Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Can a State Agency Use AI Agents on Medicaid Records?
No, not while a state eligibility screen draws an applicant's name, date of birth and Social Security number into the model's context, because a Medicaid record is protected health information and a Privacy Act record at once. Check the system-of-records notice and the model contract, then require tokens on that screen and a named approver.
An eligibility worker opens a case, checks household income against the limit and records a determination. The screen in front of her holds the applicant's name, date of birth and Social Security number beside the income figure the check needs, and an agent given that task reads the page as it is drawn, so the model receives everything the page draws. The same case is a Privacy Act system of records, because the agency retrieves it by the individual's name, and the notice the agency publishes about that system already lists the categories of individuals and records it holds, each routine use and the safeguards around them. That notice is where the public record of the system begins, and it is the document an agency has to keep true when a vendor's agent starts working inside it. Two people carry the exposure: the beneficiary whose identifiers sit in a transcript, and the eligibility lead who has to explain a disclosure nobody wrote down. A scoped credential, a site allowlist and a filter on traffic to the model each leave the rendered page as it is, so the answer turns on whether the values on that screen are replaced before the model reads them. An agency should start that test with one eligibility screen, the record type used here.
Key findings
- For an eligibility or claims task to run without the applicant's identifiers entering the model's context, the values on the rendered screen would have to be replaced with consistent tokens before any model reads it, with the real values resolving only at the approved destination (What Is Render-Layer Tokenization?).
- It would also require a named person approving each determination, submission or payment the agent proposes, and a record of what the model received on each screen and who approved what (How Can Agencies Use AI on Privacy Act Records?).
- The gap sits at the screen: the vendor pages reviewed describe credentials held for an agent and AI traffic inspected at the model boundary, and none of them describes a state eligibility screen whose values are replaced before the model reads it (Doppler, 2026; CrowdStrike, 2026).
- Doppler's page says its product is built to "Give every coding agent its own scoped, read-only, expiring set of credentials," a control over what an agent holds that leaves open what a page renders (Doppler, 2026).
- CrowdStrike's Falcon Guardian page states that the product "identifies sensitive data in AI interactions and applies runtime controls to redact, encrypt, or block it before exposure," a control at the model boundary rather than on the screen behind it (CrowdStrike, 2026).
- An evaluation of autonomous web agents found that they "are prone to inadvertent use of unnecessary sensitive information" (Zharmagambetov et al., 2025), and an adaptive-attack study bypassed 12 published defenses with an "attack success rate above 90% for most" (Nasr et al., 2025).
What does an agent read on a Medicaid eligibility screen?
An eligibility determination is not one field. The screen draws an applicant banner with the name, date of birth and Social Security number, a household roster with each member's income, the eligibility category, a verification checklist and the reason for the determination. The task the agent was given, such as checking household income against the limit, sits inside that frame.
That frame is what the model receives. An evaluation of autonomous web agents found that they "are prone to inadvertent use of unnecessary sensitive information", which is what a screen that prints the identifier beside the task invites (Zharmagambetov et al., 2025). The agent does not choose the Social Security number; the number sits above the field it needs, and the model reads the page it is shown.
Minimum necessary speaks to the same point. The Privacy Rule requires a covered entity to "make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request" (Can Staff Use AI on Patient Records Without PHI?), and a design that sends a whole case screen into model context makes that showing hard.
| What the eligibility screen draws | What the determination needs | What the model receives without a control |
|---|---|---|
| Applicant name | The case to work | The legal name |
| Date of birth | Nothing | The full date |
| Social Security number | The key the system retrieves by | The number, unchanged |
| Household income | The figure compared with the limit | The figure and its source |
| Category and verification status | The rule applied and what is verified | Both fields |
| Determination reason | The reason the worker records | The text |
A screen rendered as tokens gives the agent the same task. The banner draws APPL_014 and SSN_002, the income figure, the category and the verification status stay readable, and the agent completes the check while the model holds values that mean nothing outside the environment (Can a Government Agency Allow Comet on Case Files?). Because the same token stands for the same applicant on every screen of the run, the agent can still match the case it opened to the case it works.
