# HIPAA-aligned controls for AI agents touching PHI

A connector into email, a helpdesk, or a warehouse can pull protected health information into an agent's context. These policies support HIPAA-aligned minimum-necessary, access, and de-identification controls on the MCP path.

For: Security and compliance owners exposing PHI-adjacent systems to AI

HIPAA's minimum-necessary rule asks that a workforce member — or an agent acting as one — touch only the PHI the task requires. An MCP connector ignores that by default: ask an agent to "summarize this patient thread" and it can pull an entire mailbox, a full support history, or a warehouse table into its context. The gateway is where the agent channel gets narrowed back to need-to-know.

These policies support alignment with the minimum-necessary and access controls (§164.502(b), §164.514(d), §164.312(a)) on that channel. `cap-bulk-export` clamps how many records a single call returns, so a summary request can't become a bulk pull. `redact-pii-egress` masks identifier patterns in responses before they reach the model. `redact-conversation-pii` does the same for support conversations, and `guard-dm-privacy` fences private-channel reads to an authorized group. Each decision lands in the audit log, which supports the §164.312(b) audit-control expectation.

Be candid about the boundary: this is coverage on the MCP path only. It is not a BAA, it does not encrypt anything at rest or in transit, and it does not certify de-identification. The web UI, the native API, retention, and the physical safeguards are all still yours to handle. The `hipaa` bundle collects the agent-channel policies; treat it as one input to a HIPAA program, not the program.

## Policies in this guide

- [Box: Redact PII from File Content on Egress](https://www.intentbasedpolicy.com/policies/box/redact-pii-egress) — Scans the responses of Box content-returning tools and rewrites personally identifiable information to fixed redaction tokens before the response reaches the…
- [Gmail Cap Bulk Export](https://www.intentbasedpolicy.com/policies/gmail/cap-bulk-export) — Throttles mass-harvesting of a mailbox by capping the per-call blast radius of the two Gmail MCP surfaces that return many full email bodies at once:
- [Intercom: Redact PII from Conversation & Contact Reads](https://www.intentbasedpolicy.com/policies/intercom/redact-conversation-pii) — Scans the free-text returned by Intercom's conversation- and contact-read MCP tools and rewrites high-confidence personal identifiers and credential shapes…
- [Slack: Deny DM and Private-Conversation Reads and Search](https://www.intentbasedpolicy.com/policies/slack/guard-dm-privacy) — Denies the agent read reach into Slack DMs and private conversations on the paths below — the workspace's highest concentration of PII/PHI (HR issues, health…