Designing HIPAA-conformant agentic AI architectures on cloud infrastructure on clinical decision support systems

The historical trend of integrating agentic artificial intelligence into clinical decision support systems would represent a paradigm shift of passive and recommendation-based decision support tools to autonomous and goal-oriented workflows capable of dynamic reasoning and action. But the autonomous nature of these agents, as characterized by an iterative process of perception, planning, and use of tools, directly challenges the underlying conditions of the Health Insurance Portability and Accountability Act especially with respect to granular access control, overall auditability, and accountability. Current clinical decision support systems based on clouds have no native constructs to regulate behavior of autonomous agents and hence there is a critical gap between the practical utility of agentic artificial intelligence and the regulatory imperative of HIPAA compliance. The given gap is filled in this paper, as it proposed a new four-part architectural structure that is intended to be used in cloud infrastructure. It includes policy-as-code and granular, dynamic authorization, encrypted episodic memory and patient-specific state retention, immutable and digitally signed action-log and verifiable audit trails, and a supervisory agent to enforce policy in real-time, refresh consent, and identify anomalies. Our reference implementation on a vendor-agnostic cloud stack based on Kubernetes, Dapr, and Open Policy Agent exemplifies a compliant patient-to-clinician data flow. The architecture supports fundamental HIPAA services such as a break-glass access service and a patient consent revocation service thus providing a secure, auditable and accountable basis to deploy autonomous agentic systems in regulated clinical settings.