# Healthcare Profile Specification

|                       |                                  |
| --------------------- | -------------------------------- |
| **Identifier**        | `urn:adl:profile:healthcare:1.0` |
| **Status**            | Draft                            |
| **ADL Compatibility** | 0.3.x                            |

Regulatory Disclaimer

This profile is provided as a technical specification in DRAFT status and does not constitute legal, regulatory, or compliance advice. It has not been reviewed or endorsed by HHS, OCR, the FDA, or any regulatory body. Organizations MUST NOT rely on this profile as their sole basis for regulatory compliance. Compliance with HIPAA, HITECH, FDA regulations, or any other healthcare regulatory framework requires qualified professional assessment specific to your organization's circumstances. This profile does not substitute for a HIPAA risk assessment as required by 45 CFR §164.308(a)(1).

## 1. Introduction[​](#1-introduction "Direct link to 1. Introduction")

The Healthcare Profile extends ADL for healthcare environments. It adds members for HIPAA compliance, Protected Health Information (PHI) handling, clinical safety controls, and health data interoperability. This profile addresses requirements from HIPAA (Privacy, Security, and Breach Notification Rules), HITECH, FDA AI/ML guidance, HL7 FHIR, ONC Health IT certification, and the 21st Century Cures Act.

When this profile is declared in an ADL document's `profiles` array, the document **MUST** satisfy all requirements defined in this specification.

This profile is designed to compose with the Governance Profile. Organizations **SHOULD** declare both profiles for full enterprise healthcare compliance coverage.

***

## 2. Additional Members[​](#2-additional-members "Direct link to 2. Additional Members")

### 2.1 hipaa\_compliance[​](#21-hipaa_compliance "Direct link to 2.1 hipaa_compliance")

**REQUIRED** when using this profile.

An object containing HIPAA regulatory compliance configuration.

| Member                | Type   | Required | Description                                        |
| --------------------- | ------ | -------- | -------------------------------------------------- |
| covered\_entity\_type | string | REQUIRED | Entity classification under HIPAA                  |
| baa\_required         | bool   | REQUIRED | Whether a Business Associate Agreement is required |
| minimum\_necessary    | object | REQUIRED | Minimum necessary access configuration             |
| security\_rule        | object | OPTIONAL | Security Rule compliance settings                  |

note

PHI categories have moved to the composable member (Section 2.5). This enables consistent data classification across profiles and reuse within tools and resources.

#### covered\_entity\_type[​](#covered_entity_type "Direct link to covered_entity_type")

**MUST** be one of:

* `covered_entity` — Health plan, healthcare clearinghouse, or healthcare provider
* `business_associate` — Entity performing functions involving PHI on behalf of a covered entity
* `subcontractor` — Business associate of a business associate

#### minimum\_necessary[​](#minimum_necessary "Direct link to minimum_necessary")

**MUST** be an object containing:

| Member            | Type   | Required | Description                        |
| ----------------- | ------ | -------- | ---------------------------------- |
| scope             | string | REQUIRED | Access scope level                 |
| justification     | string | OPTIONAL | Reason for access level            |
| review\_frequency | string | OPTIONAL | How often access scope is reviewed |

`scope` **MUST** be one of: `task_specific`, `role_based`, `full_record`.

#### security\_rule[​](#security_rule "Direct link to security_rule")

When present, **MAY** contain:

| Member                  | Type   | Description                                     |
| ----------------------- | ------ | ----------------------------------------------- |
| encryption\_at\_rest    | string | Required algorithm: `AES_256`, `AES_128`        |
| encryption\_in\_transit | string | Required protocol: `TLS_1_2`, `TLS_1_3`         |
| mfa\_required           | bool   | Whether multi-factor authentication is required |
| data\_retention         | string | Retention policy: `none`, `minimum`, `standard` |
| restoration\_hours      | number | Maximum hours to restore critical systems       |

***

### 2.2 phi\_handling[​](#22-phi_handling "Direct link to 2.2 phi_handling")

**REQUIRED** when using this profile.

An object containing PHI data handling and de-identification controls.

