Agents that never carry PHI where it should not go
Clinical, payer and research teams want agents on EHR integrations, claims pipelines and trial data. Prismor decides at the tool call what each agent may read, run and send, and keeps a trail your privacy office can use.
Where agent rollouts stall in healthcare
The agents are ready. The business associate review is not, because nobody can say which systems the agent will touch once it starts working.
PHI in the context window
An agent debugging a claims job reads the fixture, and a patient record is now in the prompt, the transcript and the provider log.
Unvetted MCP servers on clinical systems
FHIR, EHR and lab connectors are being exposed as MCP servers. Each one is a new integration nobody security-reviewed.
No record of what the agent did
Breach investigations and HIPAA audits need the action, not the conversation: which record, which system, which destination.
Controls that stand up to a privacy review
Least privilege for agents, enforced where they act, with evidence attached.
Path and system scoping
Policy names the directories, hosts and MCP tools each agent may use. A research agent does not get the production EHR connector.
Secret and credential cloaking
Database strings and API tokens for clinical systems are replaced with placeholders before the agent sees them.
Tamper-evident audit trail
Hash-chained record of every tool call and decision, exportable as a Proof Pack for a HIPAA security-rule review.
Approvals for sensitive actions
Writes to systems of record or bulk exports go to a named approver, with the outcome logged.
What we see in the field
Three observations from teams in this sector, before the product pitch.
Agents make every developer a PHI handler
A workstation that never touched patient data can now pull a production fixture through an MCP connector in one prompt. The minimum-necessary standard applies to that agent the same way it applies to a person.
The security rule wants the action record
Audit controls under the HIPAA Security Rule ask for a record of activity in systems that hold ePHI. A chat transcript is not that record. A log of which system was read and where data went is.
Vendor agents arrive through the BAA back door
EHR vendors and integration partners are shipping their own agents and MCP servers. Each one is a new business-associate surface unless the covered entity can constrain what it reaches.
How Prismor fits
Prismor sits between the agents your teams already run and the clinical, claims and research systems your privacy program already governs.
Beside the agent
Hooks into Claude Code, Codex, Cursor and agent frameworks, and fronts FHIR, EHR and internal MCP servers through one governed gateway.
Inside your data classification
Policy names the directories, hosts and connectors that carry PHI. Agents are scoped to de-identified or approved sources by default.
Into your compliance file
Tamper-evident trail exports over OCSF to the SIEM and as a Proof Pack for the security-rule risk analysis.
What engineering and security teams get
Tool-call interception
Every shell, file, network and MCP call is checked against signed policy before it runs.
Egress allowlist
Agents reach only approved hosts. Data cannot be posted to an unlisted endpoint, by design or by injection.
Prompt-injection screening
Results coming back from documents, tickets and MCP tools are scanned before they can steer the agent.
MCP gateway
One governed endpoint in front of FHIR, EHR and internal MCP servers, with per-tool allow and deny.
Shadow AI discovery
Find agents, MCP servers and keys running on workstations that were never enrolled.
SIEM export over OCSF
Send agent activity to the SIEM your security operations team already watches.
Agent workflows in healthcare, governed by Prismor
- EHR and FHIR integration work
Coding agents building interfaces without holding live patient data or credentials.
- Claims and billing pipelines
Assistants debugging jobs inside a policy that blocks PHI-bearing paths.
- Clinical trial data engineering
Research agents scoped to de-identified datasets and approved storage.
- Internal support assistants
Retrieval over policies and runbooks, never over patient systems.
- Vendor agent pilots
Observe-only mode to see what a third-party agent tries before granting access.
- Security-rule evidence
A per-agent record of permitted and actual behaviour for the compliance file.
Deployment that fits the boundary
Policy is evaluated where the agent runs. Where the console lives is up to you.
Open-source runtime
The interception layer runs on the developer machine or the agent host. Policy is evaluated locally, so a blocked tool call never leaves the box.
Hosted control plane
Enrol devices and agents to the Prismor console for fleet-wide policy, live activity, approvals and Proof Pack exports.
Self-hosted or on-prem
Run the control plane inside your own VPC or data centre on Enterprise plans, with telemetry routed to your SIEM over OCSF.
Fail closed
If a signed policy cannot be verified or the runtime is tampered with, the agent stops rather than running unchecked.
Frequently asked questions
Is Prismor itself HIPAA compliant?
The hosted control plane is operated under a HIPAA-aligned program and SOC 2 Type 2, and Enterprise customers can run it self-hosted so no telemetry leaves their environment.
Can we block an agent from reading any directory that holds PHI?
Yes. Path rules deny reads and writes to named locations, and the deny happens before the tool call runs, so the data never reaches the model.
What if a tool result contains an injected instruction?
Content returned by MCP servers and files is screened for injection patterns and can be tagged as untrusted. Policy can then block a following high-risk action in the same session.
Do developers have to change how they work?
No. Prismor installs as a hook or gateway in front of the agent they already use. Allowed actions run as before; only policy violations are stopped or routed for approval.
Want a control plane over your AI agents?
Prismor checks every tool call your agents make against your policy, blocks what breaks it, and keeps the audit trail. Run the open-source runtime yourself, or let us set it up across your org.
Or email [email protected]