{"id":"https://openalex.org/W7162127756","doi":"https://doi.org/10.1145/3786335.3813175","title":"A HIPAA-Compliant Architecture for Agentic Clinical AI Systems","display_name":"A HIPAA-Compliant Architecture for Agentic Clinical AI Systems","publication_year":2026,"publication_date":"2026-05-22","ids":{"openalex":"https://openalex.org/W7162127756","doi":"https://doi.org/10.1145/3786335.3813175"},"language":null,"primary_location":{"id":"doi:10.1145/3786335.3813175","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3786335.3813175","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Conference on AI and Agentic Systems","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3786335.3813175","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5134657499","display_name":"HIMANSHU TRIPATHI","orcid":"https://orcid.org/0009-0009-0380-0736"},"institutions":[{"id":"https://openalex.org/I17301866","display_name":"University of Alabama","ror":"https://ror.org/03xrrjk67","country_code":"US","type":"education","lineage":["https://openalex.org/I17301866"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Himanshu Tripathi","raw_affiliation_strings":["Department of Computer Science, The University of Alabama, Tuscaloosa, Alabama, USA"],"raw_orcid":"https://orcid.org/0009-0009-0380-0736","affiliations":[{"raw_affiliation_string":"Department of Computer Science, The University of Alabama, Tuscaloosa, Alabama, USA","institution_ids":["https://openalex.org/I17301866"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5083240694","display_name":"Subash Neupane","orcid":"https://orcid.org/0000-0001-9260-3914"},"institutions":[{"id":"https://openalex.org/I118073183","display_name":"Meharry Medical College","ror":"https://ror.org/00k63dq23","country_code":"US","type":"education","lineage":["https://openalex.org/I118073183"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Subash Neupane","raw_affiliation_strings":["Department of Computer Science and Data Science, Meharry Medical College, Nashville, Tennessee, USA"],"raw_orcid":"https://orcid.org/0000-0001-9260-3914","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Data Science, Meharry Medical College, Nashville, Tennessee, USA","institution_ids":["https://openalex.org/I118073183"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5074949168","display_name":"Sudip Mittal","orcid":"https://orcid.org/0000-0001-9151-8347"},"institutions":[{"id":"https://openalex.org/I17301866","display_name":"University of Alabama","ror":"https://ror.org/03xrrjk67","country_code":"US","type":"education","lineage":["https://openalex.org/I17301866"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sudip Mittal","raw_affiliation_strings":["Department of Computer Science, The University of Alabama, Tuscaloosa, Alabama, USA"],"raw_orcid":"https://orcid.org/0000-0001-9151-8347","affiliations":[{"raw_affiliation_string":"Department of Computer Science, The University of Alabama, Tuscaloosa, Alabama, USA","institution_ids":["https://openalex.org/I17301866"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136811693","display_name":"Shahram Rahimi","orcid":"https://orcid.org/0000-0003-2779-0076"},"institutions":[{"id":"https://openalex.org/I17301866","display_name":"University of Alabama","ror":"https://ror.org/03xrrjk67","country_code":"US","type":"education","lineage":["https://openalex.org/I17301866"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Shahram Rahimi","raw_affiliation_strings":["Department of Computer Science, University of Alabama, Tuscaloosa, Alabama, USA"],"raw_orcid":"https://orcid.org/0000-0003-2779-0076","affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Alabama, Tuscaloosa, Alabama, USA","institution_ids":["https://openalex.org/I17301866"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5136741422","display_name":"Vibhuti Gupta","orcid":"https://orcid.org/0000-0002-6221-4712"},"institutions":[{"id":"https://openalex.org/I55302922","display_name":"The University of Texas Medical Branch at Galveston","ror":"https://ror.org/016tfm930","country_code":"US","type":"education","lineage":["https://openalex.org/I55302922"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Vibhuti Gupta","raw_affiliation_strings":["Department of Biostatistics and Data Science, University of Texas