Deploy AI in a HIPAA-eligible environment with Amazon Quick

Healthcare organizations seek similar benefits from AI as other businesses: quicker responses, reduced manual effort, and timely insights for decision-making. However, healthcare data presents unique challenges due to its complexity, contextual relevance, and strict regulatory requirements. This piece begins by clarifying some terms to provide context.

Protected Health Information (PHI) refers to any data that identifies an individual and pertains to their health, care, or payment for care, including medical notes, claims, or member IDs. When software interacts with PHI, it falls under the Health Insurance Portability and Accountability Act (HIPAA), the federal law governing PHI access, security, and auditing.

Agentic AI alters what it means for software to "touch PHI." Traditional analytics tools simply read data and return a response. In contrast, an agentic workspace like Amazon Quick can do more. For instance, its chat agents can work with both unstructured data, like clinical notes and appeals letters, and structured data, such as claims and member records.

These agents retrieve data from both sources, interact with other systems via connectors, and perform multi-step tasks on behalf of the user. Connectors are pre-built integrations that enable secure reading from and action within external systems, including Slack, Microsoft Outlook, Salesforce, Atlassian Jira, and Microsoft SharePoint.

Custom tools can also be added through Model Context Protocol (MCP). Only authorized connectors are visible in the system. When a chat agent can both read and act on PHI, sufficient governance is required: clear guardrails, an audit trail of the agent's actions, and accountability for actions taken without human intervention. To facilitate this governance, Amazon Quick offers ACL-aware retrieval, chat and feedback logging, and controls over each agent's actions.

Amazon Quick is a HIPAA-eligible service, which applies across its web, desktop, and mobile clients, subject to the shared responsibility model and user configuration. However, this post focuses on the capabilities of the Amazon Quick web version, accessible via a browser. The post starts by defining HIPAA-eligible and HIPAA-compliant.

HIPAA eligibility is an AWS designation indicating that AWS has assessed the service and permits its use for PHI processing under a signed AWS BAA. HIPAA compliance, on the other hand, is a property of the entire environment. While Amazon Quick is HIPAA-eligible, it alone is not enough to ensure HIPAA compliance. The environment must also include proper data classification, correct configuration of controls, and ownership of administrative and physical safeguards, such as workforce training, risk analysis, and breach procedures, which AWS does not handle.