Agentic AI systems powered by Large Language Models (LLMs) as their foundational reasoning engine, are transforming clinical workflows such as medical report generation and clinical summarization by autonomously analyzing sensitive healthcare data and executing decisions with minimal human oversight. However, their adoption demands strict compliance with regulatory frameworks such as Health Insurance Portability and Accountability Act (HIPAA), particularly when handling Protected Health Information (PHI). This work-in-progress paper introduces a HIPAA-compliant Agentic AI framework that enforces regulatory compliance through dynamic, context-aware policy enforcement. Our framework integrates three core mechanisms: (1) Attribute-Based Access Control (ABAC) for granular PHI governance, (2) a hybrid PHI sanitization pipeline combining regex patterns and BERT-based model to minimize leakage, and (3) immutable audit trails for compliance verification.

本研究解决了自主AI系统在医疗保健中如何处理敏感数据并实现HIPAA合规的问题。提出了一种动态、上下文感知的政策执行框架，集成了基于属性的访问控制、混合PHI清理管道和不可变审计跟踪等机制。该框架的核心发现是能够有效保障患者隐私，同时促进AI系统在医疗流程中的安全应用。

面向HIPAA合规的医疗保健自主AI系统