Agentbeam
Healthcare

Beam for healthcare

AI coding agents touch clinical systems, patient-facing tools and the infrastructure around PHI — often with more access than the team realizes. Beam records what an agent actually did on the machine that ran it, so a security review isn't reconstructed from memory after the fact.

Beam is not a HIPAA compliance product and doesn't scan for PHI. It's an activity record for the engineering side of your stack.

See the audit trailHow Beam works
A healthcare IT security reviewer examining a local AI agent activity log, with a flagged file-access event highlighted

What Beam actually watches

Scoped honestly: this is agent-activity monitoring, not a clinical-data or PHI scanner.

  • Runtime

    Commands, file writes and tool calls

    Every event carries project_path and file_path, so a write outside the expected repo is visible rather than buried in a transcript.

  • Supply chain

    Scan a skill or MCP server before it runs

    Eleven heuristic patterns plus a version-pin check, before a server or skill file with real filesystem access gets trusted.

  • Data handling

    Credential redaction, not PHI detection

    Known credential formats — keys, tokens, auth headers — are redacted before persistence. Beam does not identify or redact patient data; that's a different problem this tool doesn't solve.

  • Local by default

    Stays on the machine that generated it

    127.0.0.1:4319, local NDJSON at 0700/0600. Relevant where clinical-adjacent infrastructure has its own data-residency rules.

  • Evidence

    Flags with the triggering event attached

    Destructive commands and privilege changes surfaced against the raw event, reviewable rather than a score to take on faith.

How a healthcare IT or security team starts

  1. 01

    Instrument machines near clinical-adjacent systems

    A hook merged into settings, plus a local service. Nothing installs or enforces itself.

  2. 02

    Watch what agents do for a couple of weeks

    Get a real answer to what your AI touched before writing a policy about it.

  3. 03

    Export what a security review needs

    A redacted NDJSON export, or a hashed case bundle for the people who have to sign off.

Where Beam fits, and where it doesn't

Beam does

  • Record what an AI coding agent did — commands, files, tool and MCP calls
  • Scan MCP configs and skills before they're connected
  • Redact known credential formats before anything is written
  • Keep everything local, with export as an explicit, user-run action

Beam does not

  • Detect, redact or otherwise handle PHI or other clinical data
  • Certify HIPAA compliance or satisfy a HIPAA Security Rule requirement by itself
  • Block or gate an agent's actions in v1 — observe and alert only
  • Replace your existing HIPAA compliance program or risk analysis

Questions from healthcare security reviews

Is Beam HIPAA compliant?

Beam isn't a covered entity or a business associate by default, and it makes no HIPAA compliance claim. It's a local-first activity recorder for AI coding agents; whether and how it fits your HIPAA program is a decision your compliance team makes, not something this page asserts for you.

Does Beam scan for PHI in code or logs?

No. Beam redacts known credential formats — API keys, tokens, auth headers — before writing an event. It does not detect or redact patient data. Review any export before it leaves your team.

Can it stop an agent from touching a clinical system?

Not in v1. Beam observes and alerts only — it emits no allow/deny response and can't block a command mid-flight.

Where does the activity data get stored?

Locally, on the machine that generated it. The collector binds to loopback only, and nothing leaves until someone runs an export.

Related

Know what your AI touched before a reviewer asks

Instrument a few machines and see the real activity record — not a promise about what it might have done.

Set up Beam