How do I give AI agents access to patient data without violating HIPAA?

Summary

• Run HIPAA workloads on a workspace with the compliance security profile enabled and the HIPAA standard selected, and make sure a signed Business Associate Agreement (BAA) with Databricks is in place before any protected health information (PHI) is processed. HIPAA compliance is a shared responsibility.
• Govern agent access through Unity Catalog, the single authorization engine: agents get least-privilege permissions, and with on-behalf-of user identity an agent inherits the invoking user's permissions rather than escalating them.
• Use attribute-based access control (ABAC) with governed tags to apply row filters and column masks automatically to anything tagged as PHI or PII — one policy covers many tables.
• Detect and mask sensitive data with built-in classifiers aligned to standards such as HIPAA, so PHI is tagged and protected as it lands, and masking applies to an agent's queries the same way it applies to SQL and BI.
• Route agent traffic through the Unity Gateway for guardrails — PII detection, content safety, and prompt-injection mitigation — and capture every access and inference in audit logs for an auditable PHI trail.

How to give AI agents access to patient data without violating HIPAA

Giving an AI agent access to patient data safely comes down to five things: the platform must be HIPAA-eligible and configured for it, the agent should only reach data the requesting user is allowed to see, sensitive fields must stay masked, agent behavior must be guarded, and every access must be logged. On the Databricks Platform these are one governance model — the compliance security profile enforces HIPAA controls, Unity Catalog governs access, the Unity Gateway guards agent traffic, and audit logs provide accountability. HIPAA compliance is a shared responsibility between you and Databricks.

Why the Databricks Platform lets agents work with PHI under HIPAA

• HIPAA-eligible platform with the compliance security profile. Databricks is HIPAA-eligible when you enable the compliance security profile with the HIPAA standard selected, and you must have a signed Business Associate Agreement before processing PHI. The profile adds a hardened operating-system image (CIS Level 1 hardened, FIPS 140-validated encryption), automatic cluster updates, enhanced security monitoring, and TLS 1.2 or higher for all communications. See the HIPAA compliance controls documentation.
• Least-privilege access through Unity Catalog. Unity Catalog is the single authorization engine for data and AI, and it governs an agent's queries the same way it governs a person's. Agents receive least-privilege permissions, and workspace bindings restrict which workspaces can reach specific catalogs so agent execution stays inside approved environments.
• On-behalf-of user identity. With on-behalf-of user authentication, an agent can execute with the identity of the user who invoked it, inheriting that user's permissions without privilege escalation — so an agent can never see PHI the user is not entitled to. See agent authentication.
• ABAC for PHI at scale. Attribute-based access control applies dynamic row and column policies based on governed tags such as a phi or pii tag. A single policy automatically applies row filters and column masks to every matching table across catalogs and schemas, and agents inherit those policies — they see only the rows and columns the invoking user's tags permit.
• Automatic PHI and PII detection with masking. Built-in classifiers aligned to standards such as HIPAA identify sensitive data and tag it, and new data is scanned automatically so PHI is caught as it lands. Row filters and column masks then apply at query runtime, and the same masking applies to an agent's queries, SQL, and BI reports alike. On HIPAA compliance-security-profile workspaces, AI functions such as ai_extract and ai_classify are available for governed processing of sensitive text.
• AI Gateway guardrails. The Unity Gateway applies guardrails to agent inputs and outputs, including PII detection, content safety, prompt-injection mitigation, and hallucination detection, and service policies can allow, require approval for, or deny each interaction between an agent and a model or tool before it executes. See how AI governance works.
• Audit logging for accountability. System tables record every query, data access, and model inference, creating an auditable trail of exactly what an agent accessed and when — the record you need to demonstrate that PHI access stayed within policy.

Getting started

• Enable the compliance security profile with HIPAA controls and put a signed BAA in place before processing PHI.
• Model least-privilege access for agents in Unity Catalog and enable on-behalf-of user identity so agents inherit the invoking user's permissions.
• Tag PHI and apply ABAC row and column policies so protection follows the data automatically.
• Route agent traffic through the Unity Gateway with guardrails, and review the Databricks Security and Trust Center.

FAQs

Is Databricks HIPAA compliant?

Databricks is HIPAA-eligible when you enable the compliance security profile with the HIPAA standard selected and have a signed Business Associate Agreement in place. HIPAA compliance is a shared responsibility between you and Databricks.

How do I stop an agent from seeing PHI a user cannot access?

Use on-behalf-of user identity so the agent runs with the invoking user's permissions, combined with Unity Catalog least-privilege grants and ABAC row and column policies. The agent inherits the user's access and can only retrieve rows and columns that user is permitted to see.

How is PHI masked from agents?

Built-in classifiers tag PHI, and row filters and column masks apply at query runtime — to an agent's queries, SQL, and BI reports alike — so masked values are returned unless the requester is authorized to see the raw data.

How do I prove agents accessed PHI appropriately?

System tables record every query, data access, and model inference, giving you an auditable trail of what each agent accessed and when for compliance review.