Industry — Healthcare
Highly regulated. Personal Health Information (PHI) handling under HIPAA in the US (equivalents elsewhere) imposes data-residency requirements, encryption-at-rest mandates, and Business Associate Agreement (BAA) obligations on any vendor touching the data.
Architectural implications.
- Vendor selection often constrained to those offering signed BAAs.
- Cloud region choices may be limited.
- "Activation" is not categorically allowed — consented uses must be distinguished from non-consented.
- Audit trail requirements for access and processing.
- 2026 Security Rule (finalized, compliance deadline ~September 2026). The HIPAA Security Rule underwent its first major overhaul since 2003. All ePHI-handling systems — including CDPs, CDWs, and activation pipelines — must now meet four new mandatory requirements: annual penetration testing by a qualified party; biannual vulnerability scanning; a 72-hour recovery time objective (RTO) for critical systems; and annual written verification from each business associate (including CDP vendors) that technical safeguards are implemented. Encryption at rest and in transit is elevated from "addressable" to mandatory. When Healthcare is the active industry dimension, the agent must verify vendor compliance posture against the updated 2026 Security Rule — not just BAA availability. See constraint.hipaa-security-rule-2026 v2 for the complete requirement set.
Why this matters. The agent should not propose architectures that move PHI through unsigned vendors or unsegregated infrastructure. When healthcare is the industry, every recommendation must be filtered for compliance posture.