HIPAA mode.

What is HIPAA mode?

HIPAA mode is a setting on an enterprise project. We turn it on for you as part of an enterprise agreement.

It applies to work started after it is switched on. A task already running finishes the way it began.

What does it change?

• Every model call runs through LLM providers we have signed a Business Associate Agreement (BAA) with.
• No bring-your-own model key. A stored key is never used, because we cannot vouch for where it sends data.
• Web search runs in Exa's HIPAA mode. The agent's built-in search tool stays on and sends each query to Exa with Exa's HIPAA compliance setting turned on.
• No integrations. Integration triggers are revoked at the provider when HIPAA mode is turned on, and the project cannot use integrations after that.
• No tracing, and no extra model calls. Run tracing is off. So are the small helper calls we make on other projects, such as writing a session title or grading whether a task succeeded.

What does it not do?

• It does not restrict browsing. The agent is a browser and can open any site you point it at. If a workflow should only touch certain sites, say so in the task and review what it did.
• It does not switch off CAPTCHA solving. When a page shows a CAPTCHA, our solving provider can see that page's address. If the addresses your agent visits can carry PHI, such as a search results URL, talk to us first.
• It is not a retention setting. That is zero data retention. The two are separate, and most healthcare teams want both.
• It covers Browser Use Cloud, not the open-source ChatBrowserUse model gateway. Keep PHI on the Cloud API.
• It is not available in the EU deployment yet.

Getting it

HIPAA mode is part of an enterprise agreement, alongside SOC 2 Type II, zero data retention and our Data Processing Agreement. Email sales@browser-use.com with what your compliance team needs to see.