Medical Branch, Galveston, Texas, USA"],"raw_orcid":"https://orcid.org/0000-0002-6221-4712","affiliations":[{"raw_affiliation_string":"Department of Biostatistics and Data Science, University of Texas Medical Branch, Galveston, Texas, USA","institution_ids":["https://openalex.org/I55302922"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"738","last_page":"754"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.2773999869823456,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.2773999869823456,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11636","display_name":"Artificial Intelligence in Healthcare and Education","score":0.13259999454021454,"subfield":{"id":"https://openalex.org/subfields/2718","display_name":"Health Informatics"},"field":{"id":"https://openalex.org/fields/27","display_name":"Medicine"},"domain":{"id":"https://openalex.org/domains/4","display_name":"Health Sciences"}},{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.09839999675750732,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/audit","display_name":"Audit","score":0.5756999850273132},{"id":"https://openalex.org/keywords/pipeline","display_name":"Pipeline (software)","score":0.5112000107765198},{"id":"https://openalex.org/keywords/core","display_name":"Core (optical fiber)","score":0.4341999888420105},{"id":"https://openalex.org/keywords/compliance","display_name":"Compliance (psychology)","score":0.42559999227523804},{"id":"https://openalex.org/keywords/audit-trail","display_name":"Audit trail","score":0.41040000319480896},{"id":"https://openalex.org/keywords/authorization","display_name":"Authorization","score":0.4088999927043915},{"id":"https://openalex.org/keywords/confidentiality","display_name":"Confidentiality","score":0.36910000443458557},{"id":"https://openalex.org/keywords/health-insurance-portability-and-accountability-act","display_name":"Health Insurance Portability and Accountability Act","score":0.3546999990940094},{"id":"https://openalex.org/keywords/corporate-governance","display_name":"Corporate governance","score":0.3528999984264374}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6328999996185303},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.5756999850273132},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.5112000107765198},{"id":"https://openalex.org/C2164484","wikidata":"https://www.wikidata.org/wiki/Q5170150","display_name":"Core (optical fiber)","level":2,"score":0.4341999888420105},{"id":"https://openalex.org/C2781460075","wikidata":"https://www.wikidata.org/wiki/Q1399332","display_name":"Compliance (psychology)","level":2,"score":0.42559999227523804},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.4162999987602234},{"id":"https://openalex.org/C80958533","wikidata":"https://www.wikidata.org/wiki/Q1047174","display_name":"Audit trail","level":3,"score":0.41040000319480896},{"id":"https://openalex.org/C108759981","wikidata":"https://www.wikidata.org/wiki/Q788590","display_name":"Authorization","level":2,"score":0.4088999927043915},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.38920000195503235},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.36910000443458557},{"id":"https://openalex.org/C2778306010","wikidata":"https://www.wikidata.org/wiki/Q606563","display_name":"Health Insurance Portability and Accountability Act","level":3,"score":0.3546999990940094},{"id":"https://openalex.org/C39389867","wikidata":"https://www.wikidata.org/wiki/Q380767","display_name":"Corporate governance","level":2,"score":0.3528999984264374},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.3522000014781952},{"id":"https://openalex.org/C188198153","wikidata":"https://www.wikidata.org/wiki/Q1613840","display_name":"Limiting","level":2,"score":0.3416999876499176},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.3402999937534332},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.33880001306533813},{"id":"https://openalex.org/C123657996","wikidata":"https://www.wikidata.org/wiki/Q12271","display_name":"Architecture","level":2,"score":0.3278000056743622},{"id":"https://openalex.org/C2777402240","wikidata":"https://www.wikidata.org/wiki/Q6783436","display_name":"Masking (illustration)","level":2,"score":0.3098999857902527},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3034000098705292},{"id":"https://openalex.org/C2777896688","wikidata":"https://www.wikidata.org/wiki/Q3773715","display_name":"Clinical governance","level":3,"score":0.2827000021934509},{"id":"https://openalex.org/C180198813","wikidata":"https://www.wikidata.org/wiki/Q121182","display_name":"Information system","level":2,"score":0.28029999136924744},{"id":"https://openalex.org/C3019659195","wikidata":"https://www.wikidata.org/wiki/Q5690566","display_name":"Meaningful use","level":3,"score":0.27320000529289246},{"id":"https://openalex.org/C136197465","wikidata":"https://www.wikidata.org/wiki/Q1729295","display_name":"Variety (cybernetics)","level":2,"score":0.2709999978542328},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.27059999108314514},{"id":"https://openalex.org/C188087704","wikidata":"https://www.wikidata.org/wiki/Q369577","display_name":"Standardization","level":2,"score":0.2685999870300293},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.2662999927997589},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.2572000026702881},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.25699999928474426},{"id":"https://openalex.org/C145642194","wikidata":"https://www.wikidata.org/wiki/Q870895","display_name":"Health informatics","level":3,"score":0.2535000145435333},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.250900000333786}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3786335.3813175","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3786335.3813175","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Conference on AI and Agentic Systems","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3786335.3813175","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3786335.3813175","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Conference on AI and Agentic Systems","raw_type":"proceedings-article"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.6448745131492615,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":12,"referenced_works":["https://openalex.org/W2087834864","https://openalex.org/W4388937234","https://openalex.org/W4390124902","https://openalex.org/W4405674063","https://openalex.org/W4406495757","https://openalex.org/W4407150885","https://openalex.org/W4408876525","https://openalex.org/W4409111965","https://openalex.org/W4415795495","https://openalex.org/W7125494575","https://openalex.org/W7136043530","https://openalex.org/W7155707164"],"related_works":[],"abstract_inverted_index":{"Agentic":[0,38],"AI":[1,39],"systems":[2],"powered":[3],"by":[4],"Large":[5],"Language":[6],"Models":[7],"(LLMs)":[8],"are":[9],"transforming":[10],"clinical":[11,96],"workflows,":[12],"yet":[13],"their":[14],"autonomous":[15],"handling":[16],"of":[17],"Protected":[18],"Health":[19],"Information":[20],"(PHI)":[21],"creates":[22],"critical":[23],"HIPAA":[24],"compliance":[25,43,75],"vulnerabilities":[26],"that":[27,107],"existing":[28],"frameworks":[29],"fail":[30],"to":[31],"address.":[32],"This":[33],"paper":[34],"introduces":[35],"a":[36,55],"HIPAA-compliant":[37],"framework":[40],"enforcing":[41],"regulatory":[42],"through":[44],"three":[45],"core":[46],"mechanisms:":[47],"Attribute-Based":[48],"Access":[49],"Control":[50],"for":[51,74,117],"dynamic":[52],"PHI":[53,91,112],"governance,":[54],"hybrid":[56],"regex":[57],"and":[58,67,70,95,102,120],"BERT-based":[59],"sanitization":[60],"pipeline":[61],"delivering":[62],"defense-in-depth":[63],"redaction":[64],"across":[65,86],"pre":[66],"post-inference":[68],"stages,":[69],"immutable":[71],"audit":[72],"trails":[73],"verification.":[76],"We":[77],"evaluate":[78],"end-to-end":[79],"system":[80],"effectiveness":[81],"on":[82],"MIMIC-IV":[83],"discharge":[84],"summaries":[85],"107,800":[87],"runs,":[88],"measuring":[89],"policy-consistent":[90],"exposure,":[92],"residual":[93],"leakage,":[94],"utility":[97,116],"under":[98,123],"multiple":[99],"authorization":[100],"settings":[101],"ablations.":[103],"The":[104],"results":[105],"show":[106],"layered":[108],"governance":[109],"substantially":[110],"reduces":[111],"exposure":[113],"while":[114],"preserving":[115],"authorized":[118],"roles,":[119],"remains":[121],"resilient":[122],"prompt-injection":[124],"stress":[125],"tests.":[126]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-05-23T00:00:00"}