A HIPAA-Aware Agentic AI Co-Pilot Framework: Orchestrating Secure Multi-Step EHR Workflows for Clinical Burden Reduction in U.S. Hospital Systems
Abstract
Physician burnout has reached crisis proportions, with 43.2% of U.S. clinicians reporting symptoms in 2024, driven primarily by excessive electronic health record (EHR) documentation consuming over 13 hours weekly. This research presents a novel policy-aware agentic artificial intelligence framework that operates as a "digital teammate" within existing hospital EHR infrastructures via standards-based FHIR (Fast Healthcare Interoperability Resources) APIs. Unlike conventional single-point AI features, our architecture orchestrates complex multi-step clinical workflows, including lab result follow-up automation, appointment logistics coordination, proactive patient messaging, and care-gap identification, while enforcing HIPAA (Health Insurance Portability and Accountability Act) compliance through role-based access control (RBAC), k-anonymity de-identification (k≥5), and AES-256/TLS 1.3 encryption protocols. Evaluation using simulated Epic-equivalent EHR data (n=12,847 patient encounters) demonstrated 62% reduction in documentation time (from 2.1 to 0.8 hours per clinician daily), 89% accuracy in care-gap detection, and zero PHI exposure incidents across 50,000 agent transactions. Comparative analysis against baseline GPT-4 implementations revealed 94% fewer HIPAA violations and 78% improved task completion safety. This work establishes the first empirically validated blueprint for deploying constrained agentic AI co-pilots in U.S. healthcare, with projected annual cost savings of $47,000 per physician through reclaimed clinical time and anticipated 30% reduction in burnout rates.
Keywords: Agentic Artificial Intelligence, HIPAA Compliance, Electronic Health Records, FHIR Interoperability, Clinical Workflow Automation, Physician Burnout Mitigation, Role-Based Access Control, Healthcare AI Safety, Protected Health Information Security, Care Coordination Optimization, EHR Management
Keywords:
Agentic Artificial Intelligence, HIPAA Compliance, Electronic Health Records, FHIR Interoperability, Clinical Workflow Automation, Physician Burnout Mitigation, Role-Based Access Control, Healthcare AI Safety, Protected Health Information Security, Care Coordination Optimization, EHR ManagementDOI
https://doi.org/10.22270/jddt.v16i3.7649References
1. American Medical Association, American Medical Association. Doctors work fewer hours, but the EHR still follows them home. American Medical Association [Internet]. 2025 Aug 19; Available from: https://www.ama-assn.org/practice-management/physician-health/doctors-work-fewer-hours-ehr-still-follows-them-home
2. Holmgren AJ, Sinsky CA, Rotenstein L, Apathy NC. National Comparison of Ambulatory Physician Electronic Health Record Use across Specialties. Journal of General Internal Medicine [Internet]. 2024 Jul 9;39(14):2868–70. DOI: https://doi.org/10.1007/s11606-024-08930-4
3. Sinsky C, Colligan L, Li L, Prgomet M, Reynolds S, Goeders L, et al. Allocation of physician time in ambulatory practice: A time and motion study in 4 specialties. Annals of Internal Medicine [Internet]. 2016 Sep 5;165(11):753–60. DOI: https://doi.org/10.7326/m16-0961
4. Wu Y, Wu M, Wang C, Lin J, Liu J, Liu S. Evaluating the prevalence of burnout among health care professionals related to electronic health record use: Systematic Review and Meta-Analysis. JMIR Medical Informatics [Internet]. 2024 Apr 17;12:e54811. DOI: https://doi.org/10.2196/54811
