Healthcare organizations want the same thing from AI that every other business wants: faster answers, less manual work, and insights that reach decision-makers in time to act on them. However, what makes the healthcare industry different is that the data is uniquely complex, deeply contextual, and strictly regulated. So this post starts with a few definitions to set the foundation for everything that follows.

Protected Health Information (PHI) is any information that identifies a person and relates to their health, care, or payment for care, such as a medical note, a claim, or a member ID. When software touches PHI, it falls under the Health Insurance Portability and Accountability Act (HIPAA), the federal law that governs how PHI data is accessed, secured, and audited.

Agentic AI changes what it means for software to “touch PHI.” A traditional analytics tool reads data and returns a response. An agentic workspace like Amazon Quick might go further. For example, its chat agents work across both unstructured content, such as clinical notes and appeals letters, and structured data, such as claims and member records. Agents might retrieve data from both unstructured and structured sources, call other systems through connectors, and complete multi-step tasks on a user’s behalf. Connectors are pre-built integrations that let Amazon Quick securely read from and take action in your external systems, such as Slack, Microsoft Outlook, Salesforce, Atlassian Jira, and Microsoft SharePoint. You can also add your own custom tools through Model Context Protocol (MCP). Only connectors authorized within your organization are visible. When a chat agent can both read and act on PHI, you need sufficient governance: deterministic guardrails, a behavioral audit trail of what the agent did, and clear accountability for actions taken without a person in the loop. To support that governance, Amazon Quick exposes ACL-aware retrieval, chat and feedback logging, and controls over what each chat agent is allowed to do.