Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Can a Medical Coding Company Use AI Agents on Client Records?
No, not on the agreement a coding company already holds: the model receives the client's chart, so the vendor handles PHI and the provider's BAA with the company does not reach it. Check what the model receives from the rendered screen, and whether a written agreement reaches the vendor, before the first claim.
A coding team works a chart the way a reader works a page. The patient banner sits above the note, the note sits beside the code field, and the claim lines sit below both. An agent that opens that chart is useful because it can read the note and propose codes in one pass, and the same pass carries the name, the medical record number and the date of birth into the model's context. A coder reads the note to assign the code; the agent reads the same note and the banner that frames it. A coding company is already a business associate, so the question is not whether the record can be handled. It is who else receives it, and on what terms.
The company's business associate agreement covers its own handling of the record. It does not name the model vendor that receives the rendered page, and a vendor that receives PHI is a party the agreement has to reach. That is the question a coding company has to settle before it runs an agent on client work: what reaches the model on the screen, what its agreement actually covers, who approves a code change or a submission, and what record survives the run. Each of those is a fact about the screen or the contract, which is why a pilot can test it rather than take a vendor's word.
Key findings
- For a coding company to put an agent on a client record without handing the model vendor PHI, the identifying values on the rendered chart would have to be replaced with consistent tokens before any model reads it, while the note the coder works from stays readable (What Is Render-Layer Tokenization?).
- It would also require a named person approving each code change and claim submission and a record of what the model received, because the note the coder must read cannot be tokenized away and stays inside the agreement (Does an AI Model Vendor Need a BAA for Patient Records?).
- The pages reviewed do not describe a coding screen whose identifiers are replaced before the model reads it; the vendor pages cover roles, reach and credential custody, and stop before what a model receives (Zendesk, 2026; SAP, 2026).
- HHS lists "claims processing or administration, data analysis, billing, and practice management" among the activities that make an entity a business associate, which is the role the company already occupies (HHS, Business Associates, 2026).
- The AgentDAM evaluation found that web agents "are prone to inadvertent use of unnecessary sensitive information," which is what a chart invites when the diagnosis sits beside the code field (Zharmagambetov et al., 2025).
- A systematic review of automation bias describes "the tendency to over-rely on automation," so an approval step that a coder clears at queue speed is not the control it looks like (Goddard et al., 2012).
What does an agent read when it opens a coding record?
The worked record is a coding vendor's model pipeline. A chart opens with a patient banner that carries the name, the medical record number, the date of birth, the age, the insurer and the visit. Below it sit the encounter note, the problem list, the medication list, the results and the charge lines the coder works. The task needs the note, the diagnosis, the procedure and the amount.
An agent that reads the chart reads the whole frame. The AgentDAM evaluation found that web agents "are prone to inadvertent use of unnecessary sensitive information," and a coding screen is built to supply exactly that: the diagnosis and the patient's identity in the same view (Zharmagambetov et al., 2025). The note is the part that cannot be removed. A coder reads it to choose the code, and an agent that does not read it cannot do the work. Identity is different. A name, a medical record number and a date of birth can be replaced with stable tokens while the note stays readable (What Is Render-Layer Tokenization?).
| What the chart draws | What coding needs | What the model receives without a control |
|---|---|---|
| Patient name and medical record number | The account key | The identifiers, unchanged |
| Date of birth and age | Nothing for the code | The full date |
| Encounter note and problem list | The clinical content | The note text |
| Diagnosis and procedure codes | The codes | The codes with the patient's context |
| Charge and balance lines | The amount | The amount and the guarantor's details |
A computer-use agent makes the frame literal: it receives a screenshot, so a value has to be replaced before the screenshot is captured, not after (How Do You Run Claude Computer Use on Customer Records Without Exposing PII?). The de-identification guidance shows why that substitution is not the same as de-identification. Safe Harbor removes "All elements of dates (except year) for dates" that relate to an individual, which is why a full date of birth in a banner is an identifier rather than a demographic (HHS, De-identification, 2026). The minimum necessary standard at 45 CFR 164.502(b) asks for reasonable efforts to limit PHI to what the purpose requires, which a full chart sent to a model does not do (Can Staff Use AI on Patient Records Without PHI?).