5. Mustafa O, Daoud YJ. Herbert Pits in Trachoma infection. Mayo Clinic Proceedings [Internet]. 2020 Jan 1;95(1):134–5. DOI: https://doi.org/10.1016/j.mayocp.2019.10.027
6. Holmgren AJ, Adler-Milstein J, Apathy NC. Electronic health record documentation burden crowds out health information exchange use by primary care physicians. Health Affairs [Internet]. 2024 Nov 1;43(11):1538–45. DOI: https://doi.org/10.1377/hlthaff.2024.00398
7. Patel BN, Rosenberg L, Willcox G, Baltaxe D, Lyons M, Irvin J, et al. Human–machine partnership with artificial intelligence for chest radiograph diagnosis. Npj Digital Medicine [Internet]. 2019 Nov 18;2(1):111. DOI: https://doi.org/10.1038/s41746-019-0189-7
8. Investigators W the H, Ancker JS, Edwards A, Nosal S, Hauser D, Mauer E, et al. Effects of workload, work complexity, and repeated alerts on alert fatigue in a clinical decision support system. BMC Medical Informatics and Decision Making [Internet]. 2017 Apr 10;17(1):36. DOI: https://doi.org/10.1186/s12911-017-0430-8
9. Wong A, Otles E, Donnelly JP, Krumm A, McCullough J, DeTroyer-Cooley O, et al. External validation of a widely implemented proprietary sepsis prediction model in hospitalized patients. JAMA Internal Medicine [Internet]. 2021 Jun 21;181(8):1065–70. DOI: https://doi.org/10.1001/jamainternmed.2021.2626
10. Hubinger E, Denison C, Mu J, Lambert M, Tong M, MacDiarmid M, et al. Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training. arXiv (Cornell University) [Internet]. 2024 Jan 10; DOI: http://arxiv.org/abs/2401.05566
11. Office of the National Coordinator for Health Information Technology. (2020). 21st century cures act: Interoperability, information blocking, and the ONC health IT certification program (85 Fed. Reg. 25642). U.S. Department of Health and Human Services [Internet]. Available from: https://www.federalregister.gov/documents/2020/05/01/2020-07419/21st-century-cures-act-interoperability-information-blocking-and-the-onc-health-it-certification
12. Centers for Medicare & Medicaid Services. (2024). Medicare and Medicaid programs; Patient protection and affordable care act; Interoperability and prior authorization final rule (CMS-0057-F). Federal Register, 89 FR 8758. [Internet]. Available from:https://www.federalregister.gov/documents/2024/02/08/2024-00895/medicare-and-medicaid-programs-patient-protection-and-affordable-care-act-interoperability-and
13. Blauer T. US Acute Care EHR market share 2024 [Internet]. KLAS Report. 2024. Available from: https://klasresearch.com/report/us-acute-care-ehr-market-share-2024-large-organizations-drive-market-energy/3333
14. McAlearney AS, Hefner JL, Sieck CJ, Huerta TR. The Journey through Grief: Insights from a Qualitative Study of Electronic Health Record Implementation. Health Services Research [Internet]. 2014 Sep 15;50(2):462–88. DOI: https://doi.org/10.1111/1475-6773.12227
15. Holmgren, A. J., Adler-Milstein, J., & McCullough, J. S. Are all certified EHRs created equal? Assessing vendor performance. Health Affairs, [Internet] (2020) 39(3), 395–403. DOI: https://doi.org/10.1377/hlthaff.2019.01118
16. Health Level Seven International. (2019). FHIR release 4 (R4). [Internet]. Available from: https://hl7.org/fhir/R4/
17. Bender D, Sartipi K. HL7 FHIR: An agile and RESTful approach to healthcare information Exchange [Internet]. 26th ed. Vols. 326–331, Proceedings of the 26th IEEE International Symposium on Computer-Based Medical Systems. IEEE; 2013. DOI: https://doi.org/10.1109/cbms.2013.6627810
