# Getting a healthcare AI agent through a hospital security review

> A hospital security review is the vendor risk assessment a health system runs before outside software may touch patient data. For an AI agent, the questions that stall a review are about identity and access: which account the agent uses, what it can reach, who approves risky actions and what the logs show. An agent that runs on a clinician's login or a shared account has no good answer to any of them.

By Harsh Mehta, Delegent. Last reviewed: 2026-11-09. Canonical URL: https://usedelegent.com/guides/hospital-security-review-ai-agents

## What the review is

Before a hospital lets a vendor's software near patient data, its security and privacy teams assess the vendor. Some also run an AI governance review for anything that uses a model. The review usually asks for:

- a security questionnaire, either the hospital's own or a standard one
- an independent attestation, commonly a SOC 2 Type II report or HITRUST certification
- a recent penetration test summary
- a data flow diagram showing where patient data goes and where it is stored
- a signed business associate agreement, which [HIPAA requires](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html) when a vendor handles patient data for a covered entity
- for AI, how the model is used, what it can do without a person, and how you manage its risks. Some reviewers map this to the [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework).

Most of that is the same for any healthcare software vendor. The identity and access section is where agents differ from ordinary software.

## The questions agents get stuck on

| What the reviewer asks | The answer that stalls | The answer that passes |
| --- | --- | --- |
| What identity does the agent use in our systems? | A clinician's login, or one shared service account. | Its own registered identity and key, separate for each agent. |
| What can it reach? | Whatever that login allows. | One task at a time: one patient, one action. |
| Who is it acting for, and why? | That isn't recorded. | The clinic, the clinician and the purpose are stated on every call. |
| Who approves a risky action, like submitting a prior auth? | The agent decides. | A named staff member approves with a phishing-resistant sign-in. |
| Where do the credentials live? | In the agent's configuration. | In a key management service. The agent gets a short-lived token for one call. |
| What do the logs show, and can anyone change them? | Application logs we can search. | One tamper-evident record per task that you can verify yourself. |
| What patient data do you keep? | Copies of requests and responses. | Tokenized patient IDs and no clinical payloads. |
| What if the agent is tricked or has a bug? | The model has guardrails. | The limits sit outside the model: a permission check, an approval and a token that works once. |

## Why reviewers ask these

Two parts of the HIPAA Security Rule sit behind most of them. It requires a [unique name or number to identify and track each user](https://www.law.cornell.edu/cfr/text/45/164.312), and audit controls that record activity in systems holding patient data. A hospital has to be able to show which actor did what.

In a [survey of 250 US healthcare leaders](https://hitconsultant.net/2026/09/15/imprivata-report-healthcare-agentic-ai-trust-gap-identity-led-governance-shadow-ai/) (Imprivata, run by Vanson Bourne, September 2026), 35% said their AI agents run on a clinician's delegated login. Another 16% said they use generic or shared accounts.

With a borrowed login, the hospital's own audit log says a clinician did the agent's work. That is the hospital's compliance problem as much as the vendor's, which is why the reviewer pushes on it.

## What to prepare before the questionnaire arrives

1. **Give each agent its own identity.** Register your software with each payer and EHR as software, with your own keys. Don't route through a clinician's account.
2. **Write down what each agent may do.** Which actions, for which clinics, for what purpose, and until when.
3. **Put a person in front of risky actions.** Decide which actions need approval, and record who approved each one.
4. **Move keys out of the agent.** Keep them in a key management service, and give the agent a short-lived token for one call.
5. **Keep an audit trail you can hand over.** See [what the record has to show](https://usedelegent.com/guides/healthcare-ai-agent-audit-trail).
6. **Store less.** Tokenize patient identifiers and don't keep clinical payloads you don't need.
7. **Draw the data flow.** One page showing the agent, your systems, the hospital and the payer, and what crosses each line.
8. **Have the paperwork ready.** A business associate agreement, your attestation report and your penetration test summary.

## If you are the reviewer

Four requests separate vendors who have solved agent identity from vendors who haven't.

- Ask to see one real task from start to finish, including the approval and the record it left.
- Ask what will appear in your EHR's audit log when the agent acts. If the answer is a clinician's name, the agent is using a borrowed login.
- Ask how fast one agent can be cut off without locking out the clinician it works for.
- Ask who at the vendor can edit or delete audit entries, and how you would know.

## If you run a payer API

Client registration is your version of this review. The same questions apply: is this client one company or one agent, who is it acting for, and what will your log say. [How a healthcare AI agent should sign in to payer and EHR APIs](https://usedelegent.com/guides/ai-agent-identity-payer-apis) covers what the standards carry and what they leave out.

## How Delegent helps

Delegent is being built to answer the identity, access and audit section of the review. Every agent gets its own identity and a single-use pass for each call. Risky actions wait for a person's passkey. Keys are non-exportable and separate for every customer and every agent. Each task leaves a hash-chained record that a reviewer can verify. Delegent signs business associate agreements as a subcontractor business associate.

It doesn't replace your SOC 2 report, your penetration test or the rest of the questionnaire. Delegent is pre-launch and looking for its first design partners. If a review is in front of you, [apply to be a design partner](https://usedelegent.com/#design-partners) and bring the questionnaire.

## Questions

### Do we need SOC 2 or HITRUST to sell an AI agent to a hospital?

HIPAA doesn't require either one. Many health systems ask for one of them as independent evidence of your controls, so not having either usually means a longer questionnaire. A business associate agreement is the part HIPAA does require when you handle patient data for the hospital.

### Is a business associate agreement required for an AI agent vendor?

Yes, if the agent creates, receives, maintains or transmits patient data on behalf of a covered entity. That makes the vendor a business associate. Companies the vendor passes that data to need agreements as well.

### Can the agent use the clinician's login if the clinician agrees?

It can work technically. The hospital's log and the payer's log will then say the clinician did everything the agent did, and the hospital can't show which actor did what. Reviewers usually flag that, whether or not the clinician agreed.

### Does an identity layer for agents replace the security review?

No. It answers the identity, access, approval and audit questions, which are the ones agents tend to fail. The hospital still reviews your infrastructure, your data handling, your attestation report and your model governance.

## Sources

- [45 CFR § 164.312, HIPAA Security Rule technical safeguards](https://www.law.cornell.edu/cfr/text/45/164.312)
- [HHS, Business Associates guidance](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html)
- [NIST, AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework)
- [HIT Consultant, Imprivata report on agentic AI in healthcare, September 15, 2026](https://hitconsultant.net/2026/09/15/imprivata-report-healthcare-agentic-ai-trust-gap-identity-led-governance-shadow-ai/)