Healthcare & life sciences
Agents touching patient records, clinical workflow and regulated submissions.
The problem in one sentence
Minimum necessary access was hard enough with humans. An agent that queries broadly to answer narrowly breaks it structurally.
Where it breaks
Minimum necessary
Agents retrieve context aggressively by design. That is in direct tension with the access discipline HIPAA expects.
Audit controls
The Security Rule expects records of access to ePHI. An agent generates orders of magnitude more access events than a clinician — most logging designs were not sized for it.
CDS boundary
Where an agent's output stops being reference information and starts being a clinical recommendation is a regulatory line, not a product decision.
Business associates
Third-party agent platforms processing ePHI need agreements, and their audit trail has to be visible to your compliance function.
The Healthcare & life sciences regime references above are checked against their primary sources on an ongoing basis. Instruments move — several cited here changed inside the last year — so verify against the source before you rely on one. If you find something stale, tell me and I will correct it.
If any of this is live for you
The fastest route is a conversation. Bring the architecture you are worried about — the first useful thing usually surfaces inside twenty minutes.