Does the model vendor receive PHI under the company's BAA?
HHS lists "claims processing or administration, data analysis, billing, and practice management" among the activities that make an entity a business associate, which is the role a coding company occupies (HHS, Business Associates, 2026).
The company's agreement with its provider covers its own handling of the record. It does not name the model vendor that receives the rendered page. HHS says a covered entity may disclose PHI to a business associate only after it obtains "satisfactory assurances, in the form of a contract or other written arrangement" (HHS, Business Associates, 2026). The model vendor is a separate recipient the agreement has to reach. The conduit exception does not help: it is limited to entities that "only provide transmission services for PHI," which an agent reading a chart does not do (HHS, Business Associates, 2026). The definition is about the data handled, not the technology, so the vendor's label does not decide it (Does an AI Model Vendor Need a BAA for Patient Records?).
Jim Sinkoff, Deputy CEO and CFO, Sun River Health, said on a HAL podcast that the rules still act as a check: "there's still a regulatory environment out there that helps to circuit break" (HAL Transcript: Jim Sinkoff).
What the vendor says about training does not settle it. OpenAI's safety document lists "Business, Enterprise and Education, not Healthcare" as the workspaces with a no-training default, which is a workspace tier and not an agreement (Can OpenAI Dots Be Enabled on Patient Records?). The question is what arrives at the model call: if the note and the banner arrive, the vendor receives PHI, and the company needs a written arrangement that names it.
Expert Determination requires a person who "determines that the risk is very small" and documents the methods and results, and the guidance warns that both methods "yield de-identified data that retains some risk of identification" (HHS, De-identification, 2026). A token reduces the exposure; it does not turn a chart into a de-identified data set.
What do the vendors themselves say?
Three vendor pages bear on this question from different directions, and each one states its limit plainly.
Zendesk's help center says eligible plans let an administrator "define your own agent roles and assign agents to those roles," which scopes the tickets an agent opens and not the values a model reads (Zendesk, 2026). The page is about support roles on an eligible plan, and a role that narrows a queue is a control on reach.
SAP's innovation guide states that "Joule Agents can access enterprise data and act across both SAP and third-party systems," a statement about reach rather than about what the model receives (SAP, 2026). An agent that can act across systems still has to be shown a page before it can act on it.
AWS's security blog describes a token vault built to "Securely store OAuth 2.0 Access and Refresh tokens, API keys," and says the agent retrieves them with its own workload token (AWS, 2025). That is credential custody, and it does not describe what a model reads from a patient chart.
| Vendor | What its page states | What the page leaves open |
|---|---|---|
| Zendesk | "you can define your own agent roles and assign agents to those roles" | Which values a model reads from a client record |
| SAP | "Joule Agents can access enterprise data and act across both SAP and third-party systems" | What the model receives on a rendered record and which agreement covers it |
| AWS | A vault built to "Securely store OAuth 2.0 Access and Refresh tokens, API keys" | The record a model reads; the vault covers credentials |
None of the three pages describes a coding screen whose identifiers are replaced before the model reads it. The pages cover roles, reach and credential custody, which are the controls a buyer is usually shown, and they stop before the screen. That is the gap a coding company has to close in its own questions, because no vendor page reviewed here closes it.
Who approves a code change or a claim submission?
Coding work ends in codes on a claim. An agent can read the note, propose the diagnosis and procedure codes, resolve an edit and draft the claim, and each of those steps changes what the company submits and what the provider is paid. The approval that matters is a named person at the coding company who sees the code and the note it came from and signs the change. A queue administrator acting on a default is not that person.