18. State of FHIR survey 2024. Firely. [Internet] (2024). Available from:https://fire.ly/resources/state-of-fhir-survey-2024/
19. Health Level Seven International. [Internet] (2024). FHIR implementation guide registry. Available from: https://hl7.org/fhir/implementationguides.html
20. Mandel JC, Kreda DA, Mandl KD, Kohane IS, Ramoni RB. SMART on FHIR: a standards-based, interoperable apps platform for electronic health records. Journal of the American Medical Informatics Association [Internet]. 2016 Feb 17;23(5):899–908. DOI: https://doi.org/10.1093/jamia/ocv189
21. Xi Z, Chen W, Guo X, He W, Ding Y, Hong B, et al. The rise and Potential of large Language Model Based Agents: A survey. arXiv (Cornell University) [Internet]. 2023 Sep 14; DOI: http://arxiv.org/abs/2309.07864
22. Singhal K, Azizi S, Tu T, Mahdavi SS, Wei J, Chung HW, et al. Large language models encode clinical knowledge. Nature [Internet]. 2023 Jul 12;620(7972):172–80. DOI: https://doi.org/10.1038/s41586-023-06291-2
23. Association of American Medical Colleges. The complexities of physician supply and demand: projections from 2022 to 2037. 2024. Available from: https://www.aamc.org/media/75236/download
24. Kane CK. Policy research perspectives: updated data on physician compensation. Chicago (IL): American Medical Association; 2023. Available from: https://www.ama-assn.org/system/files/ama-physician-compensation-report-2023.pdf
25. Adler-Milstein J, Holmgren AJ, et al. Cumulative time to chart closure and physician burnout. J Gen Intern Med. 2024. DOI: https://doi.org/10.1007/s11606-024-08929-x
26. Gardner RL, Cooper E, Haskell J, Harris DA, Poplau S, Kroth PJ, Linzer M. Physician preferences for after-hours documentation and the association with burnout. J Gen Intern Med. 2024. DOI: https://doi.org/10.1007/s11606-024-08931-3
27. Holmgren AJ, Downing NL, Tang M, Sharp C, Longhurst C, Huckman RS. Association of team-based documentation support with physician electronic health record use and visit volume: a national difference-in-differences analysis. JAMA Netw Open. 2023;6(2):e230210. DOI: https://doi.org/10.1001/jamanetworkopen.2023.0210
28. Wong A, Otles E, Donnelly JP, Krumm A, McCullough J, DeTroyer-Cooley O, et al. External validation of a widely implemented proprietary sepsis prediction model in hospitalized patients. JAMA Intern Med. 2021;181(8):1065–1070. DOI: https://doi.org/10.1001/jamainternmed.2021.2626
29. Institute for Healthcare Improvement Lucian Leape Institute. Generative artificial intelligence and patient safety: a framework for safe adoption. Boston (MA): Institute for Healthcare Improvement; 2024. Available from: https://www.ihi.org/resources/Pages/Publications/Generative-AI-and-Patient-Safety.aspx
30. Park PS, Shumailov I, Zhao M, Papernot N, Anderson R. AI deception: a survey of examples, risks, and potential solutions. Patterns. 2024;5(1):100905. DOI: https://doi.org/10.1016/j.patter.2023.100905
31. Sendak MP, D’Arcy J, Kashyap S, Gao M, Nichols M, Corey K, Ratliff W. A path for translation of machine learning products into healthcare delivery. EMJ Innov. 2020;4(1):22–30. DOI: https://doi.org/10.33590/emjinnov/20-00123
32. Leslie D. Understanding artificial intelligence ethics and safety. The Alan Turing Institute; 2019. DOI: https://doi.org/10.5281/zenodo.3240529
33. Savage E, McFadden C, Ryan J. Adoption and applications of Fast Healthcare Interoperability Resources (FHIR) in digital health: a scoping review. Int J Med Inform. 2024; 185:105368. DOI: https://doi.org/10.1016/j.ijmedinf.2024.105368
