Preventing PHI leakage between CrewAI agents and tasks under HIPAA

Where PHI moves in a CrewAI workflow

A multi-agent workflow moves data far more often than a single-model application does. PHI that enters at one task can reach other agents, tools and model endpoints through several paths. Each path is a boundary where you can inspect and constrain the data.

The main boundaries are task context passed from one task to the next, memory that more than one agent can read, delegation from one agent to another, tool inputs and outputs, agent-to-agent handoffs, and the prompts sent to model providers. Calls to MCP servers add another path, because tool arguments and results cross a process or network boundary.

The common failure is not a model that misbehaves. It is an agent that receives a full record because that was the easiest thing to pass along. A summarization agent needs a clinical note. A scheduling agent does not. If both receive the same context, the second has gained access it has no function for.

Build the inventory empirically. Run the workflow with synthetic patient records and capture what each agent, tool and model call actually receives at each step. Record which agent has a documented need for each data element. Do not infer behavior from prompt instructions or from how the crew was designed on paper. The inventory is the input to every control that follows.

The HIPAA lens: each receipt of ePHI is a decision

The Security Rule applies to electronic PHI, meaning individually identifiable health information transmitted by or maintained in electronic media. It requires reasonable and appropriate administrative, physical and technical safeguards for the confidentiality, integrity and availability of ePHI, including protection against reasonably anticipated unauthorized uses or disclosures. The technical safeguards in 45 CFR 164.312 apply to covered entities and business associates.

Two principles shape the design. The minimum necessary standard rests on the idea that PHI should not be used or disclosed when it is not necessary for a particular purpose or function. The workforce security standard requires procedures so that people have appropriate access to ePHI and those without access cannot obtain it. Neither text mentions AI agents. Applying them to agents is an interpretation, but a practical one: treat each agent, tool or model call that receives ePHI as an access and disclosure decision, and test it against the minimum necessary standard.

The regulatory discussion of insider leakage is a useful analogy. It notes that preventing leakage by authorized users is difficult and that organizations should consider an insider's interactions with systems and their components. An agent that is authorized to run but receives more than its task needs resembles that case.

Contracts matter too. Covered entities must establish business associate agreements that obligate business associates to safeguard the ePHI they handle. Model and tool providers that receive ePHI in your pipeline may fall within that relationship. Whether a given provider and configuration qualifies is a question for legal review, and it should be settled before PHI reaches the endpoint.