There’s no switch that makes an AI agent HIPAA compliant. What reduces OCR risk-analysis exposure is tokenizing PHI before it reaches an LLM or a tool call, and keeping proof that it happened. VeriSwarm Guard tokenizes PHI at the boundary using Presidio NER — replacing SSNs, MRNs, names, and other identifiers with typed tokens before the model or the downstream tool ever sees the raw value — and Vault chains every tokenization event into a tamper-evident ledger. Both are Max-plan capabilities. Neither certifies compliance on its own; see what this does not do below.
A human clinician typing into an EHR is a known, auditable actor inside a system you already govern. An AI agent handling the same workflow routes PHI through places a human never would: an LLM provider’s inference API, a third-party tool call, an integration’s request log, a debugging trace. Each hop is a new place PHI can leak, and most of them sit outside the access controls a traditional HIPAA risk analysis was built to cover.
None of these require a human insider or an external attacker. They’re what happens when an agent does exactly what it was told, at a speed and scale that makes manual review impossible.
Guard’s PII tokenization runs before text leaves the boundary — before it reaches an LLM, before it reaches a tool call. Presidio NER detection scans outbound text for PHI-shaped values and replaces each one with a typed, session-scoped token. The model and the downstream tool only ever see the token.
POST /v1/suite/guard/pii/tokenize
{
"text": "Patient SSN 555-12-3456, MRN 88213, call at 917-555-0199",
"ttl_seconds": 3600
}
→ {
"tokenized_text": "Patient SSN [VS:SSN:a1b2c3], MRN [VS:ID:d4e5f6],
call at [VS:PHONE:g7h8i9]",
"session_id": "sess_...",
"tokens_created": 3
}Tokens resolve back to their original values only through a separate rehydrate call, scoped to the same session, and only when a downstream write operation genuinely needs the real value — a scheduling system that has to dial an actual phone number, for instance. Every rehydration is itself an event the tenant can audit.
HHS OCR’s enforcement pattern in 2026 has a consistent root cause: failure to conduct an accurate and thorough risk analysis, the single largest category of enforcement action by a wide margin over every other cause combined. A risk analysis is only as strong as the evidence backing it — and an editable log is weak evidence.
Vault chains every tokenization event, every rehydration, and every agent decision with a SHA-256 link to its predecessor. A verification call walks the full chain and reports exactly where it breaks, if it breaks:
GET /v1/suite/vault/verify
→ {
"ok": true,
"events_verified": 41_902,
"first_event_id": "evt_...",
"last_event_id": "evt_...",
"errors": []
}A tenant-scoped PHI inventory (GET /v1/suite/guard/phi-inventory) aggregates the same tokenization signals into a report by PHI type, by agent, and by HIPAA-style sensitivity tier — answering the question a risk analysis has to answer first: where is PHI actually flowing through the agent fleet.
Being direct about the boundary here matters more than the sales pitch. PHI tokenization and Vault’s audit ledger are not a HIPAA compliance certification, a legal opinion, or a substitute for a formal risk analysis. Turning them on does not make a covered entity or business associate HIPAA compliant. HIPAA still requires a risk analysis that actually accounts for your agents, the full technical-safeguards suite under the Security Rule (encryption, access control, integrity, transmission security), a Business Associate Agreement with every party in the data path — model provider included — and policies and training that exist outside any piece of software.
What VeriSwarm does is remove one specific, high-leverage gap: PHI reaching an LLM or tool call untokenized, and an audit log that can’t prove it wasn’t edited after the fact. Everything else in a HIPAA compliance program — scope, BAAs, incident response, workforce training — still has to be built by the team deploying the agents, with counsel involved for anything touching a formal filing or a Corrective Action Plan.
There's no HIPAA-compliance certification a vendor can hand you, and no software feature that makes a covered entity or business associate compliant by itself. What a HIPAA-compliant AI agent workflow requires is a risk analysis that actually accounts for the agent, PHI handled per the Security Rule's technical safeguards (access control, audit controls, integrity, transmission security), and a Business Associate Agreement with anyone touching PHI on your behalf — model provider included. VeriSwarm's role is narrower and concrete: tokenize PHI before it reaches an LLM or tool call, and produce the audit evidence that a risk analysis and a HIPAA audit-controls requirement actually ask for.
Tokenization directly supports two Security Rule technical safeguards: access control (PHI never reaches a system — including a third-party LLM — that shouldn't see it) and audit controls (§164.312(b) requires hardware, software, or procedural mechanisms that record and examine activity in systems containing ePHI). It does not, by itself, satisfy the full technical safeguards suite — encryption in transit and at rest, integrity controls, transmission security, and a signed BAA with every party in the data path still have to be in place independently.
Guard's PII tokenization endpoint (POST /v1/suite/guard/pii/tokenize) runs Presidio NER detection over outbound text and replaces detected values — SSNs, MRNs, names, phone numbers, addresses — with typed tokens like [VS:SSN:a1b2c3], scoped to a session with a configurable TTL (default 1 hour, max 24). The tokenized text is what reaches the LLM or the downstream tool. A separate rehydrate call restores original values only when a write operation legitimately needs them, and every rehydration is itself an auditable event.
When Vault is enabled, every tokenization and rehydration event is written into a hash-chained ledger — each event links to its predecessor's hash, so any retroactive edit breaks the chain visibly. GET /v1/suite/vault/verify walks the full chain and returns ok: true/false with the exact event where verification fails, if it fails. That's the artifact a risk analysis or an OCR audit-controls review can check against, rather than trusting an unverifiable log.
No. PHI tokenization is part of Guard, and the immutable audit ledger is Vault — both are Max-plan capabilities ($299/mo), not included in Gate's free tier. Gate's free tier covers agent trust scoring, event ingestion, and decision checks; PHI handling and the hash-chained evidence trail require Max.
No. A BAA is a legal instrument between a covered entity and anyone creating, receiving, maintaining, or transmitting PHI on its behalf — that requirement doesn't go away because a technical control reduces exposure. If your agent's tool calls, LLM provider, or infrastructure touch PHI, those relationships still need BAAs in place, tokenization or not.
If OCR has already opened a review or requested a Corrective Action Plan, the evidence package looks different from a preventive risk analysis — see OCR Risk-Analysis Enforcement and AI Agents. For the full mapping of OCR’s 2026 enforcement priorities to VeriSwarm capability, start at VeriSwarm for Healthcare.
A 30-minute walkthrough, live against your fleet — not demo data. Guard and Vault are Max-plan capabilities; trust scoring itself is free.