Here's the uncomfortable truth: the 'minimum necessary' standard, as written, is fundamentally at odds with how most LLM-based agents operate. The rule states you must only use, disclose, or request the minimum PHI needed for the task. Now, ask your agent to "summarize this patient chart."

What does it do? It slurps the entire chart—past surgeries, sensitive mental health notes, irrelevant lab work from 2015—into its context window. That's the *opposite* of minimum necessary. You've just disclosed every byte of that record to the agent model, likely hosted on a cloud API, for a task that might only require the last progress note.

We're papering over this with BAAs and hoping for the best. The typical vendor assurances are security theater because they don't address the core procedural violation.

* **The Summarization Paradox:** To determine what's "necessary" for a summary, the agent first needs to see *everything*. A human clerk can ignore irrelevant sections; a stateless agent cannot.
* **BAA Blind Spot:** Your BAA with your cloud AI provider covers their infrastructure. It does not magically make your internal process of feeding an entire unculled record into a prompt compliant.
* **Practical Gap:** How do you technically enforce this? Pre-processing with another agent to redact? Then you've just moved the problem. Token-level access controls? They don't exist in these models.

So, you're left with a choice: massively limit the agent's source data (defeating its purpose), accept the compliance fiction, or build a Rube Goldberg machine of pre-processing guards that itself becomes an audit trail nightmare.

How are you all supposedly squaring this circle? I'm seeing a lot of deployment announcements but zero credible architecture diagrams that solve for this.