Integrate HIPAA Compliance
Into Your Workflow via API
Pull the HIPAA Agent Compliance Score™ for any US healthcare provider by NPI. Grade lookups, compliance scans, AI reports, policy generation, training programs, and more.
REST API, MCP Server, A2A Protocol. NPI is the universal key. Metered pricing.
API & Enterprise Pricing
Three tracks. NPI is the universal key.
Free Tier
500 credits. No credit card. Get your key in 30 seconds.
Need more? See our Startup Program
Per-Check API
On-demand compliance data for insurance, legal, and agent integrations.
$5,000 annual minimum (credited against usage)
Request API AccessMSP / Reseller
Manage HIPAA compliance for your client portfolio.
Consumer Plans
Direct plans for individual healthcare practices.
83-tool scan, HIPAA Agent Compliance Score™, top 3 findings, free 30-minute consultation.
22-page signed report with attestation page, audit response readiness, SHA-256 integrity hash. Ready for OCR, insurers, and BAA partners.
Everything — monthly scanning, 24 policies, staff training, BAA management, evidence packages, weekly intelligence, annual SRA, unlimited audit reports, GPT access. $3,588/year via PayPal invoice.
Authentication
Get a free API key instantly above, or contact compliance@hipaaagent.ai for enterprise keys. Include your key in every request via the X-API-Key header. Keys are tied to your billing account.
Rate Limits
Standard: 60 requests/minute. Bulk tier: 600 requests/minute. Rate limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset) included in every response.
Code Examples
curl -X GET "https://hipaaagent.ai/v1/a2a/grade/1234567890" \
-H "X-API-Key: your_api_key" \
-H "Content-Type: application/json"
# Response
# "compliance_score" = HIPAA Agent Compliance Score™ (0-100)
# "grade" = HIPAA Agent Compliance Score™ letter grade (A-F)
{
"npi": "1234567890",
"practice_name": "Sacramento Family Dental",
"compliance_score": 72,
"grade": "C",
"categories": {
"email_security": { "score": 45, "weight": 35 },
"application_security": { "score": 82, "weight": 13 },
"privacy_compliance": { "score": 90, "weight": 10 }
},
"scan_date": "2026-02-28T09:14:34Z"
}import requests
API_KEY = "your_api_key"
BASE = "https://hipaaagent.ai/v1/a2a"
# Dispatch a full compliance scan
resp = requests.post(
f"{BASE}/scans/dispatch",
headers={"X-API-Key": API_KEY},
json={
"npi": "1234567890",
"scan_type": "full",
"callback_url": "https://your-app.com/webhook"
}
)
# 202 Accepted — async scan dispatched
data = resp.json()
# {
# "status": "accepted",
# "job_id": "job_7f3a9bc1d92e",
# "poll_url": "/v1/a2a/jobs/job_7f3a9bc1d92e",
# "estimated_duration_ms": 45000
# }
# Poll for completion
import time
while True:
job = requests.get(
f"{BASE}/../v1/a2a/jobs/{data['job_id']}",
headers={"X-API-Key": API_KEY}
).json()
if job["status"] == "completed":
# grade = HIPAA Agent Compliance Score™ letter grade (A-F)
print(f"Grade: {job['result']['grade']}")
break
time.sleep(5)Webhooks: All async endpoints accept an optional callback_url. When the job completes, we POST the full result to your webhook endpoint.
const response = await fetch('https://hipaaagent.ai/v1/a2a/grade/1234567890', {
headers: { 'X-API-Key': process.env.HIPAA_AGENT_API_KEY }
});
// compliance_score = HIPAA Agent Compliance Score™ (0-100)
// grade = HIPAA Agent Compliance Score™ letter grade (A-F)
const { grade, compliance_score, categories } = await response.json();
console.log(`Grade: ${grade} (${compliance_score}/100)`);Internal Network Scanner
Deploy a local agent inside your network. 12-phase scan covers encryption, MFA, segmentation, asset inventory, and more. Results merge with your external scan for a unified compliance grade.
# Request a deploy token via API curl -X POST "https://hipaaagent.ai/v1/a2a/network/deploy/YOUR_NPI" \ -H "X-API-Key: your_api_key" # Install and run the scanner npx @hipaaagent/network-scanner --key DEPLOY_TOKEN # Or install globally npm install -g @hipaaagent/network-scanner hipaa-scan register --api-key DEPLOY_TOKEN hipaa-scan scan
May 2026 HIPAA Security Rule Coverage
Combined external + internal scanning verifies all 13 requirements.
Integration Protocols
REST API
PrimaryPrimary integration method. JSON request/response, API key authentication, metered billing. Full spec at /openapi-a2a.yaml. View →
MCP Server
AI NativeModel Context Protocol for Claude, ChatGPT, and custom AI assistants. Expose compliance tools natively.
A2A Protocol
Agent EconomyGoogle Agent-to-Agent protocol for direct machine-to-machine compliance task delegation.
Agent Card
DiscoveryDiscoverable at /.well-known/agent-card.json. Describes capabilities, pricing, and rate limits for agent discovery. See our agent card for machine-readable capability discovery. View →
Blockchain Verification
TrustlessDaily SHA-256 root hash of all audit events anchored on Base (Ethereum L2). Verify compliance records independently on Basescan — no trust required. View →
HIPAA Agent is Now Agent-Ready: How AI Agents Can Automate Healthcare Compliance
HIPAA compliance fails because it demands sustained human attention across dozens of tasks. AI agents don't forget, don't miss deadlines, and don't get distracted. REST API, MCP Server, A2A Protocol — three integration paths for the agent economy.
Read the full post →Built For
MSPs
Monitor 100+ clinics from one API. Trigger scans, pull grades, generate reports for your entire client base programmatically.
Insurance
Automate underwriting compliance checks. Pull compliance grades and breach history for any practice by NPI before binding a policy.
DSOs
Standardize compliance across locations. Run scans across every practice in your organization and track remediation centrally.
EHR Vendors
Embed compliance into onboarding. When a new practice joins your EHR, trigger a compliance scan and surface their grade inside your product.
Compliance Consultants
White-label compliance infrastructure. Run scans, generate policies, and deliver evidence packages under your brand for your entire client portfolio.
Legal & M&A
Due diligence automation. Pull compliance grades, breach history, and risk assessments for acquisition targets or litigation support.
JSON-RPC 2.0 Adapter
The A2A endpoint at POST /api/a2a accepts both REST and spec-compliant JSON-RPC 2.0 requests. Batch requests supported.
curl -X POST "https://hipaaagent.ai/api/a2a" \
-H "X-API-Key: your_api_key" \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"method": "hipaa.grade",
"params": { "npi": "1234567890" },
"id": 1
}'
# Response
{
"jsonrpc": "2.0",
"result": {
"npi": "1234567890",
"grade": "C",
"compliance_score": 72,
"categories": { ... }
},
"id": 1
}16 Named Methods
hipaa.scanhipaa.gradehipaa.findingshipaa.breachhipaa.srahipaa.policieshipaa.baahipaa.evidencehipaa.batchhipaa.reputationhipaa.validate_workflowhipaa.breach_probabilityhipaa.vendor_riskhipaa.get_controlshipaa.compliance_statehipaa.compliance_deltaTrust & Transparency
Publicly verifiable reputation stats backed by SHA-256 data integrity hashes. Every number comes from live database queries.
Start Building
Get your free API key instantly. 500 credits, no credit card. Need enterprise volume? Contact sales.