| Member               | Type   | Required | Description                                |
| -------------------- | ------ | -------- | ------------------------------------------ |
| de\_identification   | object | REQUIRED | De-identification method and configuration |
| breach\_notification | object | REQUIRED | Breach notification configuration          |
| consent\_management  | object | OPTIONAL | Patient consent tracking                   |
| data\_provenance     | object | OPTIONAL | Data lineage tracking                      |

#### de\_identification[​](#de_identification "Direct link to de_identification")

**MUST** be an object containing:

| Member                       | Type   | Required | Description                                    |
| ---------------------------- | ------ | -------- | ---------------------------------------------- |
| method                       | string | REQUIRED | De-identification method                       |
| re\_identification\_controls | bool   | OPTIONAL | Whether re-identification prevention is active |

`method` **MUST** be one of: `safe_harbor`, `expert_determination`, `none`.

#### breach\_notification[​](#breach_notification "Direct link to breach_notification")

**MUST** be an object containing:

| Member              | Type   | Required | Description                                                      |
| ------------------- | ------ | -------- | ---------------------------------------------------------------- |
| notification\_hours | number | REQUIRED | Maximum hours to notify authorities                              |
| contact             | string | REQUIRED | Breach notification contact                                      |
| threshold           | number | OPTIONAL | Number of affected individuals triggering escalated notification |

#### consent\_management[​](#consent_management "Direct link to consent_management")

When present, **MAY** contain:

| Member                | Type   | Description                                                          |
| --------------------- | ------ | -------------------------------------------------------------------- |
| required              | bool   | Whether explicit consent is required                                 |
| consent\_types        | array  | Types: `treatment`, `payment`, `operations`, `research`, `marketing` |
| granularity           | string | Consent granularity: `broad`, `purpose_specific`, `data_specific`    |
| revocation\_supported | bool   | Whether consent revocation is supported                              |

#### data\_provenance[​](#data_provenance "Direct link to data_provenance")

When present, **MAY** contain:

| Member          | Type  | Description                              |
| --------------- | ----- | ---------------------------------------- |
| tracking        | bool  | Whether data lineage tracking is enabled |
| source\_systems | array | List of source system identifiers        |

***

### 2.3 clinical\_safety[​](#23-clinical_safety "Direct link to 2.3 clinical_safety")

**OPTIONAL.** An object containing clinical safety controls for agents involved in clinical decision support or patient-facing interactions.

| Member               | Type   | Required | Description                            |
| -------------------- | ------ | -------- | -------------------------------------- |
| fda\_classification  | object | OPTIONAL | FDA device/software classification     |
| change\_control      | object | OPTIONAL | Model change management (PCCP-aligned) |
| bias\_monitoring     | object | OPTIONAL | Bias detection and mitigation          |
| human\_in\_the\_loop | object | OPTIONAL | Clinical decision oversight            |

#### fda\_classification[​](#fda_classification "Direct link to fda_classification")

When present, **MAY** contain:

| Member            | Type   | Description                                                   |
| ----------------- | ------ | ------------------------------------------------------------- |
| device\_class     | string | `exempt`, `class_I`, `class_II`, `class_III`, `non_device`    |
| clearance\_type   | string | `510k`, `de_novo`, `pma`, `not_applicable`                    |
| clearance\_number | string | FDA clearance/approval number                                 |
| software\_level   | string | `non_significant_risk`, `significant_risk`, `life_supporting` |

#### change\_control[​](#change_control "Direct link to change_control")

Aligned with FDA Predetermined Change Control Plan (PCCP) guidance. When present, **MAY** contain:

| Member                | Type   | Description                                 |
| --------------------- | ------ | ------------------------------------------- |
| pccp\_authorized      | bool   | Whether a PCCP has been FDA-authorized      |
| modification\_scope   | array  | Authorized modification types               |
| validation\_protocol  | string | URI to validation protocol                  |
| rollback\_plan        | bool   | Whether rollback capability exists          |
| monitoring\_frequency | string | Real-world performance monitoring frequency |

#### bias\_monitoring[​](#bias_monitoring "Direct link to bias_monitoring")

When present, **MAY** contain:

| Member                | Type   | Description                       |
| --------------------- | ------ | --------------------------------- |
| enabled               | bool   | Whether bias monitoring is active |
| protected\_classes    | array  | Demographics monitored for bias   |
| assessment\_frequency | string | How often bias is assessed        |
| last\_assessment      | string | ISO 8601 timestamp                |