Is a Medicaid eligibility record a Privacy Act record as well as health information?
Both descriptions attach, and they attach to the same case. The Privacy Act defines a record as "any item, collection, or grouping of information about an individual that is maintained by an agency", and a system of records as "a group of any records under the control of any agency from which information is retrieved by the name of the individual" (DOJ, 2026). A Medicaid eligibility case meets both: it identifies a person, and the agency retrieves it by name or case number.
The statute requires a public description. Each agency must "publish in the Federal Register upon establishment or revision" a notice of "the existence and character of the system of records" that includes "the categories of individuals on whom records are maintained in the system" and "the categories of records maintained in the system" (Cornell Law School, 2026). The notice also carries the routine uses and the storage and access practices, which makes it the document to check.
A contractor is covered by the same section. When an agency provides by contract for the operation of a system of records, "the agency shall, consistent with its authority, cause the requirements of this section to be applied to such system" (GovInfo, 2026). An agent vendor operating an eligibility system, or a model vendor receiving its screens, sits inside that sentence rather than beside it.
A published notice shows how far the description reaches. The Federal Labor Relations Authority's notice records that its request system was replaced by "FOIAXPress, a commercial off-the-shelf product", and that the replacement "will shift storage of records to a FedRAMP-certified third-party cloud environment" (Federal Labor Relations Authority, 2023). A commercial product and a third-party cloud appear in the notice because the system of records is the unit the public is told about.
What do the vendors themselves say?
Two vendor pages bear on this question, and both describe a control that sits beside the rendered screen rather than on it.
Doppler's page for AI coding agents says the product is built to "Give every coding agent its own scoped, read-only, expiring set of credentials," a limit on what an agent holds rather than on what a page shows it (Doppler, 2026). The same page says credentials are "Injected at runtime instead of written to a .env, so agents can't read, log, or commit them," and it does not say whether an agent can read a variable injected into its own process. A state agency reading that page learns how a credential is scoped and nothing about the applicant's date of birth on the eligibility screen.
CrowdStrike's Falcon Guardian page states that the product "identifies sensitive data in AI interactions and applies runtime controls to redact, encrypt, or block it before exposure" (CrowdStrike, 2026). The limit is in the phrase the page uses: redaction and blocking apply to AI interactions on the way to or from a model, the page names no person who approves an action, and it does not describe rewriting the page an agent operates. A gate at the model boundary can stop a value that crosses it; it does not change what the eligibility screen draws.
The pages describe credentials held for an agent and AI traffic inspected at the model boundary; a state eligibility screen whose values are replaced before the model reads it is not described in the pages reviewed.
Which Medicaid tasks can run on placeholders?
Eligibility and claims work divides into two groups: tasks whose fields are administrative, and tasks whose fields are the identifiers themselves.
A prior authorization request is the clearest case. Under CMS-0057-F, Medicaid and CHIP fee-for-service and managed care plans, among others, must maintain a Prior Authorization API "populated with its list of covered items and services" that identifies documentation requirements and returns an approval, a denial with a reason or a request for more information, and decisions are due "within 72 hours for expedited (i.e., urgent) requests" and seven calendar days for standard ones (CMS, 2024). The fact sheet dates the API provisions to January 1, 2027, and excludes drug prior authorization.
Those fields are the ones the work needs: the item or service, the member's category, the dates and the determination status. The applicant's name, date of birth and Social Security number are not. A screen that renders APPL_014, SSN_002 and DOB_003 keeps every field the agent compares.
Inspection at the boundary fails sometimes, which is the reason to prefer tokens. A 2025 study bypassed 12 published defenses against jailbreaks and prompt injections with an "attack success rate above 90% for most" (Nasr et al., 2025), and what an attacker collects when a filter fails depends on what the model already holds.