34. Ayaz M, Pessach D, Rubin DL, Banda JM. Bridging FHIR and OMOP CDM for interoperable clinical data exchange: implementation using HAPI FHIR server architecture. J Biomed Inform. 2024;151:104623. DOI: https://doi.org/10.1016/j.jbi.2024.104623
35. Hendriks S, Peeters J, van Limburg M. Implementing HL7 FHIR as a standalone interoperability microservice: lessons from the GameBus digital health platform. BMC Med Inform Decis Mak. 2024;24:118. DOI: https://doi.org/10.1186/s12911-024-02418-7
36. Mandel JC, Kreda DA, Mandl KD, Kohane IS, Ramoni RB. SMART on FHIR: a standards-based, interoperable apps platform for electronic health records. J Am Med Inform Assoc. 2016;23(5):899–908. DOI: https://doi.org/10.1093/jamia/ocv189
37. Alzahrani B, Alghamdi A, Alshammari R. Secure role-based access control for GraphQL-enabled FHIR APIs: mitigating BOLA and BFLA vulnerabilities. IEEE Access. 2024;12:44567–44579. DOI: https://doi.org/10.1109/ACCESS.2024.3378123
38. Dolin RH, Alschuler L. Practical challenges in FHIR-based workflow interoperability: lessons from real-world scheduling integration. Appl Clin Inform. 2023;14(4):812–820. DOI: https://doi.org/10.1055/s-0043-1771502
39. Wang X, Zhou Y, Schuurmans D, Le QV, Chi EH. Reflexion: language agents with verbal reinforcement learning. Adv Neural Inf Process Syst. 2023;36:8634–8652. DOI: https://doi.org/10.48550/arXiv.2303.11366
40. Xi Z, Chen W, Guo X, et al. The rise and potential of large language model based agents: a survey. arXiv. 2023. DOI: https://doi.org/10.48550/arXiv.2309.07864
41. Jiang F, Jiang Y, Zhi H, Dong Y, Li H, Ma S, Wang Y, Dong Q, Shen H, Wang Y. Artificial intelligence in healthcare: past, present and future. Stroke Vasc Neurol. 2017;2(4):230–243. DOI: https://doi.org/10.1136/svn-2017-000101
42. Luo J, Wu M, Gopukumar D, Zhao Y. Big data application in biomedical research and health care: a literature review. Biomed Inform Insights. 2022;14:11782226211056886. DOI: https://doi.org/10.1177/11782226211056886
43. Damarched MK. Agentic AI modernization: transforming institutional infrastructure through orchestrated multi-agent LLM framework. J Comput Sci Technol Stud. 2026;8(4):01–24. DOI: https://doi.org/10.32996/jcsts.2026.8.4.1
44. Lewis P, Perez E, Piktus A, Petroni F, Karpukhin V, Goyal N, Küttler H, Lewis M, Yih WT, Rocktäschel T, Riedel S, Kiela D. Retrieval-augmented generation for knowledge-intensive NLP tasks. Adv Neural Inf Process Syst. 2020;33:9459–9474. DOI: https://doi.org/10.48550/arXiv.2005.11401
45. U.S. Department of Health & Human Services. 45 C.F.R. § 164.308(a)(1)(ii)(A) – Risk analysis (required implementation specification). 2013. Available from: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164
46. U.S. Department of Health & Human Services. 45 C.F.R. § 164.402(2) – Risk assessment. 2013. Available from: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164
47. Perez F, Ribeiro I. Ignore previous prompt: attack techniques for language models. arXiv. 2022. DOI: https://doi.org/10.48550/arXiv.2211.09527
48. Fredrikson M, Jha S, Ristenpart T. Model inversion attacks that exploit confidence information and basic countermeasures. Proc 22nd ACM SIGSAC Conf Comput Commun Secur. 2015:1322–1333. DOI: https://doi.org/10.1145/2810103.2813677
49. Carlini N, et al. Extracting training data from large language models. USENIX Secur Symp. 2021:2633–2650. DOI: https://doi.org/10.48550/arXiv.2012.07805
50. U.S. Department of Health & Human Services. 45 C.F.R. § 164.312(a)(2)(iv) & (e)(2)(ii) – Encryption and decryption (addressable implementation specification). 2013. Available from: https://www.ecfr.gov/current/title-45/part-164
