HIPAA-ENDPOINTSstopsModel calls go only to local hosts or vendors under a signed BAA
45 CFR 164.502(e), 164.504(e) · checked 2026-11-02
Policy log
Every rule the agent obeys, and where it came from.
This page is generated from the agent's own policy file, so it cannot describe a rule the agent does not run. Version 1.0.0, effective 2026-11-02: 23 active rules, next review by 2026-11-16.
When the worker startsWhen a request arrivesOn every tool callOn the excerpts a tool returnsOn the draft answerBefore the answer leavesBefore a release counts as verifiedChangelogProposals
Not legal advice. These rules are technical safeguards. A deployment is HIPAA compliant only with the agreements, risk analysis, policies and training listed on the agent page.
How much each purpose may read
Minimum necessary, per 45 CFR 164.502(b): the excerpts the model may see per request, and the tools it may call.
| Purpose of use | Max excerpts | Tools |
|---|---|---|
treatment | 8 | search_records, get_facts, answer, escalate_to_human |
payment | 4 | search_records, get_facts, answer, escalate_to_human |
operations | 4 | search_records, get_facts, answer, escalate_to_human |
patient_access | 6 | search_records, get_facts, answer, escalate_to_human |
When the worker starts
HIPAA-ENCRYPTION-KEYstopsThe tenant key-encryption key is set and is not a placeholder
45 CFR 164.312(a)(2)(iv) · checked 2026-11-02
Tests that prove it
HIPAA-NO-PERSISTED-STATEstopsNo persistent graph checkpointer (it would store pre-de-identification text)
45 CFR 164.312(a)(1) · checked 2026-11-02
Tests that prove it
HIPAA-NO-TRACINGstopsNo third-party tracing of prompts (LangSmith, OpenTelemetry exporters to a SaaS)
45 CFR 164.502(e) · checked 2026-11-02
Tests that prove it
F-RLS-ROLEstopsNever run as a superuser or BYPASSRLS role (row-level security would be inert)
Arbiter post-mortem, 2026-09-04 · checked 2026-11-02
Tests that prove it
S1557-INVENTORYstopsKeep an inventory of the decision-support tools and their input variables
45 CFR 92.210 (Section 1557, patient care decision support tools) · checked 2026-11-02
Tests that prove it
HIPAA-EVALUATIONwarnsThe policy is re-reviewed on schedule (warns, never stops a running service)
45 CFR 164.308(a)(8) · checked 2026-11-02
Tests that prove it
When a request arrives
HIPAA-BAAstopsThe tenant has a signed business associate agreement
45 CFR 164.502(e) · checked 2026-11-02
Tests that prove it
HIPAA-PURPOSEstopsUse is for treatment, payment, operations or the patient's own access, or is authorized
45 CFR 164.506(c), 164.508(a)(1), 164.524 · checked 2026-11-02
PATIENT-NEEDS-STATEstopsA patient-facing request names the patient's state, so state disclosure rules can apply
Applies to audience: patient
Needed to apply Cal. Health & Safety Code 1339.75 and similar state rules · checked 2026-11-02
Tests that prove it
On every tool call
HIPAA-MIN-NECESSARY-TOOLSstopsOnly the tools allowed for the stated purpose
45 CFR 164.502(b), 164.514(d) · checked 2026-11-02
Tests that prove it
HIPAA-MIN-NECESSARY-CAPremovesRetrieval is capped per purpose (fewer excerpts for payment and operations)
45 CFR 164.502(b), 164.514(d) · checked 2026-11-02
Tests that prove it
On the excerpts a tool returns
HIPAA-PSYCHOTHERAPY-NOTESremovesPsychotherapy notes are excluded unless the patient authorized their use
45 CFR 164.508(a)(2) · checked 2026-11-02
PART2-SUD-RECORDSremovesSubstance use disorder treatment records are excluded without Part 2 consent
42 CFR 2.31 · checked 2026-11-02
Tests that prove it
On the draft answer
HIPAA-OUTPUT-LEAKstopsThe draft contains no raw identifier (dates, addresses, names the scrubber missed)
45 CFR 164.514(b)(2) (Safe Harbor identifiers) · checked 2026-11-02
Tests that prove it
CITATIONS-REQUIREDstopsEvery answer cites at least one excerpt it was given
Arbiter reference pipeline, validation node · checked 2026-11-02
Tests that prove it
NO-AUTOMATED-DETERMINATIONSstopsNo coverage, medical-necessity or eligibility determinations; a licensed clinician decides
Applies to purpose: payment, operations
Cal. Health & Safety Code 1367.01(k), Ins. Code 10123.135(j) (SB 1120, ch. 879, 2024; in force 1 Jan 2025). Written for health plans and insurers; applied here to every payment and operations use official text not yet read by a person · checked 2026-11-02
Tests that prove it
F-NEGATIONrewritesA "no" is stated only when the record states it; otherwise say the record does not document it
