks prompt injection attempts via network

  3. Prevents jailbreak attacks

  4. Secrets Auditor - Credential and data protection

  5. Detects sensitive data in transmissions
  6. Prevents credential exposure
env:
  INJECTION_BLOCK_ON_DETECTION: "true"
  INJECTION_THRESHOLD: "0.7"
  CREDENTIAL_DETECTION_ENABLED: "true"

164.502 - Uses and Disclosures of PHI

Requirement: A covered entity may not use or disclose PHI except as permitted or required.

Lucid Implementation:

  1. PII Compliance Auditor - PHI detection and redaction
  2. Identifies PHI in AI inputs and outputs
  3. Can automatically redact PHI before processing
  4. Logs all PHI encounters for audit purposes
env:
  PHI_DETECTION_ENABLED: "true"
  PII_CATEGORIES: "name,dob,ssn,mrn,health_condition,medication,diagnosis,insurance_id"
  PHI_REDACT_ON_DETECTION: "true"
  LOG_PHI_ENCOUNTERS: "true"

PHI Categories Detected: - Patient names - Dates of birth - Social Security Numbers - Medical Record Numbers (MRN) - Health conditions and diagnoses - Medications - Insurance IDs - Contact information

Evidence for HIPAA Audits

Required Documentation

Lucid provides the following evidence for HIPAA compliance assessments:

  1. Access Control Evidence
  2. Records of access control enforcement
  3. User authentication logs

  4. Authorization verification records

  5. Audit Trail

  6. Comprehensive logs of all ePHI access
  7. User identity and timestamps

  8. Actions performed on the system

  9. Integrity Evidence

  10. Model integrity verification results
  11. Hardware attestation certificates

  12. AI Passport cryptographic proofs

  13. Security Incident Records

  14. Blocked injection attempts
  15. Detected credential exposures
  16. PHI detection events

Generating Compliance Reports

# List all AI Passports (compliance certificates)
lucid passport list --from 2024-01-01

# Export detailed audit records
lucid passport export --format json --detailed > hipaa_evidence.json

# Generate HIPAA-specific compliance report
lucid passport export --compliance-report hipaa --format pdf > hipaa_report.pdf

# View security events
lucid logs hipaa-agent --security-events

For Your HIPAA Security Officer

The Security Officer can use Lucid outputs to:

  1. Document technical safeguards using AI Passport attestations
  2. Demonstrate audit controls via Observability Auditor logs
  3. Verify access control implementation through PII Compliance Auditor records
  4. Evidence integrity controls with Eval Auditor verification results

Business Associate Considerations

If you are a Business Associate using Lucid to process ePHI:

  1. Ensure BAA coverage - Verify your Lucid agreement includes Business Associate provisions
  2. Configure appropriate controls - Use the HIPAA profile as a baseline
  3. Document your configuration - Maintain records of your security settings
  4. Report incidents promptly - Use Lucid's security event logs to identify potential breaches

Minimum Necessary Standard

HIPAA requires that covered entities limit PHI disclosures to the minimum necessary. Lucid supports this through:

  1. PHI Redaction - Automatically removes unnecessary PHI from AI processing
  2. Access Controls - Restricts system access based on roles
  3. Audit Logging - Documents what PHI was accessed and by whom
env:
  PHI_REDACT_ON_DETECTION: "true"
  MINIMUM_NECESSARY_ENFORCEMENT: "true"
  ROLE_BASED_ACCESS: "true"

Best Practices for Healthcare AI

  1. Enable the HIPAA profile - Provides comprehensive baseline protection
  2. Configure PHI redaction - Minimize unnecessary PHI in AI processing
  3. Retain logs for 6 years - Meet HIPAA documentation requirements
  4. Use US regions - Avoid international data transfer complications
  5. Review audit logs regularly - Monitor for unusual access patterns
  6. Document everything - Maintain configuration files as compliance records
  7. Test incident response - Use security event logs to practice breach response