Automation bias is the reason the approval has to be more than a click. A systematic review describes "the tendency to over-rely on automation," which is what an approval step becomes when a coder clears a queue at production speed (Goddard et al., 2012). The approval should name the person, the code, the claim and the screen the model used. If the record cannot show those four things, the signature is a formality.
Guardrails sit on the same side of the line. NVIDIA's documentation defines five rail types and notes that "Input and Output rails are the most common," which places the effort on content rather than on the record (What Are AI Agent Guardrails?). A guardrail can block a tool call or filter an output; it does not decide which values the model was shown before it proposed the code.
The claim can also carry a change the coding company did not intend. A remittance or payment-detail screen may let an agent change the account information on file, and the FBI's IC3 guidance says to "Use secondary channels and/or two-factor authentication to verify requests for changes in account information" (FBI IC3, 2024). A confirmation inside the same session the agent controls verifies nothing. The secondary channel is the check.
What should a coding company ask for in writing?
Five answers turn the vendor conversation into something a compliance officer can file.
- What the model receives from the rendered screen, field by field. A vendor that answers for a settings page has not answered.
- Whether the vendor will sign a business associate agreement, and which model provider is named in it. The HHS guidance points to a written arrangement, and the clause has to name every party that receives the record.
- Where the token mapping lives and who can resolve a token back to a value. A mapping the vendor holds is PHI under another name.
- Who approves each code change and claim submission, and where that approval is recorded.
- What record shows what the model received, and whether it exports to the company's own monitoring.
The last two questions are the ones a demo skips. In a SailPoint survey of 353 IT professionals, "80% of organizations said agents took unintended actions," which is why the test belongs on one workflow rather than in a slide (How Do You Test Whether an AI Agent Can Reach Data Outside Its Assigned Task?). Pick one chart, replace the identifiers with test tokens, run the coding task, and compare the screen the model received with the fields the coder actually used. If the screen holds a real name or medical record number, the exposure happened before the approval, and the vendor's answer to the first question is incomplete.
The federal record shows how often that risk sits with an outside company: 496 of the 1,403 large breaches reported in 2025 and 2026, 35.4%, came through a vendor acting as a business associate (How Many Healthcare Breach Victims Were Exposed Through a Vendor?).
A coding company can ask the five questions in order, and the first one is the one that decides the rest.
What does a governed environment change?
A governed environment acts where the page is drawn, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so the chart renders PATIENT_014 and MRN_0022 in the banner and DX_001 and CPT_001 in the code fields, while the note and the charge lines the coder works from stay readable. For each task the planner proposes what to tokenize, starting from personal information, account numbers, credentials and record numbers. Real values resolve only at an approved destination, at the moment of an approved action, and the claim submission is such an action. A named person approves each code change, and every screen the model was shown, every action and every approval lands in a record that exports to the company's own monitoring.
For this page's question, the control changes two things the agreement cannot. The first is what the vendor receives: a model that reads tokens and never holds the mapping receives less of the record in that flow (Does an AI Model Vendor Need a BAA for Patient Records?). The second is the record: an agreement says what a vendor may do, and a record says what the model actually received on each screen. The agreement still has to cover the note, because the note is the part the coder must read.
The control does not replace the contract. The coding company still owes its own duties, the party that operates the environment belongs in the analysis if it holds the mapping, and the determination belongs to counsel. What the control removes is the part of the exposure a contract cannot reach: the identifiers a model would otherwise hold in a transcript, a summary or a later page.
Its scope is the rendered page. An agent that reaches the record through a direct API call is a different design with a different analysis. Columbia's DAPLab states that "trustworthy agent automation cannot be solved at a single layer of the stack," which is why the rendering step and the agreement are both needed (Columbia DAPLab, 2026).
