Using LLMs on Reproductive Health PHI: HIPAA Obligations, State-Law Exposure and Runtime Policy Enforcement

What HIPAA requires when an LLM touches PHI

The starting point is 45 CFR 164.502(a): a covered entity or business associate may not use or disclose PHI except as permitted or required by the Privacy Rule or by subpart C of part 160. The rules reach PHI in any form or medium, and failure to comply can bring civil and criminal penalties. Routing PHI through a model does not change that analysis. It adds a processing path that has to fit within a permitted use.

Two practical questions follow. First, is the LLM vendor or hosting arrangement a business associate? Business associates are entities that provide services involving access to PHI, so any vendor that can see prompts, outputs or retrieved records should be evaluated that way, with BAA terms confirmed by counsel. Second, which Security Rule standards apply? Section 164.312(a)(1) limits access to systems maintaining ePHI to persons or software programs that have been granted access rights. Section 164.312(b) requires hardware, software or procedural mechanisms that record and examine activity in systems that contain or use ePHI. Our reading is that agents and tool-calling services fall under the first, and that gateways, retrieval stores and output stores holding ePHI fall under the second.

Reproductive health PHI adds a federal layer. The 2024 final rule, published April 26, 2024 after a 2023 proposal, is reflected in the eCFR text of 164.502(a)(5)(iii) as of October 2026. That text prohibits using or disclosing PHI to conduct, or to impose liability in, a criminal, civil or administrative investigation of any person for the mere act of seeking, obtaining, providing or facilitating reproductive health care. It applies where the entity that received the request has reasonably determined that listed conditions exist, for example that the care was lawful in the state where it was provided. Because the regulatory treatment of this category has been changing, policy for it should be versioned, so that a rule change can be applied and recorded without rebuilding the workflow.

State law and legal process exposure

Federal text is only part of the exposure. The 2024 rule preamble states that state laws requiring use or disclosure of PHI to investigate or impose liability for the mere act of seeking, obtaining, providing or facilitating health care are subject to HIPAA's general preemption provision. It also says state authorities may be able to use other Privacy Rule permissions, such as law enforcement disclosures, where the care at issue is unlawful under the circumstances in which it was provided, and that the rule does not foreclose officials from collecting information from sources HIPAA does not regulate.

The preamble also describes a presumption that applies only where the care was provided by someone other than the regulated entity that received the request. These are fact-dependent determinations about where care occurred, who is asking and whether the care was lawful. A model cannot make them reliably, and an automated policy can only act on record-level attributes that someone has established. Requests tied to legal process or law enforcement that implicate reproductive health care should go to legal review before any LLM-assisted handling.

State requirements vary by jurisdiction and sit alongside HIPAA. Counsel should analyze the health system's footprint, and the outcome should be expressed as policy attributes such as care location and requester type, so enforcement does not depend on individual judgment in the moment.

Controls to enforce at runtime

Blanket permission ignores the added sensitivity of this data. Blanket prohibition removes legitimate uses such as documentation support and operational workflows. The more defensible position is a distinct data category with policy evaluated per interaction, using attributes such as user or agent role, purpose, data category and, where legal process is involved, requester.

The four outcomes map to different situations. Allow applies where role, purpose and category match an approved use. Redact applies where the task can be done without specific elements, for example removing identifiers before a summarization request. Block applies where policy does not permit the use at all, including disclosure paths tied to legal process that have not been reviewed. Escalate applies where a human determination is needed, and the approver, decision and time must be recorded.

Each has a tradeoff. Redaction can reduce clinical usefulness. Escalation adds latency and reviewer workload, so it should be reserved for decisions that need judgment. Blocking without a sanctioned alternative pushes staff toward unmanaged tools. This is design reasoning rather than a legal requirement, but it is how the access-control concept in 164.312(a)(1) translates to software programs acting on records.

The evidence an auditor can use

Policies, BAAs and pre-deployment reviews describe intended behavior. They do not show what a model was permitted to do with a specific record, or what happened. Section 164.312(b) asks for mechanisms that record and examine activity, so the useful question is whether a record exists for each interaction, not only whether logs exist somewhere in the stack.

For each prompt, response or tool call involving reproductive health PHI, the record should show the user or agent identity, the purpose, the data category, the policy version in force, the decision (allow, redact, block or escalate), any redactions applied, any approver and timestamp, and whether the decision was applied before the data moved. A log assembled after the fact can show that something occurred. Evidence produced by enforcement shows that a rule was evaluated and acted on at the time.

Trussed enforces policy in the execution path across models, agents, tools and MCP servers, applying allow, redact, block, rate limit or escalate for human approval to individual interactions and tool calls. Enforced at runtime, not reviewed after the fact, each decision generates audit-ready evidence mapped to HIPAA, including 164.312(b). Deployment is self-managed in the customer cloud, with configurable retention and data residency. Trussed runs in production with healthcare and pharma organizations. Mapping evidence to a standard supports an audit but does not establish compliance by itself.