Traccia is an observability and governance platform. The HIPAA module adds registry fields, safeguard checklists, customer vendor BAA tracking, soft PHI warnings, and labeled exports for teams that govern healthcare AI agents. It helps you collect and organize evidence. It does not certify HIPAA compliance, file with OCR, or replace your legal or GRC program.

Not Legal Advice

Obligations under HIPAA depend on whether you are a Covered Entity or Business Associate, whether data is PHI, and how your agents and vendors handle that data. There is no federal HIPAA certification. Work with qualified counsel. Enabling the Traccia HIPAA module does not make your organization HIPAA compliant.

Business Associate Agreement (BAA)

Traccia does not currently offer a signed BAA. You may still use Traccia to govern agents — we warn about PHI risk rather than hard-blocking ingestion. Prefer minimum necessary data and SDK redaction where appropriate. Contact support@traccia.ai or use Request Healthcare Follow-up in Settings → Compliance or Governance Hub → HIPAA for healthcare onboarding and the BAA roadmap. Shared responsibility: Trust Center.

What the Module Is and Is Not

Traccia provides	Traccia does not provide
AI system registry with customer-declared PHI flags, categories, and role hints	Legal determination that HIPAA applies or that data is PHI
Safeguards checklist drafts for administrative, technical, physical, and Privacy themes	A complete Security Rule risk analysis or workforce training LMS
Inventory of your vendors' BAA status for model APIs, vector databases, and more	A signed Traccia BAA — deferred; contact support@traccia.ai
Soft PHI warnings in Hub and optional SDK notices — warn, do not block	Hard-blocking of PHI in traces
JSON audit bundles with 45 CFR labels, safeguard drafts, and vendor rows	OCR breach notification filings or patient rights portals
SDK best-effort redaction via regex and hipaa.* span attributes	A guarantee that all PHI is removed — not medical NER
Enterprise retention options useful for ~6-year documentation practice	Legal advice that six years is required for every artifact

Who This Is For

Covered Entities and Business Associates building or deploying AI agents that may handle PHI — use Traccia for agent inventory, oversight, and evidence alongside counsel and broader HIPAA/GRC tools.
Healthcare product teams who want clear shared-responsibility docs and a path to talk to Traccia about future BAA / healthcare onboarding.
Everyone else: leave the module off if you do not need HIPAA-oriented Hub features. Core governance stays available.

Enable the Module

The module is disabled by default. Traccia never turns it on based on IP or locale. An org admin must opt in.

Sign in to the app → Settings → Compliance (/settings?section=compliance).
Optionally set Primary operating region to US for a suggestion to enable HIPAA (suggestion only — never auto-enabled).
Turn on Show HIPAA Features. The toggle merges with any EU AI Act framework already enabled — both can be on at once.

SDK vs Dashboard

Enabling the module in the dashboard unlocks HIPAA UI and export labels. Optionally pass compliance={"frameworks": ["hipaa"]} in traccia.init() (and prefer redact_pii=True) to stamp hipaa.* attributes on spans.

Typical Workflow

Register AI systems and set Handles PHI, optional PHI categories, and role hint when the module is on.
Instrument with redaction where appropriate — soft warnings only; Traccia does not refuse PHI payloads.
Complete the safeguards checklist (agent inventory + status notes) and track vendor BAAs under Governance Hub → HIPAA (/governance?tab=hipaa).
Use Reviews / Incidents for oversight and internal issue tracking (incidents are not OCR filings).
Export a HIPAA-labeled evidence pack for auditors or your GRC tool (e.g. Vanta/Drata) — complementary, not a full replacement.
Contact Traccia via the in-app CTA or support@traccia.ai if you need a BAA or dedicated healthcare onboarding.

CFR Mapping: What the Evidence Actually Covers

HIPAA audit bundles attach labels describing how sections relate to common Security and Privacy themes. Below is what those labels mean in practice — operational evidence only.

Theme	Typical obligation	What Traccia contributes
45 CFR 164.308(a)(1)	Risk analysis / inventory of systems that may handle ePHI	AI system registry with PHI flags/categories; checklist inventory step
45 CFR 164.308	Administrative safeguards (policies, access, vendor oversight)	Safeguard checklist drafts; customer vendor BAA inventory
45 CFR 164.312	Technical safeguards (authn, audit controls, integrity)	Audit events, review/incident samples; SDK integrity helpers where enabled
45 CFR 164.310	Physical / hosting safeguards	Checklist place to record hosting/region notes
45 CFR 164.502(b)	Minimum necessary	PHI flags, vendor inventory pointers, best-effort SDK redaction
Breach Notification Rule	Investigate and notify when PHI is compromised	Internal Hub incidents (not OCR filings)
45 CFR 164.316	Documentation retention practices	Retention configuration + Hub warning when below common ~6-year practice

Traccia does not address OCR filings, patient rights portals, or a signed Traccia BAA today. Treat exports as input to your compliance program.

Evidence Pack Contents

A HIPAA audit bundle includes the standard governance snapshot plus:

hipaa_cfr_mapping — labels above
PHI fields on registered AI systems (handles_phi, categories, role hint)
Recent safeguard checklist drafts and customer vendor BAA inventory rows
traccia_baa_available: false and an explicit disclaimer

SDK Example

clinical_assistant.py

python

from traccia import init, observe

init(
    compliance={"frameworks": ["hipaa"]},
    redact_pii=True,  # recommended when HIPAA framework is on
)

@observe()
def clinical_assistant(user_message: str) -> str:
    # Prefer minimum necessary PHI in prompts and traces.
    # redact_pii best-effort masks emails, phones, SSN-like, MRN/NPI/DOB heuristics.
    return f"Acknowledged: {user_message[:200]}"

Redaction uses best-effort regex patterns (email, phone, SSN-like, MRN/NPI/DOB heuristics). It is not a medical NER and does not guarantee removal of all PHI.

Combine With Other Tools

Traccia focuses on AI agent governance and evidence. Pair it with:

Qualified healthcare counsel for BAAs, risk analysis, and breach processes
Org-wide GRC platforms (e.g. Vanta, Drata) for broader control tracking
HIPAA-eligible cloud services and model vendors under your own BAAs

HIPAA Controls for AI Agents