What the record shows
An agent on a coding record is only as contained as what reaches its model: the rendered chart is where the patient's identifiers sit, so consistent tokens before that read, a named person approving each code change and claim submission, and an exported record are the three parts of the answer. The pages reviewed describe roles, reach and credential custody, and none describes a coding screen whose identifiers are replaced before the model reads it. The company's own agreement covers its handling of the record and not the model vendor's. One chart is enough to check it: open a test record in the agent, capture the screen the model received, the codes it proposed and the approval, and compare that capture with the fields the coder actually used; if the capture holds a real name or medical record number, the exposure happened before the approval.
Methodology and limitations
This page rests on HHS Office for Civil Rights guidance, the FBI's IC3 notice, vendor documentation from Zendesk, SAP and AWS, two research papers, Columbia's DAPLab and existing RedactSure research pages. Vendor pages were read between October 16, 2026 and October 22, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where each product applies its control.
No product named here was tested for this page, and "not described in the pages reviewed" means the pages listed in Sources. Vendor features change, so the page carries its date. The example describes a record type, a coding vendor's model pipeline, and not an organization. RedactSure is deploying now with enterprise and government customers. Whether an agent's reading meets a contractual or regulatory requirement belongs to counsel, assessors and the organization's own compliance officers, and nothing here replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
Can a medical coding company use AI agents on client records?
No, not on the agreement it already holds. The company is a business associate, and its provider agreement covers its own handling of the record; a model vendor that receives the rendered chart is a separate recipient that the agreement has to name. The work becomes governable when identifiers are replaced before the model reads the page, a named person approves each code change, and the company can show what the model received. One chart with test data tests all three.
What does the model receive from a rendered coding screen?
The whole frame the page draws: the patient banner with the name, medical record number and date of birth; the encounter note and problem list; the diagnosis and procedure codes; and the charge lines. The task needs the note, the codes and the amount, and the banner arrives with them. Unless the identifiers are replaced before the model reads the screen, they stay in its context for the rest of the run, including the summary and the claim draft.
Who approves a code change or a claim submission?
A named person at the coding company, not a queue default. The person should see the code, the note it came from, the claim it lands on and the screen the model used, and the approval should be recorded against those four things. Automation bias is the reason: a reviewer who clears a queue at production speed tends to over-rely on the suggestion. An approval that cannot show its evidence is a click, not a control.
What record exists of what the agent read?
The record the environment keeps, if there is one: the screen the model received, the tokens it worked with, the action it proposed and the person who approved, exported to the company's own monitoring. A vendor dashboard that shows the action but not the page answers half the question. Without that record, the company cannot tell whether the model read the banner or only the note, and it cannot show a client what left the record.
Does a role in the coding application control what the model reads?
No. A role decides which records an account may open, and the vendor pages describe roles in those terms. Once the record is open, the model receives whatever the screen renders, including the banner the role did not need for the task. A role is a control on reach; it is not a control on what the model is shown. The two questions have to be answered separately.
What if the model vendor will not sign a business associate agreement?
Then the record cannot go to that vendor. The company can still use an agent that runs against tokens and never sends the chart, or it can choose a vendor that will sign, but it cannot treat a refusal as a technical detail. The agreement is the instrument that makes the disclosure lawful, and a workspace setting or a no-training promise is not a substitute. The decision belongs to counsel and the compliance officer.
How RedactSure Keeps a Coding Chart's Identifiers Out of the Model
A coding company that hands its model vendor the rendered chart has already disclosed the patient's identity. In a SailPoint survey of 353 IT professionals, 80 percent said agents took unintended actions.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the chart renders the patient's name, medical record number and date of birth, and the model carries them into the code suggestions and the claim draft. Inside: the banner renders PATIENT_014 and MRN_0022, the diagnosis and procedure codes render as DX_001 and CPT_001, the note stays readable, and the model works on those tokens. Real values resolve only at the destination a reviewer approves, and that reviewer approves each code change and submission.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A coding screen that renders tokens gives the model the task without the patient's identity. Bring one chart and see, with test values, what the model receives, who approves the change and what the record holds. Book a demo