By: Brandon Cortright, Senior Staff AI Builder
As a patient, you should never have to explain yourself twice. Reminding an agent that you can only take evening appointments, every time, is the kind of friction that sends people into a long hold queue instead of finishing the task with a virtual agent. Cutting that friction drives down abandonment, and it’s a big part of why agentic memory matters to us at Artera.
But agent memory itself is a commodity; the hard part, and the part that matters in healthcare, is managing memory securely. That reflects a broader principle in how we build.
Memory is a commodity
Every engineering org lives with the Iron Triangle: innovate quickly, cheaply, or with high quality – and balance the three. Healthcare IT constrains that balance for us, prioritizing quality (security) over cost or velocity. Above all, we’ve had one consistent guiding light in our approach to agents since the start: keeping our patients’ data secure.
Our rule of thumb is that we don’t rebuild what we can responsibly buy. Training a foundation model from scratch is an enormous, multi-hundred-million-dollar undertaking, so we buy our models from the cloud hyperscalers rather than train our own, then deploy the most capable ones available with safety and guardrails built in. We made the same call when RAG systems took off. Memory is the latest instance of that pattern.
It helps to be precise about what memory is, because the hype muddles it. Memory is not training; you would never encode a patient’s PHI or personal preferences into a model’s training set, and we do not. Most people use “agent memory” to mean a context layer that lets an agent recall relevant details across a conversation or between visits.
The cloud hyperscalers offer this off the shelf, at no cost. Amazon Bedrock AgentCore Memory is one example, but a simple Google search will yield dozens of specialized options like Mem0, Zep, Letta, and LangMem. It is a consumer-grade, commodity infrastructure that costs virtually nothing, so we use what’s available off the shelf. Any attempt at making “memory” feel novel or hard is the AI-age equivalent of a snake oil salesman.
The real work is doing it securely
Building on a managed, cloud-native memory layer keeps our costs low and our patient experience high. The hard part, and the part we invest in heavily, is making it safe. Here’s how:
A deterministic patient identity [our privacy guard]. Everything starts with knowing who we are talking to. We implement a keyed HMAC rather than a plain hash of a patient ID, since a plain hash, though deterministic, is vulnerable to pre-computed rainbow tables. Our IDs are internally generated and not tied to any external patient identifier, and a platform-managed pepper keeps the hash non-invertible. This ensures a reliable way to map a patient to an actor and prevent anyone who knows the hashing strategy from reversing the hash.
Defense-in-depth [our syntactic guard]. Our agents are designed to fail safe: when identify is uncertain, they default to no recall at all. If verification is inconclusive, the agent proceeds as if it has never met the patient. If something upstream breaks, say we’re provided an empty pepper, the system fails entirely. We use AI to monitor our repositories so a seed is never leaked; if a leak is detected, every hash refuses to run.
Multi-tenant isolation by design. No agent is ever aware of another client’s infrastructure. Every agent lives in its own tenant’s isolated cloud account, so a compromise in one tenant yields zero information gain in another. Anything that does not resolve to a real tenant is discarded, which blocks replay attacks and prevents context building inside an anonymous “null patient.”
Observability that is private by construction. Our audit records carry no PHI by construction. We assign correlation fields and omit data points like actor IDs, PHI, and environment variables, which preserves our HIPAA-compliant logging invariant while still giving us a real-time, analyzable feed to catch anything going wrong with a live agent.
The takeaway
An agent that remembers things is a fun demo, implementable in a few minutes of vibe-coding and by no means worthy of a press release. A security P0 mindset is what puts an agentic company on the board. And in our never-ending quest to separate hype from reality, we’d rather tell you the truth than dress a commodity up as magic.