#### human\_in\_the\_loop[​](#human_in_the_loop "Direct link to human_in_the_loop")

When present, **MAY** contain:

| Member           | Type   | Description                                                         |
| ---------------- | ------ | ------------------------------------------------------------------- |
| level            | string | `advisory`, `approval_required`, `continuous_oversight`             |
| role             | string | Clinical role responsible (e.g., "Physician", "Nurse Practitioner") |
| escalation\_path | string | Escalation contact or procedure                                     |

***

### 2.4 interoperability[​](#24-interoperability "Direct link to 2.4 interoperability")

**OPTIONAL.** An object containing health data interoperability standards compliance.

| Member                | Type   | Required | Description                                    |
| --------------------- | ------ | -------- | ---------------------------------------------- |
| fhir\_version         | string | OPTIONAL | Supported FHIR version                         |
| terminology\_bindings | array  | OPTIONAL | Supported code systems                         |
| tefca\_participant    | bool   | OPTIONAL | Whether agent participates in TEFCA            |
| information\_blocking | object | OPTIONAL | 21st Century Cures Act compliance              |
| dsi\_transparency     | object | OPTIONAL | ONC Decision Support Intervention transparency |

#### fhir\_version[​](#fhir_version "Direct link to fhir_version")

When present, **MUST** be one of: `DSTU2`, `STU3`, `R4`, `R4B`, `R5`.

#### terminology\_bindings[​](#terminology_bindings "Direct link to terminology_bindings")

When present, **MUST** be an array of strings. Common values: `ICD-10`, `SNOMED-CT`, `LOINC`, `RxNorm`, `CPT`, `HCPCS`.

#### information\_blocking[​](#information_blocking "Direct link to information_blocking")

When present, **MAY** contain:

| Member              | Type  | Description                                     |
| ------------------- | ----- | ----------------------------------------------- |
| compliant           | bool  | Whether agent is information blocking compliant |
| exceptions\_claimed | array | Any claimed exceptions per 45 CFR Part 171      |

#### dsi\_transparency[​](#dsi_transparency "Direct link to dsi_transparency")

When present, **MAY** contain:

| Member                        | Type | Description                                                   |
| ----------------------------- | ---- | ------------------------------------------------------------- |
| predictive\_dsi               | bool | Whether agent includes predictive DSI                         |
| source\_attributes\_published | bool | Whether source attributes are disclosed                       |
| irm\_practices                | bool | Whether Intervention Risk Management practices are documented |

***

### 2.5 data\_classification Extension[​](#25-data_classification-extension "Direct link to 2.5 data_classification Extension")

This profile extends the core ADL `data_classification` member (Spec §10.4) with a `healthcare` sub-object for PHI classification.

**REQUIRED** when using this profile. The `data_classification` member **MUST** be present with a `healthcare` sub-object. The `data_classification.categories` array **MUST** include `phi`.

#### healthcare[​](#healthcare "Direct link to healthcare")

An object containing healthcare-specific data classification. When present, **MUST** contain:

| Member               | Type  | Required | Description                                  |
| -------------------- | ----- | -------- | -------------------------------------------- |
| phi\_types           | array | REQUIRED | Categories of PHI the agent may access       |
| hipaa\_applicability | bool  | OPTIONAL | Whether HIPAA applies to this classification |

#### phi\_types[​](#phi_types "Direct link to phi_types")

**MUST** be a non-empty array. Each item **MUST** be one of:

* `demographics` — Patient demographic information
* `medical_records` — Clinical and medical record data
* `billing` — Billing and payment information
* `mental_health` — Mental and behavioral health records
* `substance_use` — Substance use disorder records (42 CFR Part 2)
* `genetic` — Genetic information (GINA)
* `reproductive` — Reproductive health information
* `hiv_status` — HIV/AIDS status information

Example:

```
{

  "data_classification": {

    "sensitivity": "restricted",

    "categories": ["pii", "phi"],

    "retention": {

      "min_days": 2190,

      "policy_uri": "https://healthtech.example/retention-policy"

    },

    "handling": {

      "encryption_required": true,

      "logging_required": true

    },

    "healthcare": {

      "phi_types": ["demographics", "medical_records"],

      "hipaa_applicability": true

    }

  }

}
```

