HIPAA

Technical safeguards alignment

Enforcing minimum necessary with Gateco policies

Example: restrict PHI access to clinical staff only

{
  "name": "PHI access — clinical staff only",
  "effect": "allow",
  "rules": [{
    "conditions": [
      {"field": "resource.classification", "operator": "eq", "value": "phi"},
      {"field": "principal.groups", "operator": "contains", "value": "clinical-staff"}
    ]
  }],
  "selectors": [{"connector_type": "pgvector"}]
}

Pair with a deny policy for restricted classifications to ensure PHI never flows to unauthorized principals, even if a future allow policy is misconfigured.

Frequently asked questions

Is a HIPAA Business Associate Agreement (BAA) available?

A HIPAA BAA is on our roadmap. Contact enterprise@gateco.ai to discuss your timeline and current controls. Many customers use Gateco's deny-by-default model and ABAC policies today for PHI access control before formal BAA availability.

How does Gateco's architecture support the HIPAA minimum necessary standard?

The minimum necessary standard requires limiting access to PHI to the minimum required to accomplish a purpose. Gateco's late-binding authorization enforces this at retrieval: policy conditions can classify documents as PHI and limit access to principals with specific clinical roles, ensuring AI applications only retrieve the specific records a given user is authorized to see.

Can I classify PHI documents in Gateco and restrict access to authorized users?

Yes. Use resource classification (e.g. classification=phi or classification=restricted) combined with ABAC conditions on principal attributes like role or department. A policy allowing only principals with role=clinician to retrieve resources with classification=phi enforces the minimum necessary standard at the retrieval layer.

BAA roadmap

We are targeting HIPAA BAA availability alongside our SOC 2 Type II certification (H2 2026). Enterprise customers with active HIPAA requirements can contact enterprise@gateco.ai to discuss current controls, timeline, and whether Gateco's existing technical safeguards are sufficient for their use case under a custom agreement.