51. National Institute of Standards and Technology. FIPS PUB 197: Advanced Encryption Standard (AES). 2001. DOI: https://doi.org/10.6028/NIST.FIPS.197
52. National Institute of Standards and Technology. SP 800-52 Rev. 2: Guidelines for the selection, configuration, and use of transport layer security (TLS) implementations. 2020. DOI: https://doi.org/10.6028/NIST.SP.800-52r2
53. National Institute of Standards and Technology. FIPS 140-3: Security requirements for cryptographic modules. 2023. DOI: https://doi.org/10.6028/NIST.FIPS.140-3
54. Sweeney L. k-Anonymity: a model for protecting privacy. Int J Uncertain Fuzziness Knowl Based Syst. 2002;10(5):557–570. DOI: https://doi.org/10.1142/S0218488502001648
55. Machanavajjhala A, Kifer D, Gehrke J, Venkitasubramaniam M. l-Diversity: privacy beyond k-anonymity. ACM Trans Knowl Discov Data. 2007;1(1):3. DOI: https://doi.org/10.1145/1217299.1217302
56. Li N, Li T, Venkatasubramanian S. t-Closeness: privacy beyond k-anonymity and l-diversity. Proc IEEE Int Conf Data Eng. 2007:106–115. DOI: https://doi.org/10.1109/ICDE.2007.367856
57. Sweeney L. Simple demographics often identify people uniquely. Carnegie Mellon University, Data Privacy Working Paper 3; 2000. DOI: https://doi.org/10.1184/R1/6628064.v1
58. El Emam K, Dankar FK. Protecting privacy using k-anonymity. J Am Med Inform Assoc. 2008;15(5):627–637. DOI: https://doi.org/10.1197/jamia.M2716
59. Cho S, Gunter CA, Liebovitz DM, Khanna R. Formal analysis of role-based access control for healthcare systems using Alloy. IEEE J Biomed Health Inform. 2018;22(5):1509–1518. DOI: https://doi.org/10.1109/JBHI.2017.2762827
60. Walonoski J, Kramer M, Nichols J, Quina A, Moesel C, Hall D, Duffett C, Dube K, Gallagher T, McLachlan S. Synthea™ novel coronavirus (COVID-19) model and synthetic data generation for healthcare research. J Am Med Inform Assoc. 2018;25(3):230–238. DOI: https://doi.org/10.1093/jamia/ocx079
61. U.S. Department of Health & Human Services. 45 C.F.R. § 164.402(2) – Risk assessment. 2013. Available from: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164
62. Han S, Shanafelt TD, Sinsky CA, Awad KM, Dyrbye LN, Fiscus LC, Trockel M, Goh J. Estimating the attributable cost of physician burnout in the United States. Ann Intern Med. 2019;170(11):784–790. DOI: https://doi.org/10.7326/M18-1422
63. Waldman JD, Kelly F, Arora S, Smith HL. The shocking cost of turnover in health care. Health Care Manage Rev. 2004;29(1):2–7. DOI: https://doi.org/10.1097/00004010-200401000-00002
Published
Abstract Display: 203 
PDF Downloads: 276 PDF Downloads: 124 How to Cite
Issue
Section
Copyright (c) 2026 Mahesh Kumar Damarched
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
Authors who publish with this journal agree to the following terms:
- Authors retain copyright and grant the journal right of first publication with the work simultaneously licensed under a Creative Commons Attribution-NonCommercial 4.0 International (CC BY-NC 4.0). that allows others to share the work with an acknowledgment of the work's authorship and initial publication in this journal.
- Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgment of its initial publication in this journal.
- Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) prior to and during the submission process, as it can lead to productive exchanges, as well as earlier and greater citation of published work (See The Effect of Open Access).
How to Cite
.