***

## 3. Compliance Mapping[​](#3-compliance-mapping "Direct link to 3. Compliance Mapping")

| ADL / Profile Section                      | Regulatory Controls                           |
| ------------------------------------------ | --------------------------------------------- |
| data\_classification.healthcare.phi\_types | HIPAA §164.514; NIST 800-53 SC-16             |
| hipaa\_compliance.security\_rule           | HIPAA §164.312; NIST 800-53 SC-8, SC-13, AC-3 |
| hipaa\_compliance.minimum\_necessary       | HIPAA §164.502(b); NIST 800-53 AC-6           |
| phi\_handling.de\_identification           | HIPAA §164.514; NIST 800-53 SI-19             |
| phi\_handling.consent\_management          | HIPAA §164.508; 42 CFR Part 2                 |
| phi\_handling.breach\_notification         | HIPAA §164.400-414; HITECH §13402             |
| clinical\_safety.fda\_classification       | FDA 21 CFR 820; ISO 13485                     |
| clinical\_safety.change\_control           | FDA PCCP Guidance; 21 CFR 820.30              |
| clinical\_safety.bias\_monitoring          | NIST AI RMF; ONC HTI-1 DSI requirements       |
| interoperability.fhir\_version             | HL7 FHIR; ONC Cures Act Final Rule            |
| interoperability.information\_blocking     | 21st Century Cures Act §4004; 45 CFR Part 171 |
| interoperability.dsi\_transparency         | ONC HTI-1 Final Rule §170.315(b)(11)          |

***

## 4. Example[​](#4-example "Direct link to 4. Example")

Complete Example

This example demonstrates a complete agent definition using this profile.

clinical-research-agent.json

```
{

  "$schema": "https://adl-spec.org/0.3/schema.json",

  "adl_spec": "0.3.0",

  "name": "Clinical Research Assistant",

  "description": "Assists researchers with patient record analysis and clinical trial matching.",

  "version": "1.0.0",

  "profiles": [

    "urn:adl:profile:healthcare:1.0"

  ],

  "lifecycle": {

    "status": "active",

    "effective_date": "2026-01-15T00:00:00Z"

  },

  "provider": {

    "name": "HealthTech Corp",

    "url": "https://healthtech.example",

    "contact": "compliance@healthtech.example"

  },

  "model": {

    "capabilities": [

      "function_calling"

    ]

  },

  "tools": [

    {

      "name": "search_patient_records",

      "description": "Search de-identified patient records for clinical trial matching",

      "parameters": {

        "type": "object",

        "properties": {

          "criteria": {

            "type": "string"

          },

          "limit": {

            "type": "integer",

            "default": 20

          }

        },

        "required": [

          "criteria"

        ]

      },

      "read_only": true

    },

    {

      "name": "generate_cohort_report",

      "description": "Generate a cohort analysis report from matched records",

      "parameters": {

        "type": "object",

        "properties": {

          "cohort_id": {

            "type": "string"

          },

          "format": {

            "type": "string",

            "enum": [

              "pdf",

              "json"

            ]

          }

        },

        "required": [

          "cohort_id"

        ]

      }

    }

  ],

  "permissions": {

    "network": {

      "allowed_hosts": [

        "ehr.healthtech.example",

        "fhir.healthtech.example"

      ],

      "allowed_protocols": [

        "https"

      ],

      "deny_private": true

    },

    "filesystem": {

      "allowed_paths": [

        {

          "path": "/data/deidentified/**",

          "access": "read"

        },

        {

          "path": "/data/reports/**",

          "access": "read_write"

        }

      ]

    }

  },

  "security": {

    "authentication": {

      "type": "oauth2",

      "required": true,

      "scopes": [

        "patient:read",

        "report:write"

      ]

    },

    "encryption": {

      "in_transit": {

        "required": true,

        "min_version": "1.2"

      },

      "at_rest": {

        "required": true,

        "algorithm": "AES-256-GCM"

      }

    }

  },

  "data_classification": {

    "sensitivity": "restricted",

    "categories": [

      "pii",

      "phi"

    ],

    "retention": {

      "min_days": 2190

    },

    "handling": {

      "encryption_required": true,

      "logging_required": true

    },

    "healthcare": {

      "phi_types": [

        "demographics",

        "medical_records"

      ],

      "hipaa_applicability": true

    }

  },

  "hipaa_compliance": {

    "covered_entity_type": "business_associate",

    "baa_required": true,

    "minimum_necessary": {

      "scope": "task_specific",

      "justification": "Access limited to de-identified records for clinical trial matching",

      "review_frequency": "quarterly"

    },

    "security_rule": {

      "encryption_at_rest": "AES_256",

      "encryption_in_transit": "TLS_1_2",

      "mfa_required": true,

      "data_retention": "none",

      "restoration_hours": 72

    }

  },

  "phi_handling": {

    "de_identification": {

      "method": "safe_harbor",

      "re_identification_controls": true

    },

    "breach_notification": {

      "notification_hours": 60,

      "contact": "privacy-officer@healthtech.example",

      "threshold": 500

    },

    "consent_management": {

      "required": true,

      "consent_types": [

        "research"

      ],

      "granularity": "purpose_specific",

      "revocation_supported": true

    }

  },

  "clinical_safety": {

    "bias_monitoring": {

      "enabled": true,

      "protected_classes": [

        "race",

        "ethnicity",

        "sex",

        "age"

      ],

      "assessment_frequency": "quarterly",

      "last_assessment": "2026-01-01T00:00:00Z"

    },

    "human_in_the_loop": {

      "level": "approval_required",

      "role": "Principal Investigator",

      "escalation_path": "IRB Committee"

    }

  },

  "interoperability": {

    "fhir_version": "R4",

    "terminology_bindings": [

      "ICD-10",

      "SNOMED-CT",

      "LOINC"

    ],

    "information_blocking": {

      "compliant": true

    }

  },

  "metadata": {

    "authors": [

      {

        "name": "HealthTech Compliance Team",

        "email": "compliance@healthtech.example"

      }

    ],

    "license": "Proprietary",

    "tags": [

      "healthcare",

      "hipaa",

      "clinical-research",

      "fhir"

    ]

  }

}
```