Arbiter finding, 2026-09-08: the faithfulness gate scores correct negations 0.0 · checked 2026-11-02
Before the answer leaves
DECISION-SUPPORT-NOTICEaddsPayment and operations answers say they are decision support, not a determination
Applies to purpose: payment, operations
Cal. Health & Safety Code 1367.01(k) (SB 1120, 2024) official text not yet read by a person · checked 2026-11-02
Tests that prove it
CA-AB3030-DISCLOSUREaddsPatient-facing AI messages in California say AI wrote them and how to reach a person
Applies to audience: patient; state: US-CA
Cal. Health & Safety Code 1339.75 (AB 3030, ch. 848, 2024; in force 1 Jan 2025). Exempt when a licensed provider read and reviewed the message official text not yet read by a person · checked 2026-11-02
Before a release counts as verified
F-STRICT-RECALLstopsRelease only if strict per-component de-identification recall is at least 0.99
Arbiter post-mortem, 2026-09-04: whole-string recall hid ZIP codes in 14 of 20 documents · checked 2026-11-02
Tests that prove it
F-NO-LEAKSstopsRelease only if the eval found zero cross-patient leaks
45 CFR 164.502(a) · checked 2026-11-02
Tests that prove it
F-EVAL-POWERstopsA release comparison needs enough gold questions to detect about a 5-point change
Arbiter finding, 2026-09-08: 40 questions resolve only about 15 points · checked 2026-11-02
Tests that prove it
Changelog
Every change to policy.yaml, newest first. Each entry gives the version, the date, what changed, the evidence, and who approved it. The research routine proposes changes in proposals/; only the owner merges them. The published copy is arbiterai.tech/policy.html.
1.0.0 (2026-11-02)
The first policy: 23 rules, all active. Approved by Yoonbo Cho, who asked on 2026-11-02 for "an AI agent that adheres to all these privacy rules including HIPAA", changing as the findings change.
- HIPAA.
- BAA gate (164.502(e)).
- Purpose of use: treatment, payment, operations or the patient's own access, otherwise an authorization (164.506(c), 164.508, 164.524).
- Minimum necessary: tools and retrieval caps per purpose (164.502(b), 164.514(d)).
- Psychotherapy notes need an authorization (164.508(a)(2)).
- Output leak check (164.514(b)(2)).
- Preflight checks: endpoints, keys, checkpointer, tracing (164.312).
- Scheduled re-evaluation warning (164.308(a)(8)).
- 42 CFR Part 2. Substance use disorder treatment records need Part 2 consent (2.31).
- Section 1557. An inventory of decision-support tools and their input variables (45 CFR 92.210(b)).
- California.
- AI disclosure on patient messages (Health & Safety Code 1339.75, AB 3030).
- No automated coverage or medical-necessity determinations, plus a decision-support notice (1367.01(k), SB 1120).
- Both are marked
confidence: secondaryuntil someone reads the official text. - Arbiter findings.
- F-NEGATION (2026-09-08): negations are stated only when the record states them.
- F-RLS-ROLE (2026-09-04): never run as a role that bypasses RLS.
- Release gates F-STRICT-RECALL (2026-09-04), F-NO-LEAKS and F-EVAL-POWER (2026-09-08).
- Not adopted, and why.
- ONC HTI-5 (effective 2026-12-28) removes decision-support transparency duties from certified EHR developers. Arbiter is not certified health IT, so nothing changes here.
- The Texas health-care AI disclosure duties wait for a primary-source check before a proposal.
Open proposals
Proposed by the research routine from a new finding or law, with the evidence. A person reviews and merges each one; nothing here is enforced until then.
2026-11-02 · open
From 1 Jan 2027, California SB 503 requires developers of clinical decision support to give deployers documentation on training data (including demographic representativeness), evaluation and known risks. Extend the decision-support inventory (S1557-INVENTORY) so every tool entry must carry training_data, evaluation and known_risks, and make preflight fail without them.
2026-11-02 · open
From 1 Jan 2027, Colorado HB 26-1139 bars a medical-necessity denial based on AI output without licensed human review, and requires AI used in utilization review to use individual clinical data. The agent already blocks determinations for payment and operations (NO-AUTOMATED-DETERMINATIONS); add Colorado as a second source and scope the rule to US-CO requests explicitly, so the audit shows which law applied. No behaviour is loosened.
Source: platform/policy/policy.yaml · engine worker/policy.py · agent worker/agent.py