HIPAA
23 agents enforce HIPAA Security Rule (§164.308 administrative · §164.310 physical · §164.312 technical), Privacy Rule (§164.500), and Breach Notification Rule (§164.404). BAA-aware evidence chain · ePHI flow-mapped at write time.
What this suite does
US Health Insurance Portability and Accountability Act — enforced per control, per framework, per evidence artifact. Every verdict is signed at write time and replayable byte-identically for five years.
- Per-§ control mapping across 45 CFR Parts 160 + 164
- ePHI flow audit — every system touching protected health info catalogued
- Risk Analysis (§164.308(a)(1)(ii)(A)) continuously refreshed
- Workforce training tracking · sanctions policy enforcement
- Breach Notification Rule timeline (60-day individual · annual <500-affected aggregate)
Key agents in this suite
A representative slice of the 23 agents in this suite. Each ships with deterministic verdicts, a cryptographic evidence chain, and per-framework control mapping.
ePHI Inventory Agent
Discovers + classifies protected health information across all integrated systems. Outputs flow-map for risk analysis.
Access Control Auditor
Verifies §164.312(a) unique user identification · automatic logoff · encryption-and-decryption.
Audit Trail Verifier
Confirms §164.312(b) hardware/software/procedural mechanisms record every ePHI access.
Workforce Training Tracker
Tracks §164.308(a)(5) workforce training completion · role-based assignment · sanctions enforcement.
BAA Coverage Mapper
Catalogues every Business Associate Agreement. Flags expired or missing BAAs against actual ePHI flows.
Why the substrate matters
Every agent in this suite shares one foundation: a canonical control catalog that projects the same evidence across frameworks, and an evidence chain that is signed at write time, independently timestamped, tamper-evident, and deterministically replayable. The auditor accepts the same artifact at year five that they accept today.
That is the difference between agent-based compliance that is workflow-grounded and AI compliance tooling that is a black box. Agent-based defensibility platform — workflow-grounded.
Read next
Get this suite
Join the early-access cohort ahead of Full GA on August 23, 2026. The substrate the auditor accepts — not legal advice; your counsel stays in the loop.