Let AI agents work near patient and trial data without letting the data out.

01The problem: agents next to ePHI and regulated records

Agents draft clinical documentation, fill in prior-authorisation paperwork, analyse research data and write lab and trial software. Much of that work sits next to electronic protected health information (ePHI) or records that fall under GxP rules. An agent on a shared workstation, with the network open and a model API key in its environment, can copy a record anywhere and leave no trustworthy trace.

The HIPAA Security Rule's audit controls standard, 45 CFR 164.312(b), asks for mechanisms that record and examine activity in information systems that contain or use ePHI. For FDA-regulated electronic records, 21 CFR 11.10(e) asks for secure, computer-generated, time-stamped audit trails. kosa8 supports evidence for controls like these; meeting them is the job of your whole program.

02Contain the data path

Mount only the data set the task needs, read-only where possible, and allow only the hosts the agent must reach. The rule is enforced on the host, not inside the VM, and refused connections are audited.

03Keep prompts on site with a local model

kosa8 model pulls and serves models on the same machine through a gateway on 127.0.0.1 port 7434 that speaks the OpenAI and Anthropic APIs. Prompts and records then go no further than the machine they are on.

04Encrypt what you keep, wipe what you are done with

Snapshots hold a sandbox's memory as well as its disks, so kosa8 encrypts them itself with AES-256-GCM, and a signed policy can require it. Live sandbox disks rely on FileVault or LUKS, which kosa8 doctor --compliance checks. When the work ends, a wipe overwrites and verifies the sandbox's disks and records it in the audit log.

05IQ and OQ records for validated work

kosa8 validate generates an Installation Qualification record from the environment itself (versions, image digests, packages, egress policy, the snapshot's seal) and runs your Operational Qualification protocol in a clone of the validated snapshot, so the validated state is never modified. Records are signed with a stated meaning (executed, reviewed or approved) and verify offline. kosa8 does not make anything validated: validation is your company's act, and these records are evidence your QA reviews.

06An audit trail that shows tampering

Each entry records who asked (human, agent or tool), what they asked and the result, chained by hash and authenticated with an HMAC key. kosa8 audit verify names the entry where a chain breaks, and an evidence package for one sandbox can be checked by someone who does not run kosa8.

07How to start

Begin with de-identified or synthetic data on one machine, and turn on disk encryption first.

1. Install kosa8 on an Apple silicon Mac or x86-64 Linux, then start the daemon.

   curl -fsSL https://kosa8.com/install.sh | shCOPY kosa8 daemon startCOPY

2. Create a sandbox with one read-only data folder and no network, then check the machine against the hardening baseline.

   kosa8 sandbox create analysis --mount ~/data/deid:/work:ro --egress denyCOPY kosa8 doctor --complianceCOPY

08Questions

Does kosa8 make an AI workflow meet HIPAA?

No software does that alone: HIPAA obligations fall on covered entities and business associates and are met by their whole set of safeguards. kosa8 supports evidence for technical safeguards such as audit controls, and it runs on your hardware with no telemetry, so the software does not send your sandboxes, files or audit logs to kosa8.

Does kosa8 validate our system for GxP?

No. Validation is the regulated company's act under its own quality system. kosa8 generates installation and operational qualification records, signed and verifiable offline, as evidence your QA reviews and approves.

Can the model run locally?

Yes. kosa8 model pull downloads a model and kosa8 model serve serves it on 127.0.0.1 port 7434 with OpenAI- and Anthropic-compatible APIs, so prompts and data stay on the machine.

What happens to patient data when the agent's work is finished?

kosa8 sandbox rm --wipe overwrites and verifies a sandbox's disks and records the wipe in the audit log, and kosa8 snapshot rm --wipe crypto-shreds an encrypted snapshot. Disks of running sandboxes are protected by FileVault or LUKS, which kosa8 doctor --compliance checks.

09Further reading

• How do I run an AI agent sandbox on my own machine instead of the cloud?
• How do I run a coding agent with a local model?
• How do I restrict an AI agent's network access to an allow-list?
• How do I give an AI agent API keys without exposing them?
• AI agents in hospitals and pharma: security risks and practical controls
• What an audit log for AI agents should record

10Sources

• eCFR: 45 CFR 164.312, technical safeguards (HIPAA Security Rule)
• eCFR: 21 CFR Part 11, electronic records and electronic signatures
• kosa8 docs: Local models
• kosa8 docs: Audit log

11Get kosa8

Install kosa8 on one machine and run a first agent against de-identified data. Enterprise terms are on the pricing page.