A survey of 353 IT professionals found that 80 percent of organizations said agents took unintended actions and about 40 percent said agents accessed unintended systems (How Do You Test Whether an AI Agent Can Reach Data Outside Its Assigned Task?), which is the failure a tokenized screen limits rather than prevents. The Data, Agents, and Processes Lab at Columbia puts the general point: "Agents turn every layer of the stack into a semantic quality problem," and "trustworthy agent automation cannot be solved at a single layer of the stack" (DAPLab, 2026).
What should an agency ask a vendor for in writing about what the agent reads?
Five questions turn a vendor conversation into something a contracting officer and a privacy officer can file.
- What the model receives from the rendered eligibility screen, field by field, including the banner fields the task does not need.
- Whether the contract makes the vendor's system part of the agency's system of records, and whether the model provider is a party to the agreement. The Privacy Act puts the duty on the agency to cause the section to apply to a contractor's system (GovInfo, 2026), and a business associate is "a person or entity that creates, receives, maintains or transmits PHI on behalf of a covered entity" under 45 CFR 160.103 (Does an AI Model Vendor Need a BAA for Patient Records?). The definition follows the data, so a model provider that receives the screen is inside it.
- Where the mapping from token to value lives, and who can resolve it. A mapping the vendor holds is the record under another name.
- Who approves each determination, submission or payment, and whether the approval names the person.
- What record shows what the model received on each screen, and whether it exports to the agency's own monitoring.
The contract question has a record behind it: 123.9 million of the 220.0 million people affected by large healthcare breaches in 2025 and 2026, 56.3 percent, were exposed in breaches that came through a business associate, counted only for breaches of 500 or more people and on a self-reported flag (How Many Healthcare Breach Victims Were Exposed Through a Vendor?).
Vendors answer the first question least often, because it asks about a page rather than a policy. OMB's M-25-21, issued in April 2025, directs agencies to accelerate federal AI use with Chief AI Officers and risk-management practices for high-impact AI (How Can Agencies Use AI on Privacy Act Records?); 62 percent of organizations are at least experimenting with AI agents and 23 percent are scaling them anywhere, and an agency that has not settled the five questions is in the first group (What Is the PII Wall?).
What does a governed environment change?
A governed environment is a control class that acts where the page is drawn, before any model reads it. The values a policy names are replaced with consistent tokens for the whole run, so the eligibility screen renders APPL_014, SSN_002 and DOB_003 while the income figure, the category and the verification status stay readable. Real values resolve only at an approved destination, at the moment of an approved action, and the determination the agency records is such a destination. A named person approves each determination, submission and payment, and every screen the model was shown, every action and every approval lands in a record that exports to the agency's own monitoring.
For this question, the control changes two things a notice cannot. The first is what the model receives: a screen that draws tokens leaves the model without the identifiers, while the notice still describes the categories of records the system holds. The second is the record: a system-of-records notice says what the agency keeps and who may see it, and a per-run record says what the model actually received on each screen and who approved the action.
Its scope is the rendered page. An agent that reaches the same data through a bulk extract or a direct API call is a different design with a different analysis, and the contract questions remain the agency's to settle. A tool that inspects traffic at the model boundary is the nearest control class beside it, and the comparison for that design sets out where each one sits (RedactSure vs CrowdStrike: 2026 Comparison & Alternative).
What the record shows
What decides the answer is what the model receives from the rendered eligibility screen, not which model reads it and not what the contract calls the vendor. A screen that prints the applicant's name, date of birth and Social Security number hands all three to the model, and the case it belongs to is retrieved by that name. A screen that draws APPL_014 and SSN_002 hands over tokens, and the determination still completes because the income figure and the category stay readable. An agency can test this in an afternoon: name one eligibility task, capture the page the model is given, list every field on it, and mark the ones the determination does not need. Then ask the vendor which of those fields its model sees, and write the answer beside the capture.
