HIPAA Compliance
Review HIPAA compliance requirements, request a BAA, and configure data handling for each eligible agent.
On this page
Runbear supports HIPAA compliance for eligible Enterprise organizations with a BAA and supported configuration. Runbear must enable organization access, and each agent must be configured individually. An Enterprise subscription does not enable this automatically.
A Business Associate Agreement (BAA) is available on request for qualifying workflows. Start by reviewing your intended use with Runbear rather than uploading protected health information (PHI) to a standard agent.
Book a HIPAA compliance consultation with Snow to discuss your workflow, BAA, and supported configuration.
Before you begin#
Use this checklist with the person responsible for security and privacy at your organization:
- Confirm Enterprise eligibility and the scope of your workflow with Runbear.
- Request a BAA and confirm the applicable agreement is in place before using PHI.
- Have Runbear enable HIPAA access for your organization.
- Review the model, provider credentials, knowledge sources, tools, and channels that will handle the data.
- Create or configure an eligible agent in HIPAA mode, then test it with non-sensitive sample data.
Enable HIPAA mode#
Create a new agent#
- Open Agents and select Create Agent.
- Choose the Standard runtime option explicitly labeled for HIPAA.
- Confirm the agent's data handling is HIPAA before connecting sensitive sources or deploying it through Chatbots.
If the HIPAA option is missing, contact Runbear to confirm organization access and the supported runtime. Do not use Classic as a substitute.
The Standard runtime choice and Standard data handling are different settings. A Standard runtime agent can use HIPAA data handling; an agent left in Standard data handling does not become a HIPAA agent because another agent in the organization uses that mode.
Change an existing agent#
Open the agent's Settings tab and find Data handling. For a supported agent, choose HIPAA and review the confirmation before saving.
Changing an existing agent can require knowledge migration and re-sync. Sources may be temporarily unavailable, and unsupported legacy knowledge configurations must be resolved first. Coordinate the change before a production workflow depends on the agent.
Supported processing and integrations#
| Area | What to check |
|---|---|
| Agent runtime | HIPAA mode requires the supported Anthropic runtime. Use the creation option labeled for HIPAA; Classic and Claude Agent SDK runtimes are not covered by this mode. |
| Models | Use a model supported for your HIPAA configuration. Claude Fable models are excluded. A model appearing elsewhere in Runbear is not confirmation that it is covered. |
| Runbear-provided credentials | HIPAA agents use separate managed Anthropic credentials. Confirm the supported configuration with Runbear. |
| Your own Anthropic key | You are responsible for the applicable BAA with Anthropic. Using your own key does not remove Runbear's runtime or model restrictions. |
| Knowledge | HIPAA agents use a separate PostgreSQL-backed retrieval path. Review each source before connecting it; switching an existing agent can require re-sync. This is not a promise that knowledge processing involves no third parties. |
| Chat attachments | HIPAA agents do not process channel attachments through the Anthropic attachment-upload path. Use the agent's Knowledge workflow for supported reference material instead. |
| Hosted code execution | Anthropic-hosted code execution is disabled for HIPAA agents. |
| Channels and external tools | Review each destination and integration separately, including the provider's contract and settings. An available connector is not automatically covered by your HIPAA arrangement. |
| Hooks | Hooks can run for HIPAA agents. Invocation tracing records handler, status, and latency without content; returned context becomes part of the prompt. Your hook endpoint and any services it calls need their own review. |
Data handling and retention#
HIPAA mode is not a zero-storage mode. HIPAA agents use a separate protected tracing path instead of ordinary Langfuse ingestion. Do not assume that disabling ordinary ingestion means prompts, replies, or all operational records are absent.
Review these data categories separately during setup:
- Conversation content and temporary message caches.
- Execution traces and configuration-change audit logs.
- Uploaded files, indexed knowledge, and long-term memory.
- Data sent to model providers, source systems, channels, tools, and hooks.
- Backups, deletion requests, and data created before the mode change.
The general FAQ and Traces API describe different data categories. Their retention descriptions are not a blanket HIPAA retention commitment. Confirm the applicable retention and deletion terms for your workflow with Runbear before using PHI.
Changing an agent's settings does not change the contracts or retention settings of an external service. The subprocessor list and Trust Center support that review.
Verify the setup#
Before using live data, reopen the agent's settings and confirm HIPAA data handling is selected. Test its knowledge retrieval, tool calls, and destination channel using non-sensitive sample data. Confirm that the selected model and credentials match the configuration reviewed with Runbear.
Repeat the scope review when adding a source, tool, channel, or provider key. Enabling the mode for one agent does not cover other agents automatically.