***

## 5. Validation Rules[​](#5-validation-rules "Direct link to 5. Validation Rules")

Validation Required

Implementations validating against this profile **MUST** enforce the following rules. Non-conforming documents should be rejected.

| Rule  | Description                                                                                                                               |
| ----- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| HC-01 | `hipaa_compliance` MUST be present                                                                                                        |
| HC-02 | `hipaa_compliance.covered_entity_type` MUST be a valid type                                                                               |
| HC-03 | `data_classification.healthcare.phi_types` MUST be a non-empty array of valid types                                                       |
| HC-04 | `hipaa_compliance.baa_required` MUST be present                                                                                           |
| HC-05 | `hipaa_compliance.minimum_necessary` MUST be present with valid `scope`                                                                   |
| HC-06 | `hipaa_compliance.security_rule.encryption_at_rest` MUST be `AES_256` or `AES_128` if present                                             |
| HC-07 | `hipaa_compliance.security_rule.encryption_in_transit` MUST be `TLS_1_2` or `TLS_1_3` if present                                          |
| HC-08 | `phi_handling` MUST be present                                                                                                            |
| HC-09 | `phi_handling.de_identification.method` MUST be a valid method                                                                            |
| HC-10 | `phi_handling.breach_notification` MUST be present with `notification_hours` and `contact`                                                |
| HC-11 | If `data_classification.healthcare.phi_types` includes `substance_use`, `phi_handling.consent_management` MUST be present (42 CFR Part 2) |
| HC-12 | All timestamps MUST be valid ISO 8601                                                                                                     |
| HC-13 | `interoperability.fhir_version` MUST be a valid version if present                                                                        |
| HC-14 | If `clinical_safety.fda_classification.device_class` is not `exempt` or `non_device`, `clinical_safety.change_control` MUST be present    |
| HC-15 | If `interoperability.dsi_transparency.predictive_dsi` is true, `source_attributes_published` and `irm_practices` MUST be true             |
| HC-16 | `data_classification` MUST be present with a `healthcare` sub-object                                                                      |
| HC-17 | `data_classification.categories` MUST include `phi`                                                                                       |