Methodology and limitations
This page rests on the Privacy Act as published by the Legal Information Institute and the Government Publishing Office, the Department of Justice's overview of its definitions, one agency's Federal Register notice, CMS's fact sheet for the prior authorization rule, two vendor product pages, two research papers, one lab page, and existing RedactSure research pages. Public documentation read in full gives a sound view of where each product applies its control. Vendor pages were read between October 16, 2026 and October 23, 2026, and each Sources line carries the date for its page.
No product on this page was tested for this page. Where the page says a behavior is not described in the pages reviewed, the recorded facts do not cover it. Vendor features change after the page's date. RedactSure is deploying now with enterprise and government customers. The example describes a record type, a Medicaid eligibility screen, and not an organization. Determinations about whether a workflow meets a legal, contractual or program requirement belong to counsel, assessors and the agency's own privacy and security officers, and nothing here replaces a pilot on the agency's own screens.
Frequently asked questions
Can a state agency use AI agents on Medicaid records?
No, not while the rendered screen shows the applicant's identifiers to the model. The record is protected health information and a Privacy Act record at once, and a model that receives the name, date of birth and Social Security number holds them for the rest of the run. The answer changes when those values are replaced with consistent tokens before the model reads the page, a named person approves each determination, and a record of what the model received exports to the agency.
Is a Medicaid eligibility case a Privacy Act system of records?
Yes, when the agency retrieves the case by the individual's name or case number. The Act defines a system of records as records under an agency's control from which information is retrieved by the name of the individual, and a Medicaid eligibility case identifies a person and is retrieved that way. The agency's published notice then lists the categories of individuals and records the system holds and each routine use. Whether a vendor's system falls inside the notice is settled in the contract.
Does a business associate agreement cover what the model reads?
Only where the model provider is a party to it. A business associate is an entity that creates, receives, maintains or transmits PHI for a covered entity, and the definition follows the data rather than the technology. A provider that never receives the identifiers, and holds no key that resolves them, is not receiving PHI in that flow. A reseller's agreement with the agency does not cover the model provider behind it, so ask for the chain of signatures rather than one.
What record shows what the model received?
Usually none, unless the design produces one. The vendor pages reviewed describe credentials scoped for an agent and AI traffic inspected at the model boundary, and neither describes a per-screen record of what the model was shown. An agency that wants one has to ask for it in the contract and check that it exports to its own monitoring. Without that, an answer to a beneficiary's question rests on the vendor's summary of the run.
Who approves an agent's determination?
A named person, if the design has one. The approval separates an agent that proposes a change from one that makes it, and it matters more in an eligibility case because the change alters a person's coverage. Ask whether the approval names the person, what that person sees before approving, and whether a rejected determination is recorded. A shared role account that approves its own work is not an approval.
Can an eligibility screen be tokenized without breaking the check?
Yes, when the token stands in consistently for the whole run. The determination compares income with a limit, applies a category and records a reason, and none of those fields is the applicant's name or number. A screen that draws APPL_014 and SSN_002 keeps the figures and the status readable while the identifiers stay behind the render. The check breaks only when the same applicant carries a different token on the next screen.
How RedactSure Keeps an Eligibility Screen's Identifiers Out of the Model
An agent asked to check income reads the applicant's name, date of birth and Social Security number because the screen prints them beside the income field. Web agents "are prone to inadvertent use of unnecessary sensitive information," which is what an eligibility screen invites.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the agent opens the case and holds the name, date of birth and Social Security number for the rest of the run. Inside the governed environment: the banner draws APPL_014 and SSN_002, the income figure and the category stay readable, and a named person approves the determination.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
An eligibility screen that prints a Social Security number puts it in every summary the model writes. Bring one eligibility task your team runs and see, with test values, what the model reads and where the real values resolve. Book a demo