Integrate HIPAA Compliance
Into Your Workflow via API
Pull the HIPAA Agent Compliance Score™ for any US healthcare provider by NPI. Grade lookups, compliance scans, AI reports, policy generation, training programs, and more.
REST API, MCP Server, A2A Protocol. NPI is the universal key. Metered pricing.
API & Enterprise Pricing
Three tracks. NPI is the universal key.
Per-Check API
On-demand compliance data for insurance, legal, and agent integrations.
$5,000 annual minimum (credited against usage)
Request API AccessMSP / Reseller
Manage HIPAA compliance for your client portfolio.
Consumer Plans
Direct plans for individual healthcare practices.
Monthly external scan, HIPAA Agent Compliance Score™, PDF report, breach alerts.
comprehensive multi-tool external + 12-phase internal scan, 27 questions, AI-generated SRA report, 30-day email sequence.
Everything — monthly scanning, 24 policies, staff training, BAA management, evidence packages, weekly intelligence, annual SRA refresh, GPT access.
Authentication
Request an API key at compliance@hipaaagent.ai. Include your key in every request via the X-API-Key header. Keys are tied to your billing account.
Rate Limits
Standard: 60 requests/minute. Bulk tier: 600 requests/minute. Rate limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset) included in every response.
Code Examples
curl -X GET "https://hipaaagent.ai/v1/a2a/grade/1234567890" \
-H "X-API-Key: your_api_key" \
-H "Content-Type: application/json"
# Response
# "compliance_score" = HIPAA Agent Compliance Score™ (0-100)
# "grade" = HIPAA Agent Compliance Score™ letter grade (A-F)
{
"npi": "1234567890",
"practice_name": "Sacramento Family Dental",
"compliance_score": 72,
"grade": "C",
"categories": {
"email_security": { "score": 45, "weight": 35 },
"application_security": { "score": 82, "weight": 13 },
"privacy_compliance": { "score": 90, "weight": 10 }
},
"scan_date": "2026-02-28T09:14:34Z"
}import requests
API_KEY = "your_api_key"
BASE = "https://hipaaagent.ai/v1/a2a"
# Dispatch a full compliance scan
resp = requests.post(
f"{BASE}/scans/dispatch",
headers={"X-API-Key": API_KEY},
json={
"npi": "1234567890",
"scan_type": "full",
"callback_url": "https://your-app.com/webhook"
}
)
# 202 Accepted — async scan dispatched
data = resp.json()
# {
# "status": "accepted",
# "job_id": "job_7f3a9bc1d92e",
# "poll_url": "/v1/a2a/jobs/job_7f3a9bc1d92e",
# "estimated_duration_ms": 45000
# }
# Poll for completion
import time
while True:
job = requests.get(
f"{BASE}/../v1/a2a/jobs/{data['job_id']}",
headers={"X-API-Key": API_KEY}
).json()
if job["status"] == "completed":
# grade = HIPAA Agent Compliance Score™ letter grade (A-F)
print(f"Grade: {job['result']['grade']}")
break
time.sleep(5)Webhooks: All async endpoints accept an optional callback_url. When the job completes, we POST the full result to your webhook endpoint.
const response = await fetch('https://hipaaagent.ai/v1/a2a/grade/1234567890', {
headers: { 'X-API-Key': process.env.HIPAA_AGENT_API_KEY }
});
// compliance_score = HIPAA Agent Compliance Score™ (0-100)
// grade = HIPAA Agent Compliance Score™ letter grade (A-F)
const { grade, compliance_score, categories } = await response.json();
console.log(`Grade: ${grade} (${compliance_score}/100)`);Internal Network Scanner
Deploy a local agent inside your network. 12-phase scan covers encryption, MFA, segmentation, asset inventory, and more. Results merge with your external scan for a unified compliance grade.
# Request a deploy token via API curl -X POST "https://hipaaagent.ai/v1/a2a/network/deploy/YOUR_NPI" \ -H "X-API-Key: your_api_key" # Install and run the scanner npx @hipaaagent/network-scanner --key DEPLOY_TOKEN # Or install globally npm install -g @hipaaagent/network-scanner hipaa-scan register --api-key DEPLOY_TOKEN hipaa-scan scan
May 2026 HIPAA Security Rule Coverage
Combined external + internal scanning verifies all 13 requirements.
Integration Protocols
REST API
PrimaryPrimary integration method. JSON request/response, API key authentication, metered billing. Full spec at /openapi-a2a.yaml. View →
MCP Server
AI NativeModel Context Protocol for Claude, ChatGPT, and custom AI assistants. Expose compliance tools natively.
A2A Protocol
Agent EconomyGoogle Agent-to-Agent protocol for direct machine-to-machine compliance task delegation.
Agent Card
DiscoveryDiscoverable at /.well-known/agent-card.json. Describes capabilities, pricing, and rate limits for agent discovery. See our agent card for machine-readable capability discovery. View →
HIPAA Agent is Now Agent-Ready: How AI Agents Can Automate Healthcare Compliance
HIPAA compliance fails because it demands sustained human attention across dozens of tasks. AI agents don't forget, don't miss deadlines, and don't get distracted. REST API, MCP Server, A2A Protocol — three integration paths for the agent economy.
Read the full post →Built For
MSPs
Monitor 100+ clinics from one API. Trigger scans, pull grades, generate reports for your entire client base programmatically.
Insurance
Automate underwriting compliance checks. Pull compliance grades and breach history for any practice by NPI before binding a policy.
DSOs
Standardize compliance across locations. Run scans across every practice in your organization and track remediation centrally.
EHR Vendors
Embed compliance into onboarding. When a new practice joins your EHR, trigger a compliance scan and surface their grade inside your product.
Compliance Consultants
White-label compliance infrastructure. Run scans, generate policies, and deliver evidence packages under your brand for your entire client portfolio.
Legal & M&A
Due diligence automation. Pull compliance grades, breach history, and risk assessments for acquisition targets or litigation support.
JSON-RPC 2.0 Adapter
The A2A endpoint at POST /api/a2a accepts both REST and spec-compliant JSON-RPC 2.0 requests. Batch requests supported.
curl -X POST "https://hipaaagent.ai/api/a2a" \
-H "X-API-Key: your_api_key" \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"method": "hipaa.grade",
"params": { "npi": "1234567890" },
"id": 1
}'
# Response
{
"jsonrpc": "2.0",
"result": {
"npi": "1234567890",
"grade": "C",
"compliance_score": 72,
"categories": { ... }
},
"id": 1
}16 Named Methods
hipaa.scanhipaa.gradehipaa.findingshipaa.breachhipaa.srahipaa.policieshipaa.baahipaa.evidencehipaa.batchhipaa.reputationhipaa.validate_workflowhipaa.breach_probabilityhipaa.vendor_riskhipaa.get_controlshipaa.compliance_statehipaa.compliance_deltaTrust & Transparency
Publicly verifiable reputation stats backed by SHA-256 data integrity hashes. Every number comes from live database queries.
Request API Access
Contact us for API keys, enterprise pricing, or partnership inquiries. NPI-based metered billing — no per-practice licensing.